[
  {
    "title": "Ultimate Member \u003c 2.0.4 - Insecure Direct Object Reference",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-0590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0590",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Management Tickets Booking \u003c= 1.4.3 - Unauthenticated Information Exposure",
    "slug": "event-monster",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5059",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Popup Surveys \u0026 Polls for WordPress (Mare.io)  \u003c= 1.36 - Missing Authorization",
    "slug": "popup-surveys",
    "type": "plugin",
    "affected_version": "* - 1.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55998",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Ebook Store \u003c 5.78 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "[*, 5.78)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.78",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-22690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22690",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventin \u003c= 4.0.25 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39584",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Product Table Lite \u003c= 3.9.4 - Unauthenticated Arbitrary Shortcode Execution \u0026 Reflected Cross-Site Scripting",
    "slug": "wc-product-table-lite",
    "type": "plugin",
    "affected_version": "* - 3.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13472",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "ACF Front End Editor \u003c= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update",
    "slug": "acf-front-end-editor",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3072",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47366",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PostX \u003c= 4.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 4.1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31096",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup by Supsystic \u003c= 1.10.27 - Missing Authorization",
    "slug": "popup-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.10.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31421",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PublishPress Authors \u003c= 4.7.5 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "publishpress-authors",
    "type": "plugin",
    "affected_version": "* - 4.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47496",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "College publisher Import \u003c= 0.1 - Arbitrary File Upload",
    "slug": "college-publisher-import",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24254",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Debug Log Manager \u003c= 2.2.1 - Missing Authorization",
    "slug": "debug-log-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6136",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "BitFire \u003c= 4.5 - Unauthenticated Information Exposure",
    "slug": "bitfire",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6722",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Advanced Database Cleaner PRO \u003c= 3.2.10 - Authenticated (Subscriber+) Limited Path Traversal",
    "slug": "advanced-database-cleaner-pro",
    "type": "plugin",
    "affected_version": "* - 3.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46256",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Widgetize Pages Light \u003c= 3.0 \u0026 Widgets as Shortcodes \u003c= 5.9.10 - Reflected Cross-Site Scripting",
    "slug": "widgetize-pages-light",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32117",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widgetize Pages Light \u003c= 3.0 \u0026 Widgets as Shortcodes \u003c= 5.9.10 - Reflected Cross-Site Scripting",
    "slug": "widgets-as-shortcodes",
    "type": "plugin",
    "affected_version": "* - 5.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32117",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Review Stream \u003c= 1.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "review-stream",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32680",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AutomatorWP – Automator plugin for no-code automations, webhooks \u0026 custom integrations in WordPress \u003c= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation",
    "slug": "automatorwp",
    "type": "plugin",
    "affected_version": "* - 5.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9539",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YML for Yandex Market \u003c= 4.7.2 - Reflected Cross-Site Scripting",
    "slug": "yml-for-yandex-market",
    "type": "plugin",
    "affected_version": "* - 4.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9378",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Omnipress \u003c= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "omnipress",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49278",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Optinly \u003c= 1.0.15 - Cross-Site Request Forgery",
    "slug": "optinly",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41134",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPML \u003c= 3.6.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-18069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-18069",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ibtana – WordPress Website Builder \u003c= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute",
    "slug": "ibtana-visual-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8282",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Społecznościowa 6 PL 2013 \u003c= 2.0.6 - Cross-Site Request Forgery",
    "slug": "spolecznosciowa-6-pl-2013",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53329",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Travel Management \u003c= 1.6.1 - Open Redirect",
    "slug": "nd-travel",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15773",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ANAC XML Bandi di Gara \u003c= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "avcp",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47242",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Tag Manager for WordPress (GTM4WP) \u003c= 1.15.1 - Stored Cross-Site Scripting via Content Element ID",
    "slug": "duracelltomi-google-tag-manager",
    "type": "plugin",
    "affected_version": "* - 1.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1961",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Gravity Forms Salesforce \u003c= 1.4.7 - Open Redirect",
    "slug": "gf-salesforce-crmperks",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30953",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Dynamic Pricing and Discounts \u003c= 2.4.1 - Unauthenticated Settings Import/Export",
    "slug": "wc-dynamic-pricing-and-discounts",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4353",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Magical Addons For Elementor \u003c= 1.2.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template",
    "slug": "magical-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10352",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Crontrol - 1.17.0 - 1.19.1 - Authenticated (Administrator+) Blind Server-Side Request Forgery",
    "slug": "wp-crontrol",
    "type": "plugin",
    "affected_version": "1.17.0 - 1.19.1",
    "from_version": "1.17.0",
    "from_inclusive": true,
    "to_version": "1.19.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8678",
    "auth_type": "Privileged",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Custom Smilies \u003c= 2.9.2 - Reflected Cross-Site Scripting",
    "slug": "custom-smilies-se",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28917",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DW Question \u0026 Answer Pro \u003c= 1.3.4 - Cross-Site Request Forgery",
    "slug": "dw-question-answer-pro",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24805",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP SVG Upload \u003c= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "wp-svg-upload",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11847",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Twitter Feed – Twitter feeds plugin for WP \u003c= 1.2.6 - Authenticated (Contributor+) Post Exposure",
    "slug": "easy-twitter-feeds",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10666",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Better Elementor Addons \u003c= 1.4.1 - Authenticated(Contributor+) Local File Inclusion",
    "slug": "better-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-33541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33541",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PDF-Rechnungsverwaltung \u003c= 0.0.1 - Unauthenticated Local File Inclusion",
    "slug": "pdf-rechnungsverwaltung",
    "type": "plugin",
    "affected_version": "* - 0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49287",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gift Certificate Creator \u003c= 1.1.0 - Reflected Cross-Site Scripting via receip_address Parameter",
    "slug": "gift-certificate-creator",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2483",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customify \u003c=  2.10.4 - Cross-Site Request Forgery to Settings Update",
    "slug": "customify",
    "type": "plugin",
    "affected_version": "* - 2.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27633",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PowerPack Elementor Addons (Free Widgets, Extensions and Templates) \u003c= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1512",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Team Manager \u003c= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-team-manager",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58840",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order date time for WooCommerce \u003c= 3.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pi-woocommerce-order-date-time-and-type",
    "type": "plugin",
    "affected_version": "* - 3.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28991",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SALESmanago \u003c= 3.8.1 - Missing Authorization",
    "slug": "salesmanago",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57971",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "EventON \u003c= 2.2.14 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33940",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NetInsight Analytics Implementation Plugin \u003c= 1.0.3 - Cross-Site Request Forgery",
    "slug": "netinsight-analytics-implementation-plugin",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52767",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Highlight \u003c= 1.0.29 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "highlight",
    "type": "theme",
    "affected_version": "* - 1.0.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37458",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator \u003c= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "feedzy-rss-feeds",
    "type": "plugin",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6801",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Warranty Requests \u003c= 2.1.6 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-warranty",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-33317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33317",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "ProfileGrid  \u003c= 5.9.5.2 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49877",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Snap App \u003c= 1.5 - Cross-Site Scripting",
    "slug": "wpsnapapp",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4596",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Featured Images \u003c= 13.7.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Thumbnail Deletion/Setting",
    "slug": "quick-featured-images",
    "type": "plugin",
    "affected_version": "* - 13.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3664",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ads by WPQuads \u003c= 2.0.87.1 - Unauthenticated SQL Injection",
    "slug": "quick-adsense-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.0.87.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.87.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30876",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Nexter Blocks \u003c= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "the-plus-addons-for-block-editor",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tabs For WPBakery Page Builder \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tabs-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37936",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \u003c= 4.89 - Unauthenticated SQL Injection via oid",
    "slug": "ap-plugin-scripteo",
    "type": "plugin",
    "affected_version": "* - 4.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6437",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "EWWW Image Optimizer \u003c= 2.8.4 - Remote Code Execution",
    "slug": "ewww-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-20010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-20010",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Instantio \u003c= 3.3.16 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "instantio",
    "type": "plugin",
    "affected_version": "* - 3.3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47550",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Booking Calendar \u003c= 1.7.0 - Authenticated SQL Injection",
    "slug": "advanced-booking-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1006",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Greeklish-permalink \u003c= 3.3 - Missing Authorization via cyrtrans_ajax_old AJAX action",
    "slug": "greeklish-permalink",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2495",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jobmonster \u003c= 4.7.9 - Authentication Bypass",
    "slug": "noo-jobmonster",
    "type": "theme",
    "affected_version": "* - 4.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-54738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54738",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Show Visitor IP Address \u003c= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "show-visitor-ip-address",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50538",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Links Lite \u003c= 3.1.0 - Reflected Cross-Site Scripting",
    "slug": "affiliate-links",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32639",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directorist \u003c= 7.8.6 - Missing Authorization",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33929",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1957",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NitroPack \u003c= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compression_ajax Function",
    "slug": "nitropack",
    "type": "plugin",
    "affected_version": "* - 1.18.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8778",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Telephone Number Linker \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "telephone-number-linker",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5743",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Generator : Creative form builder for WordPress \u003c= 2.1.86 - Cross-Site Request Forgery",
    "slug": "contact-form-generator",
    "type": "plugin",
    "affected_version": "* - 2.1.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-6965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6965",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Ultimate Addons for WPBakery \u003c= 3.19.17 - Cross-Site Request Forgery",
    "slug": "Ultimate_VC_Addons",
    "type": "plugin",
    "affected_version": "* - 3.19.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51402",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 5.12.7 - Authenticated (Subscriber+) Information Exposure",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 5.12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0911",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Asgaros Forum \u003c= 3.1.0 - Authenticated (Subscriber+) Authorization Bypass",
    "slug": "asgaros-forum",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32227",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Total Poll Lite \u003c= 4.8.6 - Cross-Site Request Forgery",
    "slug": "totalpoll-lite",
    "type": "plugin",
    "affected_version": "* - 4.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27449",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ARForms Form Builder \u003c= 1.6.7 - Reflected Cross-Site Scripting",
    "slug": "arforms-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37920",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donate Me \u003c= 1.2.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "donate-me",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31778",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.8.21 - Authenticated(Editor+) Arbitrary File Upload",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.8.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-40219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40219",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CYAN Backup \u003c= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cyan-backup",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9662",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \u003c= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Panel Slider Widget",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy SVG Allow \u003c= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "easy-svg-image-allow",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7089",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Users \u003c= 1.4 - Cross-Site Request Forgery to Settings Update",
    "slug": "wordpress-users",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6390",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ExS Widgets \u003c= 0.3.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "exs-widgets",
    "type": "plugin",
    "affected_version": "* - 0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-38715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38715",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution \u003c= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5259",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager \u003c= 4.71 - Insecure Direct Object Reference to Information Exposure",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3749",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Comment Reply Email \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "comment-reply-email",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35773",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Database Backup \u003c= 4.3.2 - Cross-Site Request Forgery",
    "slug": "wp-database-backup",
    "type": "plugin",
    "affected_version": "[*, 4.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10874",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sliding Social Icons \u003c= 1.61 - Cross-Site Request Forgery and Stored Cross-Site Scripting",
    "slug": "sliding-social-icons",
    "type": "plugin",
    "affected_version": "* - 1.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.61",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9437",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Datepicker \u003c= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-datepicker",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44042",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beds24 Online Booking \u003c= 2.0.25 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "beds24-online-booking",
    "type": "plugin",
    "affected_version": "* - 2.0.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51664",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Streamit \u003c= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "streamit",
    "type": "theme",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2519",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Weblizar Pin Feeds \u003c 1.1.2 - Cross-Site Request Forgery",
    "slug": "weblizar-pinterest-feeds",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-5656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5656",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Meta Data Manager \u003c=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion",
    "slug": "post-meta-data-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5426",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Product Catalog Feed by PixelYourSite \u003c= 2.1.0 - Reflected Cross-Site Scripting via 'edit'",
    "slug": "product-catalog-feed",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1804",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 3.9.7 - Unauthenticated SQL Injection",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-3077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3077",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) \u003c= 3.1.87 - Cross-Site Request Forgery",
    "slug": "mailin",
    "type": "plugin",
    "affected_version": "* - 3.1.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8477",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IP Ban \u003c= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "simple-ip-ban",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9413",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Vodpod Video Gallery \u003c= 3.1.7 - Reflected Cross-Site Scripting",
    "slug": "vodpod-video-gallery",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2010-4875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4875",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin \u003c= 5.7.23 - Unauthenticated SQL Injection via optin",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.23",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5756",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Apimo Connector \u003c= 2.6.3.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "apimo",
    "type": "plugin",
    "affected_version": "* - 2.6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31602",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Time Slots Booking Form \u003c= 1.2.10 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-time-slots-booking-form",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-35734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35734",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Retain Live Chat \u003c= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "retain",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3391",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Popup Newsletter \u003c= 1.4.7 - Reflected Cross-Site Scripting",
    "slug": "simple-popup-newsletter",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34658",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-PManager \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "wp-programmmanager",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13875",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Slider Feed \u003c= 2.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "instagram-slider-widget",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10149",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation \u003c= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "optinmonster",
    "type": "plugin",
    "affected_version": "* - 2.16.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4045",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sided \u003c= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sided",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50554",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "I Plant A Tree \u003c= 1.7.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "i-plant-a-tree",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54331",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form \u003c= 2.10.1 - Unauthenticated Insecure Direct Object Reference to Form Submission Alteration",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1640",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Funnel Builder by FunnelKit \u003c= 3.10.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "funnel-builder",
    "type": "plugin",
    "affected_version": "* - 3.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49034",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Small Package Quotes – USPS Edition \u003c= 1.3.5 - Unauthenticated SQL Injection",
    "slug": "small-package-quotes-usps-edition",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13533",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Madara - Core \u003c= 2.2.3 - Unauthenticated Arbitrary File Deletion",
    "slug": "madara-core",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7712",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "ProfileGrid \u003c= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3714",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Migration Plugin DB \u0026 Files – WP Synchro \u003c= 1.9.1 - Cross-Site Request Forgery",
    "slug": "wpsynchro",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41660",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woocommerce OpenPos \u003c= 7.0.1 - Missing Authorization to Information Exposure",
    "slug": "woocommerce-openpos",
    "type": "plugin",
    "affected_version": "* - 7.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37935",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Hueman Addons \u003c= 2.3.3 - Authenticated (Contributor+) Stored Cross Site Scripting",
    "slug": "hueman-addons",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4784",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Google Analytics Extension \u003c= 4.0.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "mainwp-google-analytics-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23651",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PPOM for WooCommerce \u003c= 33.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "woocommerce-product-addon",
    "type": "plugin",
    "affected_version": "* - 33.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "33.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24668",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schedule Posts Calendar \u003c= 5.2 - Cross-Site Request Forgery",
    "slug": "schedule-posts-calendar",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40556",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 5.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 5.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39555",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adifier System \u003c 3.1.4 -  Unauthenticated Local File Inclusion",
    "slug": "adifier-system",
    "type": "theme",
    "affected_version": "[*, 3.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-49753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49753",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Hotel Booking \u003c= 2.0.7 - Missing Authorization to (Subscriber+) Arbitrary Post Deletion",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5651",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Theme File Duplicator \u003c= 1.3 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "theme-file-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27282",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tiger Forms \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "tiger-form",
    "type": "plugin",
    "affected_version": "[*, 2.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44474",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter \u003c= 8.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "* - 8.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3583",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kimili Flash Embed \u003c= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kimili-flash-embed",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37221",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "multi Scheduler \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "multi-scheduler",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-13426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13426",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Gum Elementor Addon \u003c= 1.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gum-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30800",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Noindex Nofollow Tool \u003c= 1.1.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "ultimate-noindex-nofollow-tool",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7196",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Featured Images \u003c= 13.7.2 - Insecure Direct Object Reference to Image Manipulation",
    "slug": "quick-featured-images",
    "type": "plugin",
    "affected_version": "* - 13.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11176",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WishList Member X \u003c= 3.25.1 - Unauthenticated Arbitrary SQL Execution",
    "slug": "wishlist-member-x",
    "type": "plugin",
    "affected_version": "* - 3.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37112",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Ninja Forms Google Sheet Connector \u003c= 1.2.6 - Reflected Cross-Site Scripting",
    "slug": "gsheetconnector-ninja-forms",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2333",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Google Sheet Connector \u003c= 1.2.6 - Reflected Cross-Site Scripting",
    "slug": "gsheetconnector-ninja-forms-pro",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2333",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Move Addons for Elementor \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "move-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56254",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Custom Cursors \u003c= 3.1 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-custom-cursors",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2221",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 5.16.4 - Authenticated Arbitrary File Upload leading to Remote Code Execution",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 5.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.16.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24145",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Arconix Shortcodes \u003c= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "arconix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooTumblog \u003c= 2.1.4 - Missing Authorization to Unauthenticated Content Injection",
    "slug": "woo-tumblog",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31729",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Prime Addons for Elementor \u003c= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode",
    "slug": "prime-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13855",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Hostel \u003c= 1.1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "hostel",
    "type": "plugin",
    "affected_version": "* - 1.1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0545",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search Exclude \u003c= 1.2.3 - Arbitrary Settings Change",
    "slug": "search-exclude",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15895",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "CodeBard Help Desk \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "codebard-help-desk",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22760",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Text Slider \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-text-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58882",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Categories Assign \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "bulk-categories-assign",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23582",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hotel Booking \u003c= 2.0.9.2 - Missing Authorization",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 2.0.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30508",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "affiliate-toolkit \u003c= 3.4.2 - Unauthenticated Server-Side Request Forgery",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5877",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Accordions – Multiple Accordions or FAQs Builder \u003c= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'pages' parameter",
    "slug": "accordions-or-faqs",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45082",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Security \u0026 Malware scan by CleanTalk \u003c= 2.149 - Unauthenticated Arbitrary File Upload",
    "slug": "security-malware-firewall",
    "type": "plugin",
    "affected_version": "* - 2.149",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.149",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13365",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SMSAlert - WooCommerce \u003c= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode",
    "slug": "sms-alert",
    "type": "plugin",
    "affected_version": "* - 3.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10233",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customizer Export/Import \u003c= 0.9.5 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "customizer-export-import",
    "type": "plugin",
    "affected_version": "* - 0.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1347",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads – Per Product Emails \u003c 1.0.9  - Cross-Site Scripting",
    "slug": "edd-per-product-emails",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9520",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8979",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) \u003c 2.3.1 - Cross-Site Scripting",
    "slug": "leaflet-maps-marker",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-2913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2913",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.9.3 - Authenticated(Editor+) SQL Injection",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 2.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-50847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50847",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor \u003c= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutentor",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43308",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP MultiTasking \u003c= 0.1.12 - Cross-Site Request Forgery to Welcome Popup Update",
    "slug": "wp-multitasking",
    "type": "plugin",
    "affected_version": "* - 0.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6853",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photosmash Plugin \u003c 1.0.5 - Cross-Site Scripting",
    "slug": "photosmash-galleries",
    "type": "plugin",
    "affected_version": "[*, 1.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-5307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5307",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amen \u003c= 3.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "amen",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3992",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Box Office \u003c= 1.2.2 - Missing Authorization",
    "slug": "woocommerce-box-office",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24799",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Author Bio Box \u003c= 3.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "author-bio-box",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39349",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Email \u003c= 1.3.43 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "contact-form-to-email",
    "type": "plugin",
    "affected_version": "* - 1.3.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5955",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Modal \u003c= 0.3.3 - Reflected Cross-Site Scripting",
    "slug": "simplemodal",
    "type": "plugin",
    "affected_version": "* - 0.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51718",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customer Email Verification for WooCommerce \u003c= 2.9.5 - Authentication Bypass via Shortcode",
    "slug": "emails-verification-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13528",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Photo Gallery \u003c= 1.8.1 - Authenticated (Admin+) SQL Injection",
    "slug": "simple-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-47588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47588",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Kadence WooCommerce Email Designer \u003c= 1.5.14 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "kadence-woocommerce-email-designer",
    "type": "plugin",
    "affected_version": "* - 1.5.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39557",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent \u003c= 2.2.5 - Authenticated(Administrator+) CSV Injection",
    "slug": "gdpr-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23678",
    "auth_type": "Privileged",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Texteller \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "texteller",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23552",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hide My WP \u003c 6.2.9 - Unauthenticated SQL Injection",
    "slug": "hide_my_wp",
    "type": "plugin",
    "affected_version": "[*, 6.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-4681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4681",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Flipbox – Awesomes Flip Boxes Image Overlay \u003c= 2.6.0 - Authenticated (Admin+) Arbitrary Options Update",
    "slug": "image-hover-effects-ultimate-visual-composer",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-33969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33969",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Relevanssi – A Better Search \u003c= 4.22.0 (Free) and \u003c= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export",
    "slug": "relevanssi-premium",
    "type": "plugin",
    "affected_version": "* - 2.25.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1380",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Relevanssi – A Better Search \u003c= 4.22.0 (Free) and \u003c= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "* - 4.22.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.22.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1380",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Captcha \u003c= 1.0 - Missing Authorization via easy_captcha_update_settings",
    "slug": "easy-captcha",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-33324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33324",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Stop Spammers Security \u003c= 2022.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "stop-spammer-registrations-plugin",
    "type": "plugin",
    "affected_version": "* - 2022.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2022.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2489",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EWWW Image Optimizer \u003c= 5.8.1 - Cross-Site Request Forgery Bypass",
    "slug": "ewww-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 5.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36750",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Joomag \u003c= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-joomag",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22827",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-In-One Security (AIOS) – Security and Firewall \u003c= 5.2.5 - Reflected Cross-Site Scripting",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "* - 5.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1037",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KKProgressbar2 Free \u003c= 1.1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "kkprogressbar",
    "type": "plugin",
    "affected_version": "* - 1.1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4534",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GSheetConnector For Gravity Forms \u003c= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation",
    "slug": "gsheetconnector-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 1.3.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.23",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-8606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8606",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive Modal Builder for High Conversion – Easy Popups \u003c= 1.5.0 - Reflected Cross-Site Scripting",
    "slug": "easy-popups",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26774",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Manager Pro – Filester - \u003c= 1.7.6 - Cross-Site Request Forgery to Arbitrary File Rename",
    "slug": "filester",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4827",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UserPro \u003c= 5.1.1 - Cross-Site Request Forgery via multiple functions",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6008",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Unite Gallery Lite \u003c= 1.7.61 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "unite-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 1.7.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34183",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "APA Register Newsletter Form \u003c= 1.0.0 - Cross-Site Request Forgery to SQL Injection",
    "slug": "apa-register-newsletter-form",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49621",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced iFrame \u003c= 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 2024.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4365",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Order Export For WooCommerce \u003c= 3.3.1 - Reflected Cross-Site Scripting",
    "slug": "woo-order-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-35275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-35275",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Support Plus Responsive Ticket System \u003c= 4.0 - JavaScript Injection",
    "slug": "wp-support-plus-responsive-ticket-system",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-10391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10391",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinpoint Booking System \u003c= 2.9.9.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "* - 2.9.9.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3636",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feedbucket – Website Feedback Tool \u003c= 1.0.6 - Cross-Site Request Forgery",
    "slug": "feedbucket",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31859",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Apollo - Sticky Full Width HTML5 Audio Player \u003c= 3.4 - Reflected Cross-Site Scripting",
    "slug": "lbg-audio5-html5-shoutcast-sticky",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48168",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Patricia Blog \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "patricia-blog",
    "type": "theme",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38732",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Car Rental by BestWebSoft \u003c= 1.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "car-rental",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44734",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XStore Core \u003c= 5.3.8 - Authenticated (Subscriber+) Limited Arbitrary File Download",
    "slug": "et-core-plugin",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33558",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Interface \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "interface",
    "type": "theme",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35758",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Revive Adserver \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-revive-adserver",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23802",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ads.txt Guru Connect \u003c= 1.1.1 - Cross-Site Request Forgery",
    "slug": "adstxt-guru-connect",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49381",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Category Custom Fields \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "categorycustomfields",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23822",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AnalyticsWP \u003c= 2.0.0 - Missing Authorization",
    "slug": "analyticswp",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39388",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ksher \u003c= 1.1.2 - Missing Authorization",
    "slug": "ksher-payment",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 4.7.51 - Missing Authorization to Unauthenticated Data Export",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 4.7.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.51",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4972",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CF7 WOW Styler \u003c= 1.6.8 - Reflected Cross-Site Scripting",
    "slug": "cf7-styler",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51689",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Box \u003c= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "[*, 3.8.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5809",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventCalendar \u003c 1.0.94 - Authenticated Cross-Site Scripting",
    "slug": "event-calendar-wd",
    "type": "plugin",
    "affected_version": "[*, 1.0.94)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.94",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-2224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2224",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function",
    "slug": "onlyoffice",
    "type": "plugin",
    "affected_version": "1.1.0 - 2.2.0",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6380",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooLentor \u003c= 2.5.3 - PHP Object Injection",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-0232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0232",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ray Enterprise Translation \u003c= 1.7.0 - Unauthenticated Local File Inclusion",
    "slug": "lingotek-translation",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31030",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.12.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1422",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YOP Poll \u003c= 6.3.0 - Author+ Stored Cross-Site Scripting via Options Module",
    "slug": "yop-poll",
    "type": "plugin",
    "affected_version": "* - 6.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24834",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Popups \u003c= 2.1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-popups-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24003",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clio Grow \u003c= 1.0.0 - Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "clio-grow-form",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22683",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Wp Sitemap \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "simple-wp-sitemap",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24380",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Designer Pro \u003c= 1.9.26 - Unauthenticated Arbitrary File Deletion",
    "slug": "wc-designer-pro",
    "type": "plugin",
    "affected_version": "* - 1.9.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6439",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Greenshift \u003c= 11.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 11.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49301",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NinjaTeam Header Footer Custom Code \u003c 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via CSS Styles",
    "slug": "header-footer-code",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6617",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "markdown-it \u003c 1.3.2 - Uncontrolled Resource Consumption",
    "slug": "maps-block-apple",
    "type": "plugin",
    "affected_version": "1.0.3",
    "from_version": "1.0.3",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-21670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21670",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Droip \u003c= 2.2.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "droip",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5831",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PowerPack Pro for Elementor \u003c 2.10.8 - Cross-Site Request Forgery to Plugin Settings Modification and Cross-Site Scripting",
    "slug": "powerpack-elements",
    "type": "plugin",
    "affected_version": "[*, 2.10.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-24843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24843",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Portfolio \u003c= 1.1.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "ht-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0497",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Plugin updates blocker \u003c= 0.2 - Cross-Site Request Forgery",
    "slug": "plugin-update-blocker",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9634",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Notification Bar \u003c= 1.3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wordpress-notification-bar",
    "type": "plugin",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37556",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tagembed: Embed Twitter Feed, Google Reviews, YouTube Videos, TikTok, RSS Feed \u0026 More Social Media Feeds \u003c= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tagembed-widget",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32561",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GS Insever Portfolio \u003c= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gs-instagram-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0539",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grip \u003c= 1.0.9 - Unauthenticated Local File Inclusion",
    "slug": "grip",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26735",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wechat Reward \u003c= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wechat-reward",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24615",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BSK Forms Blacklist \u003c= 3.8.1 - Reflected Cross-Site Scripting",
    "slug": "bsk-gravityforms-blacklist",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47624",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Reset \u003c= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log",
    "slug": "wp-reset",
    "type": "plugin",
    "affected_version": "* - 2.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10645",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.126",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.126",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10784",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GD Mail Queue \u003c= 3.9.3 - Unauthenticated Stored Cross-Site Scripting via Email",
    "slug": "gd-mail-queue",
    "type": "plugin",
    "affected_version": "* - 3.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3122",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Check Tester \u003c= 1.0.2 - Authenticated (Subscriber+) Cross-Site Scripting",
    "slug": "contact-form-check-tester",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24247",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Reviews \u003c= 5.13.0 - Admin+ Stored Cross-Site Scripting",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "[*, 5.13.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.13.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24603",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Advanced-Search \u003c= 3.3.9.3 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "wp-advanced-search",
    "type": "plugin",
    "affected_version": "* - 3.3.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39538",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Donate With QRCode \u003c= 1.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "donate-with-qrcode",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24618",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Improved Include Page \u003c= 1.2 - Authenticated (Contributor+) Arbitrary Posts/Pages Access",
    "slug": "improved-include-page",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24845",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Sliced Invoices \u003c= 3.9.5 - Missing Authorization",
    "slug": "sliced-invoices",
    "type": "plugin",
    "affected_version": "* - 3.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31628",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Onepage Builder – Easiest Landing Page Builder For WordPress \u003c= 2.4.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "tx-onepager",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-38391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38391",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Doofinder for WooCommerce \u003c= 2.1.7 - Reflected Cross-Site Scripting via tab",
    "slug": "doofinder-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49185",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Sitemap \u003c= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-sitemap",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4472",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 4.2.2 - Unauthenticated Option Creation",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19982",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "GNU-Mailman Integration \u003c= 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "gnu-mailman-integration",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38354",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy Page Builder \u003c= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.18",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-2897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2897",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SheetDB \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sheetdb",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31873",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KB Support – WordPress Help Desk and Knowledge Base \u003c= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure",
    "slug": "kb-support",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8632",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Majestic Support \u003c= 1.1.0 - Missing Authorization",
    "slug": "majestic-support",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49860",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Namaste! LMS \u003c= 2.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "namaste-lms",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50410",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Blocks for Block Editor | Gutenberg \u003c= 3.2.5 - Missing Authorization",
    "slug": "the-plus-addons-for-block-editor",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33572",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Enfold \u003c= 5.6.9 - Reflected Cross-Site Scripting",
    "slug": "enfold",
    "type": "theme",
    "affected_version": "* - 5.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37199",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Truepush \u003c= 1.0.8 - Missing Authorization",
    "slug": "truepush-free-web-push-notifications",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44021",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newspack \u003c= 3.8.6 - Missing Authorization",
    "slug": "newspack-plugin",
    "type": "plugin",
    "affected_version": "* - 3.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43968",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WassUp Real Time Analytics \u003c 1.8.3.1 - Cross-Site Scripting",
    "slug": "wassup",
    "type": "plugin",
    "affected_version": "[*, 1.8.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-2633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2633",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conditional Fields for Contact Form 7 \u003c= 2.4.1 - Missing Authorization",
    "slug": "cf7-conditional-fields",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47838",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Aptivada for WP \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "aptivada-for-wp",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48135",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Registration – Contact Form 7 \u003c= 5.1 - Authenticated (Editor+) Privilege Escalation",
    "slug": "frontend-registration-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4870",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Prime Slider – Addons For Elementor \u003c= 3.13.2 - Missing Authorization to Notice Dismissal",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32682",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "REST API TO MiniProgram \u003c= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover",
    "slug": "rest-api-to-miniprogram",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8485",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Extended Post Status \u003c= 1.0.19 - Missing Authorization via wp_insert_post_data",
    "slug": "extended-post-status",
    "type": "plugin",
    "affected_version": "* - 1.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32094",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "School Management System for Wordpress \u003c= 92.0.0 - Authenticated (Student+) SQL Injection via 'view-attendance'",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 92.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "92.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12609",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form \u0026 Custom Form Builder \u003c= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "* - 6.16.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.16.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11188",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HMS Testimonials \u003c= 2.0.10 - Cross-Site Request Forgery",
    "slug": "hms-testimonials",
    "type": "plugin",
    "affected_version": "[*, 2.0.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-4240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4240",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"
  },
  {
    "title": "Wishlist \u003c= 1.0.44 - Cross-Site Request Forgery",
    "slug": "wishlist",
    "type": "plugin",
    "affected_version": "* - 1.0.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32272",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Just Writing Statistics \u003c= 4.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "just-writing-statistics",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56250",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto \u003c= 5.1.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "tripetto",
    "type": "plugin",
    "affected_version": "* - 5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36895",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rank Math SEO PRO \u003c= 3.0.35 - Reflected Cross-Site Scripting",
    "slug": "seo-by-rank-math-pro",
    "type": "plugin",
    "affected_version": "* - 3.0.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32800",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Rocket Extension \u003c= 4.0.3 - Missing Authorization to Plugin Settings Change",
    "slug": "mainwp-rocket-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23665",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donations Made Easy – Smart Donations \u003c= 4.0.12 - Cross-Site Request Forgery",
    "slug": "smart-donations",
    "type": "plugin",
    "affected_version": "* - 4.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47551",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 4.1.0 - SQL Injection",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "[*, 4.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0479",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPBookit \u003c= 1.6.4 - Unauthenticated Arbitrary User Password Change",
    "slug": "wpbookit",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10215",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OSS Aliyun \u003c= 1.4.10 - Authenticated (Administrator+) SQL Injection",
    "slug": "oss-aliyun",
    "type": "plugin",
    "affected_version": "* - 1.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30494",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Video List Manager \u003c= 1.7 - Authenticated (Admin+) SQL Injection",
    "slug": "video-list-manager",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1408",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Restriction WordPress \u003c= 1.2.6 - Admin+ Stored Cross-Site Scripting",
    "slug": "page-and-post-restriction",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1027",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IRM Newsroom \u003c= 1.2.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmflat' Shortcode",
    "slug": "irm-newsroom",
    "type": "plugin",
    "affected_version": "* - 1.2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4585",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Elements \u003c= 8.0 - Unauthenticated SQL injection",
    "slug": "master-elements",
    "type": "plugin",
    "affected_version": "* - 8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0693",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Alt Text AI – Automatically generate image alt text for SEO and accessibility \u003c= 1.4.9 - Authenticated (Subscriber+) SQL Injection",
    "slug": "alttext-ai",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4847",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Coupon \u0026 Discount Code Reveal Button \u003c= 1.2.5 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "coupon-reveal-button",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32722",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RRAddons for Elementor \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rrdevs-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54232",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Banners \u003c= 3.3 - Reflected Cross-Site Scripting",
    "slug": "custom-banners",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8799",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rehub \u003c= 19.9.7 - Unauthenticated Password Protected Post Disclosure",
    "slug": "rehub-theme",
    "type": "theme",
    "affected_version": "* - 19.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7368",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "OnionBuzz \u003c= 1.0.7 - Cross-Site Request Forgery",
    "slug": "onionbuzz-viral-quiz",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53312",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Quick FrontEnd Editor \u003c= 5.5 - Reflected Cross-Site Scripting",
    "slug": "wp-quick-front-end-editor",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4363",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Instant Image Generator \u003c= 1.5.2 - Unauthenticated Arbitrary File Upload",
    "slug": "ai-image",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52377",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All-in-One WP Migration and Backup \u003c= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import",
    "slug": "all-in-one-wp-migration",
    "type": "plugin",
    "affected_version": "* - 7.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.97",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8490",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKT Page Builder \u003c= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "skt-builder",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12848",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zigaform – Price Calculator \u0026 Cost Estimation Form Builder Lite \u003c= 7.4.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "zigaform-calculator-cost-estimation-form-builder-lite",
    "type": "plugin",
    "affected_version": "* - 7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26994",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relevanssi \u003c= 4.0.4 - Cross-Site Scripting",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-9034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-9034",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress - Pro \u003c= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider",
    "slug": "profilepress-pro",
    "type": "plugin",
    "affected_version": "* - 4.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9947",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AR for WordPress \u003c= 7.3 - Missing Authorization to Unauthenticated Limited File Upload",
    "slug": "ar-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-12300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12300",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Job Board Manager \u003c= 2.1.58 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "job-board-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38722",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapPress Maps for WordPress \u003c= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.94.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.94.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10715",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extra User Details \u003c= 0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "extra-user-details",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35878",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.14",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.14",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.12",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.11",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.4",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.3",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-5832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.11",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.8",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.2",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "teachPress \u003c= 9.0.5 - Cross-Site Request Forgery via delete_database()",
    "slug": "teachpress",
    "type": "plugin",
    "affected_version": "* - 9.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49163",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShopConstruct – Product Catalog, Shopping Cart and eCommerce solution for Store \u003c= 1.1.2 - Reflected Cross-Site Scripting via multiple parameters",
    "slug": "shopconstruct",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34011",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "System Dashboard \u003c= 2.8.7 - Missing Authorization to Information Disclosure (sd_global_value)",
    "slug": "system-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5712",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Videopack (formerly Video Embed \u0026 Thumbnail Generator) \u003c 2.0 - Remote Code Execution",
    "slug": "video-embed-thumbnail-generator",
    "type": "plugin",
    "affected_version": "[*, 2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-1785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-1785",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Graphene \u003c= 2.9.2 - Missing Authorization",
    "slug": "graphene",
    "type": "theme",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1984",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Sticky HTML5 Music Player \u003c= 3.1.6 - Authenticated (Contributor+) SQL Injection",
    "slug": "lbg-audio3-html5",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32290",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Image Slider by NextCode \u003c= 1.1.2 - Multiple Cross-Site Request Forgery",
    "slug": "baslider",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29437",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Backup and Staging by WP Time Capsule \u003c= 1.22.23 - Reflected Cross-Site Scripting",
    "slug": "wp-time-capsule",
    "type": "plugin",
    "affected_version": "* - 1.22.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47477",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Copy Move Posts \u003c= 1.6 - Missing Authorization",
    "slug": "copy-move-posts",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23764",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wp-football \u003c= 1.1 - Cross-Site Scripting",
    "slug": "wp-football",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4586",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frictionless \u003c= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "frictionless",
    "type": "plugin",
    "affected_version": "* - 0.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13396",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clock In Portal \u003c= 2.1 - Cross-Site Request Forgery to Designation Deletion",
    "slug": "clock-in-portal",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Media Category Management \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "wp-media-category-management",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32950",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SupportCandy – Helpdesk \u0026 Support Ticket System \u003c= 2.0.0 - Arbitrary File Upload",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "[*, 2.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-11223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11223",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Altair \u003c= 5.2.2 - Unauthenticated PHP Object Injection",
    "slug": "altair",
    "type": "theme",
    "affected_version": "* - 5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32928",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Popular Posts \u003c= 5.3.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress-popular-posts",
    "type": "plugin",
    "affected_version": "[*, 5.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-20746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20746",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enable Media Replace \u003c= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode",
    "slug": "enable-media-replace",
    "type": "plugin",
    "affected_version": "* - 4.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9496",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LatePoint \u003c= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 5.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30836",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Estatebud – Properties \u0026 Listings \u003c= 5.5.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "estatebud-properties-listings",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13710",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Groups and Communities \u003c= 5.9.5.7 - Reflected Cross-Site Scripting",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4957",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload - Contact Form 7 \u003c= 1.3.3.2 - Arbitrary File Upload",
    "slug": "drag-and-drop-multiple-file-upload-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-12800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12800",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modal Window – create popup modal window \u003c= 5.3.9 - Cross-Site Request Forgery",
    "slug": "modal-window",
    "type": "plugin",
    "affected_version": "* - 5.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3472",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PayPal Currency Converter BASIC for WooCommerce \u003c= 1.3 - Path Traversal to Arbitrary File Read",
    "slug": "paypal-currency-converter-basic-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5065",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Content Slide \u003c= 1.4.2 - Cross-Site Request Forgery",
    "slug": "content-slide",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2708",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Social Connect \u003c= 0.10.1 - Cross-Site Scripting",
    "slug": "social-connect",
    "type": "plugin",
    "affected_version": "* - 0.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4551",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BookingPress \u003c= 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24732",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPDating \u003c= 7.4.0 - SQL Injection",
    "slug": "dsp_dating",
    "type": "plugin",
    "affected_version": "* - 7.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-2460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2460",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woffice Core \u003c= 5.4.21 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "woffice-core",
    "type": "plugin",
    "affected_version": "* - 5.4.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2780",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.5.24 - Authenticated Local File Inclusion",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14798",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "RegistrationMagic – User Registration Plugin with Custom Registration Forms \u003c= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 6.0.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10508",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Recall – Registration, Profile, Commerce \u0026 More \u003c= 16.26.11 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9770",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Online Booking and Scheduling Plugin – Bookly \u003c= 22.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bookly-responsive-appointment-booking-tool",
    "type": "plugin",
    "affected_version": "* - 22.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "22.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5209",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directorist \u003c= 7.5.3 - Authenticated (Administrator+) Local File Inclusion",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2252",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ditty \u003c= 3.1.46 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9600",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Moneytizer \u003c= 9.6.3 - Cross-Site Request Forgery via multiple AJAX actions",
    "slug": "the-moneytizer",
    "type": "plugin",
    "affected_version": "* - 9.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6968",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \u003c= 4.88 - Unauthenticated SQL Injection",
    "slug": "ap-plugin-scripteo",
    "type": "plugin",
    "affected_version": "* - 4.88",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.88",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13322",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Compress – Image Optimizer [All-In-One] \u003c= 6.10.35 - Cross-Site Request Forgery",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.10.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32106",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Grid, Slider \u0026 Carousel Ultimate \u003c= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-grid-carousel-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29925",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "H5P CSS Editor \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "h5p-css-editor",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39318",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "REHub Framework \u003c 19.6.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "rehub-framework",
    "type": "plugin",
    "affected_version": "[*, 19.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.6.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-31234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31234",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Backuply – Backup, Restore, Migrate and Clone \u003c= 1.2.7 - Authenticated (Admin+) Directory Traversal",
    "slug": "backuply",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2294",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Foodbakery \u003c= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation",
    "slug": "wp-foodbakery",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-0180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0180",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Visitor Traffic Real Time Statistics \u003c= 2.11 - Missing Authorization to Arbitrary Plugin Installation/Activation",
    "slug": "visitors-traffic-real-time-statistics",
    "type": "plugin",
    "affected_version": "* - 2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24193",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MailerLite - Signup forms \u003c= 1.5.3 - Reflected Cross-Site Scripting",
    "slug": "official-mailerlite-sign-up-forms",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1604",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 \u003c= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload",
    "slug": "contact-form-7",
    "type": "plugin",
    "affected_version": "* - 5.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6449",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Menu Icons by ThemeIsle \u003c= 0.13.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "menu-icons",
    "type": "plugin",
    "affected_version": "* - 0.13.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.13.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4635",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MG Post Contributors \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "mg-post-contributors",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51701",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TI WooCommerce Wishlist \u003c= 2.10.0 - Missing Authorization",
    "slug": "ti-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 2.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58247",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "IP Locator \u003c= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ip-locator",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30826",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FL3R Accessibility Suite \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via fl3raccessibilitysuite Shortcode",
    "slug": "fl3r-accessibility-suite",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6689",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wordTube \u003c= 1.43 - Remote File Inclusion",
    "slug": "wordtube",
    "type": "plugin",
    "affected_version": "* - 1.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.43",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2007-2481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-2481",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag'",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0381",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO By 10Web \u003c= 1.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "seo-by-10web",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2224",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Template Customizer for WooCommerce \u003c= 1.2.9.1 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "email-template-customizer-for-woo",
    "type": "plugin",
    "affected_version": "* - 1.2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49288",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Header Notification \u003c= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-header-notification",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22579",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetTricks \u003c= 1.5.4.1 - Authenticated (Subscriber+) Information Exposure",
    "slug": "jet-tricks",
    "type": "plugin",
    "affected_version": "* - 1.5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53992",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ultimate Store Kit Elementor Addons \u003c= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-store-kit",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47629",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI Features",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 4.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2734",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial Slider And Showcase Pro \u003c= 2.3.15 - Unauthenticated Local File Inclusion",
    "slug": "testimonial-slider-showcase-pro",
    "type": "plugin",
    "affected_version": "* - 2.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32656",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster \u003c= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "sellkit",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4608",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce \u003c= 1.1.0 - Unauthenticated SQL Injection",
    "slug": "WhatsCart-for-WooCommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31056",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "raindrops \u003c= 1.600 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "raindrops",
    "type": "theme",
    "affected_version": "* - 1.600",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.600",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34414",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) \u003c= 1.1.34 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magical-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34547",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Private Only \u003c= 3.5.1 - Multiple Cross-Site Request Forgery",
    "slug": "private-only",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-5483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5483",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pretty Url \u003c= 1.5.4 - Cross-Site Request Forgery",
    "slug": "pretty-url",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22563",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.6.1 - .swf and .exe File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-5739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5739",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WatuPRO \u003c 4.9.0.8 - Cross-Site Request Forgery",
    "slug": "watupro",
    "type": "plugin",
    "affected_version": "[*, 4.9.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9418",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets \u0026 Elementor Templates) \u003c= 3.5.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5036",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutena Kit – Gutenberg Blocks and Templates \u003c= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutena-kit",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31805",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "uListing plugin \u003c= 2.0.5 - Authenticated Insecure Direct Object References (IDOR)",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36874",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Advanced Booking Calendar \u003c= 1.7.1 - Unauthenticated SQL Injection",
    "slug": "advanced-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45822",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 24.0.3 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 24.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56237",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 2.5.3 - Authenticated SQL Injection",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 2.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-12949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-12949",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Type Builder \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "themify-ptb",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31365",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Beaver Add-ons for Beaver Builder \u003c= 2.4.5 -  Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets",
    "slug": "ninja-beaver-lite-addons-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2163",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print My Blog \u003c= 3.27.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "print-my-blog",
    "type": "plugin",
    "affected_version": "* - 3.27.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.27.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37271",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Blocks – WordPress Blocks Plugin \u003c= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1312",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Vertical Icon Menu \u003c= 1.5.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpdevart-vertical-menu",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23870",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Role \u003c= 1.5.5 - Cross-Site Scripting",
    "slug": "user-role",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YouTube Playlists with Schema \u003c= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jma-youtube-playlists-with-schema",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13589",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Export \u0026 Order Import for WooCommerce \u003c= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter",
    "slug": "order-import-export-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13921",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Client Invoicing by Sprout Invoices \u003c= 20.8.0 - Insecure Direct Object Reference",
    "slug": "sprout-invoices",
    "type": "plugin",
    "affected_version": "* - 20.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53819",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Welcome Email Editor \u003c= 5.0.5 - Missing Authorization via ajax_handler",
    "slug": "welcome-email-editor",
    "type": "plugin",
    "affected_version": "* - 5.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47756",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form 7 – Dynamic Text Extension \u003c= 4.1.0 - Insecure Direct Object Reference",
    "slug": "contact-form-7-dynamic-text-extension",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6630",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Automatic \u003c= 3.92.0 - Unauthenticated SQL Injection",
    "slug": "wp-automatic",
    "type": "plugin",
    "affected_version": "* - 3.92.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.92.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-27956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27956",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Private Files \u003c= 0.40 - Cross-Site Request Forgery to Disable Protection",
    "slug": "private-files",
    "type": "plugin",
    "affected_version": "* - 0.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.40",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1793",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP BASE Booking of Appointments, Services and Events \u003c= 4.9.1 - Reflected Cross-Site Scripting via status Parameter",
    "slug": "wp-base-booking-of-appointments-services-and-events",
    "type": "plugin",
    "affected_version": "* - 4.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12469",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.28",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.1",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.18",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.31",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.31",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.24",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.10",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.6",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.4",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.7",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.19",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.14",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.15",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.34",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.32",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.23",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.22",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.2",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Spam Embed on Multisite Installations",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.34",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking Calendar \u003c= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 10.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4669",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF for WPForms \u003c= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-for-wpforms",
    "type": "plugin",
    "affected_version": "* - 6.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58620",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spiritual Gifts Survey \u003c= 0.9.10 - Reflected Cross-Site Scripting",
    "slug": "spiritual-gifts-survey",
    "type": "plugin",
    "affected_version": "* - 0.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Libsyn Publisher Hub \u003c= 1.4.4 - Unauthenticated Cross-Site Scripting",
    "slug": "libsyn-podcasting",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45835",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Linked Variations for Woocommerce \u003c= 1.0.3 - Missing Authorization",
    "slug": "linked-variation",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46244",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress WP-Advanced-Search \u003c= 3.3.9 - Unauthenticated SQL Injection",
    "slug": "wp-advanced-search",
    "type": "plugin",
    "affected_version": "* - 3.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9796",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Envo Multipurpose \u003c= 1.1.6 - Missing Authorization",
    "slug": "envo-multipurpose",
    "type": "theme",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-22770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22770",
    "auth_type": "Auth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LoginPress Pro \u003c 3.0 - Missing Authorization to License Status Update",
    "slug": "loginpress-pro",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-32677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32677",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WishList Member X \u003c= 3.25.1 - Unauthenticated Information Exposure",
    "slug": "wishlist-member-x",
    "type": "plugin",
    "affected_version": "* - 3.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37113",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP-Lister Lite for eBay \u003c= 3.5.7 - Reflected Cross-Site Scripting via 's'",
    "slug": "wp-lister-for-ebay",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22307",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.0.8 - Cross-Site Request Forgery to Arbitrary Member Deletion",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "[*, 4.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0328",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Source Control Lite \u003c 2.3.1 - Insecure Direct Object Reference",
    "slug": "image-source-control-isc",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24781",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Minify HTML \u003c= 2.1.10 - - Regular Expressions Denial of Service",
    "slug": "minify-html-markup",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12579",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tickera \u003c= 3.5.2.6 - Missing Authorization",
    "slug": "tickera-event-ticketing-system",
    "type": "plugin",
    "affected_version": "* - 3.5.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35729",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Page Generator Plugin – MPG \u003c= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 4.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10705",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PrePost SEO \u003c= 3.0 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "prepost-seo",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2029",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Options Pages \u003c= 0.9.7 - Reflected Cross-Site Scripting",
    "slug": "admin-options-pages",
    "type": "plugin",
    "affected_version": "* - 0.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23905",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chameleon CSS \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "chameleon-css",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24626",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "360 Product Rotation \u003c 1.4.8 - Reflected Cross-Site Scripting",
    "slug": "360-product-rotation",
    "type": "plugin",
    "affected_version": "[*, 1.4.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15082",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProductX – WooCommerce Builder \u0026 Gutenberg WooCommerce Blocks \u003c= 3.1.4 - PHP Object Injection via wopb_wishlist and wopb_compare",
    "slug": "product-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-23512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23512",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dropdown Multisite selector \u003c 0.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dropdown-multisite-selector",
    "type": "plugin",
    "affected_version": "[*, 0.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-31090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31090",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WOLF \u003c= 1.0.8.3 - Authenticated (Editor+) CSV Path Traversal",
    "slug": "bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-52396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52396",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form DB \u003c= 2.8.19 - Cross-Site Scripting",
    "slug": "contact-form-7-to-database-extension",
    "type": "plugin",
    "affected_version": "* - 2.8.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-7139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7139",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "leenk.me \u003c= 2.16.0 - Reflected Cross-Site Scripting",
    "slug": "leenkme",
    "type": "plugin",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49661",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet \u003c= 3.2.6 - Unauthenticated Arbitrary File Upload",
    "slug": "woocommerce-refund-and-exchange",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6222",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fast Secure Contact Form \u003c= 4.0.37 - Cross-Site Scripting",
    "slug": "si-contact-form",
    "type": "plugin",
    "affected_version": "* - 4.0.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9539",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hover Effects Ultimate \u003c= 9.7.1 - Reflected Cross-Site Scripting",
    "slug": "image-hover-effects-ultimate",
    "type": "plugin",
    "affected_version": "* - 9.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29424",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formzu WP \u003c= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id",
    "slug": "formzu-wp",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49160",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.5.8.1 - Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.5.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24381",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0554",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PressGrid - Frontend Publish Reaction \u0026 Multimedia Theme \u003c= 1.3.1 - Unauthenticated PHP Object Injection",
    "slug": "press-grid",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31429",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPify Woo Czech \u003c= 4.0.8 - Missing Authorization",
    "slug": "wpify-woo",
    "type": "plugin",
    "affected_version": "* - 4.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1492",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Retina 2x \u003c= 6.4.5 - Sensitive Information Exposure",
    "slug": "wp-retina-2x",
    "type": "plugin",
    "affected_version": "* - 6.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44982",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Walk Score Plugin \u003c= 0.5.5 - Cross-Site Scripting",
    "slug": "walk-score",
    "type": "plugin",
    "affected_version": "* - 0.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4573",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "GD Rating System \u003c= 2.3 - Cross-Site Scripting",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5292",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 9.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2101",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Staff / Employee Business Directory for Active Directory \u003c= 1.2.1 - Insufficient Escaping of Stored LDAP Values",
    "slug": "ldap-ad-staff-employee-directory-search",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4757",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "The Pack Elementor addons (Header Footer \u0026 WooCommerce Builder,  Template Library) \u003c= 2.0.8.6 - Authenticated (contributor+) Local File Inclusion",
    "slug": "the-pack-addon",
    "type": "plugin",
    "affected_version": "* - 2.0.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-38768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38768",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Social Icons \u003c= 3.2.4 - Missing Authorization via cnss_save_ajax_order",
    "slug": "easy-social-icons",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33998",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "List category posts \u003c= 0.91.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "list-category-posts",
    "type": "plugin",
    "affected_version": "* - 0.91.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.91.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47636",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Two Factor Authentication \u003c 1.1.10 - Cross-Site Scripting",
    "slug": "two-factor-authentication",
    "type": "plugin",
    "affected_version": "[*, 1.1.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9355",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Material Dashboard \u003c= 1.4.5 - Unauthenticated Local File Inclusion",
    "slug": "material-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31097",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "QR Code Tag \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "qr-code-tag",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Calendar \u003c= 1.5.3 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "wp-calendar",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageMapper \u003c= 1.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting via imgmap_save_area_title",
    "slug": "imagemapper",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5532",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Server Status by Hostname/IP \u003c= 4.6 - SQL Injection",
    "slug": "server-status-by-hostnameip",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-12570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12570",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My IDX Home Search \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "my-idx-home-search",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11889",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fast Total Search \u003c= 1.79.270 - Cross-Site Request Forgery",
    "slug": "fulltext-search",
    "type": "plugin",
    "affected_version": "* - 1.79.270",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.79.270",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57893",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "web-cam \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter",
    "slug": "web-cam",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Force Update Translations \u003c= 0.5 - Cross-Site Request Forgery",
    "slug": "force-update-translations",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58236",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photoracer Plugin \u003c= 1.0 - SQL Injection",
    "slug": "photoracer",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2009-2122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2122",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Missing Authorization in 'ucss_connect'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1335",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blaze Online eParcel for WooCommerce \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "blaze-online-eparcel-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54240",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Asgaros Forums \u003c= 1.15.13 - Authenticated Stored Cross-Site Scripting",
    "slug": "asgaros-forum",
    "type": "plugin",
    "affected_version": "* - 1.15.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-42365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42365",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Bitcoin Payments – Blockonomics \u003c= 3.5.7 - Reflected Cross-Site Scripting",
    "slug": "blockonomics-bitcoin-payments",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47145",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BRW \u003c= 1.8.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "ova-brw",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49313",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Passster \u003c= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode",
    "slug": "content-protector",
    "type": "plugin",
    "affected_version": "* - 4.2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1808",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GMAce \u003c= 1.5.2 - Cross-Site Request Forgery via gmace_manager_client",
    "slug": "gmace",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23861",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "offset writing \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "offset-writing",
    "type": "theme",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22791",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share With Floating Bar \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "social-share-with-floating-bar",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8790",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pardot \u003c= 2.1.0 - Missing Authorization",
    "slug": "pardot",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32148",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive Posts Carousel WordPress Plugin \u003c= 15.0 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "responsive-posts-carousel-pro",
    "type": "plugin",
    "affected_version": "* - 15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52728",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Digital Publications by Supsystic \u003c= 1.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "digital-publications-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2384",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKSDEV Toolkit \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sksdev-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51595",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qi Addons For Elementor \u003c= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown widget",
    "slug": "qi-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3309",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "beyot-framework",
    "type": "plugin",
    "affected_version": "* - 6.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13419",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "benaa-framework",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13419",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "g5plus-auteur",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13419",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "april-framework",
    "type": "plugin",
    "affected_version": "* - 5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13419",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Archivist – Custom Archive Templates \u003c= 1.7.4 - Cross-Site Request Forgery",
    "slug": "archivist-custom-archive-templates",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25448",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"
  },
  {
    "title": "Advanced Accordion Gutenberg Block \u003c= 5.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "advanced-accordion-block",
    "type": "plugin",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2543",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Build Private Store For Woocommerce \u003c= 1.0 - Missing Authorization",
    "slug": "build-private-store-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24633",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Markdown on Save Improved \u003c= 2.5 - Stored Cross-Site Scripting",
    "slug": "markdown-on-save-improved",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4812",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoho SalesIQ \u003c= 1.0.8 - Cross-Site Scripting",
    "slug": "zoho-salesiq",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-5962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5962",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PHP Everywhere \u003c= 2.0.3 - Remote Code Execution by Contributor+ users via gutenberg block",
    "slug": "php-everywhere",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-24665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-24665",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Awesome Support \u003c= 6.1.4 - Reflected Cross-Site Scripting",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5354",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Link to Facebook \u003c= 2.3 - Stored Cross-Site Scripting",
    "slug": "add-link-to-facebook",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5214",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Publications \u003c= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-publications",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11605",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myCred – Loyalty Points and Rewards plugin \u003c= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.7.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11201",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "theMarketer \u003c= 1.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "themarketer",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47655",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flexi – Guest Submit \u003c= 4.28 - Unauthenticated Local File Inclusion",
    "slug": "flexi",
    "type": "plugin",
    "affected_version": "* - 4.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.28",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32589",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sidebar Manager Light \u003c= 1.18 - Cross-Site Request Forgery",
    "slug": "sidebar-manager-light",
    "type": "plugin",
    "affected_version": "* - 1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47647",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Order Statuses for WooCommerce \u003c= 1.5.2 - Missing Authorization",
    "slug": "custom-order-statuses-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32524",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.0.5 - User Metadata Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2006-6016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-6016",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Message ticker \u003c= 9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "message-ticker",
    "type": "plugin",
    "affected_version": "* - 9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30533",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Copify \u003c= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "copify",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1900",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bug Library \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "bug-library",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38355",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ClickFunnels \u003c= 3.1.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "clickfunnels",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47152",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Securimage-WP-Fixed \u003c= 3.5.4 - Reflected Cross-Site Scripting",
    "slug": "securimage-wp-fixed",
    "type": "plugin",
    "affected_version": "* - 3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34640",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "W3 Total Cache \u003c= 0.9.2.4 - Insecure Cryptography to Sensitive Information Disclosure",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "* - 0.9.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-6078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6078",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AdFoxly – Ad Manager, AdSense Ads \u0026 Ads.txt \u003c= 1.8.5 - Cross-Site Request Forgery",
    "slug": "adfoxly",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46617",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Plugin Notes Plus \u003c= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "plugin-notes-plus",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37561",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sticky Social Link \u003c= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "sticky-social-link",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34546",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MC Woocommerce Wishlist \u003c= 1.7.8 - Missing Authorization",
    "slug": "smart-wishlist-for-more-convert",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34813",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Novelist \u003c= 1.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "novelist",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30847",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All push notification for WP \u003c= 1.5.3 - Reflected Cross-Site Scripting",
    "slug": "all-push-notification",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32546",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9994",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wp-forecast \u003c= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-forecast",
    "type": "plugin",
    "affected_version": "* - 9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JiangQie Free Mini Program \u003c= 2.5.2 - Unauthenticated Arbitrary File Uplaod",
    "slug": "jiangqie-free-mini-program",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49314",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SexyBookmarks \u003c= 6.1.4.0 - Cross-Site Request Forgery",
    "slug": "sexybookmarks",
    "type": "plugin",
    "affected_version": "* - 6.1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-3256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3256",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Functions Plugin \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "custom-functions",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iframe \u003c= 5.0 - Authenticated (Contributor+ Stored Cross-Site Scripting",
    "slug": "iframe",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34805",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leaflet Maps Marker \u003c= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "leaflet-maps-marker",
    "type": "plugin",
    "affected_version": "* - 3.12.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38782",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LUNA RADIO PLAYER \u003c= 6.24.01.24 - Unauthenticated Arbitrary File Read",
    "slug": "lu-radioplayer",
    "type": "plugin",
    "affected_version": "* - 6.24.01.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.24.01.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10816",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Jobs for WordPress \u003c= 2.7.5 - Reflected Cross-Site Scripting via job-search",
    "slug": "job-postings",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2833",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Portable phpMyAdmin \u003c= 1.5.0 - Authentication Bypass",
    "slug": "portable-phpmyadmin",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-4462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4462",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Nelio Content \u003c= 3.2.0 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "nelio-content",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30531",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Manager Pro \u003c= 1.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "filester",
    "type": "plugin",
    "affected_version": "* - 1.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52710",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TinyMCE Advanced qTranslate fix editor problems \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "tinymce-advanced-qtranslate-fix-editor-problems",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26582",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import Markdown \u003c= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "import-markdown",
    "type": "plugin",
    "affected_version": "* - 1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57901",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tree Sitemap (Pages, Posts \u0026 Categories list) \u003c= 2.9 - Missing Authorization to Arbitrary Plugin Installation/Activation",
    "slug": "tree-website-map",
    "type": "plugin",
    "affected_version": "[*, 2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24192",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sitemap by click5 \u003c= 1.0.35 - Unauthenticated Arbitrary Options Update",
    "slug": "sitemap-by-click5",
    "type": "plugin",
    "affected_version": "* - 1.0.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0952",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WooCommerce Bulk Stock Management \u003c= 2.2.33 - Cross-Site Scripting",
    "slug": "woocommerce-bulk-stock-management",
    "type": "plugin",
    "affected_version": "* - 2.2.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35918",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "News Flash \u003c= 1.1.0 - Authenticated (Editor+) PHP Object Injection",
    "slug": "news-flash",
    "type": "theme",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7560",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "404 to 301 \u003c= 3.0.8 - Logs Deletion via Cross-Site Request Forgery",
    "slug": "404-to-301",
    "type": "plugin",
    "affected_version": "[*, 3.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24766",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WooCommerce Menu Extension \u003c= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woocommerce-menu-extension",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leaky Paywall \u003c= 4.21.2 - Cross-Site Request Forgery",
    "slug": "leaky-paywall",
    "type": "plugin",
    "affected_version": "* - 4.21.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37540",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Go Maps (formerly WP Google Maps) \u003c= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1582",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FS Poster \u003c= 6.5.8 - Cross-Site Request Forgery",
    "slug": "fs-poster",
    "type": "plugin",
    "affected_version": "* - 6.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37237",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Saragna \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "saragna-social-stream",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51711",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1326",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AP Background \u003c= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ap-background",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10165",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Logo Slider \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "the-logo-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31571",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Reviews \u003c= 6.2.0 - Unauthenticated CSV Injection",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "* - 6.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46801",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Gutenberg Blocks and Page Layouts – Attire Blocks \u003c= 1.9.2 - Missing Authorization",
    "slug": "attire-blocks",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4088",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Listing, Classified Ads \u0026 Business Directory – uListing \u003c= 2.0.5 - Privilege Escalation",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-36879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36879",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Weaver Xtreme Theme Support \u003c= 6.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "weaverx-theme-support",
    "type": "plugin",
    "affected_version": "* - 6.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0276",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARMember \u003c= 4.0.22 - Cross-Site Request Forgery",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52200",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Accordion Slider \u003c= 1.9.11 - Authenticted (Contributor+) Stored Cross-Site Scripting via HTML Attribute",
    "slug": "accordion-slider",
    "type": "plugin",
    "affected_version": "* - 1.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9582",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enable Accessibility \u003c= 1.4.1 - Reflected Cross-Site Scripting",
    "slug": "enable-accessibility",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9208",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Cross-Site Request Forgery via ajax_edit_folder",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0726",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Sequential Order Numbers for WooCommerce \u003c= 3.6.2 - Cross-Site Request Forgery",
    "slug": "sequential-order-numbers-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32263",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BCorp Shortcodes \u003c= 0.23 -  Unauthenticated PHP Object Injection",
    "slug": "bcorp-shortcodes",
    "type": "plugin",
    "affected_version": "* - 0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.23",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-49773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49773",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WM Zoom \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wm-zoom",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50556",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution \u003c= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update",
    "slug": "shopengine",
    "type": "plugin",
    "affected_version": "* - 4.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-10173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10173",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Modern Events Calendar lite \u003c 6.10.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "[*, 6.10.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-1400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1400",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Country Selector \u003c= 1.6.5 - Reflected Cross-Site Scripting via AJAX call of check_country_selector",
    "slug": "wordpress-country-selector",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-28290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-28290",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Share Buttons Adder \u003c= 6.0.0 - Reflected Cross-Site Scripting",
    "slug": "simple-share-buttons-adder",
    "type": "plugin",
    "affected_version": "[*, 6.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9303",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Users Masquerade \u003c= 2.0.0 - Authenticated (Subscriber+) Authentication Bypass",
    "slug": "wp-users-masquerade",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9522",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Teardrop - Fullscreen Photography Theme | Portfolio \u003c= 1.8.5 - Arbitrary Options Update",
    "slug": "teardrop",
    "type": "theme",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9476",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SeatReg \u003c= 1.56.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "seatreg",
    "type": "plugin",
    "affected_version": "* - 1.56.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.56.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13463",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by Ays \u003c= 6.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gallery-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 6.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57947",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Slick Slider WordPress \u003c= 1.5 - Authenticated (Contributor+) Content Injection",
    "slug": "responsive-slick-slider",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49852",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Aspose.Words Exporter \u003c= 6.3.1 - Missing Authorization",
    "slug": "aspose-doc-exporter",
    "type": "plugin",
    "affected_version": "* - 6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32146",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Posts and Users Stats \u003c= 1.1.3 - Authenticated (Subscriber+) CSV Injection",
    "slug": "posts-and-users-stats",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44738",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Quick Subscribe \u003c= 1.7.1 - Cross-Site Request Forgery to Arbitrary Settings Update and Stored Cross-Site Scripting",
    "slug": "quick-subscribe",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1792",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Admire Extra \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "admire-extra",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13665",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Weaver Show Posts \u003c= 1.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name",
    "slug": "show-posts",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1404",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FULL – Cliente \u003c= 3.1.22 - Reflected Cross-Site Scripting",
    "slug": "full-customer",
    "type": "plugin",
    "affected_version": "* - 3.1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9211",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support Board \u003c= 3.8.0 - Reflected Cross-Site Scripting",
    "slug": "supportboard",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form \u0026 Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "2.0 - 2.13.9",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.13.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7702",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FS Product Inquiry \u003c= 1.1.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "fs-product-inquiry",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4857",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exchange Rates Widget \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "exchange-rates-widget",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPS Hide Login \u003c= 1.9.16.3 - Login Page Disclosure",
    "slug": "wps-hide-login",
    "type": "plugin",
    "affected_version": "* - 1.9.16.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.16.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6289",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "OWL Carousel \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lgx-owl-carousel",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24801",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Images Optimize and Upload CF7 \u003c= 2.1.4 - Missing Authorization to Arbitrary File Deletion",
    "slug": "images-optimize-and-upload-cf7",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4101",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WCFM - WooCommerce Multivendor Marketplace \u003c= 3.4.11 - Unauthenticated SQL Injection",
    "slug": "wc-multivendor-marketplace",
    "type": "plugin",
    "affected_version": "* - 3.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24849",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI Search Bar \u003c= 2.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "open-ai-search-bar",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31563",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Silencesoft RSS Reader \u003c= 0.6 - Cross-Site Request Forgery to RSS Feed Deletion",
    "slug": "external-rss-reader",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7842",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Legal Pages \u003c= 1.4.5 - Missing Authorization",
    "slug": "legal-pages",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48242",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Twitter Feed \u003c 1.2 - Cross-Site Scripting",
    "slug": "easy-twitter-feeds",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24413",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1020",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1020",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3813",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShipEngine Shipping Quotes \u003c= 1.0.7 - Unauthenticated SQL Injection",
    "slug": "shipengine-shipping-quotes",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13531",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.37",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.33",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.33",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.24",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.24",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.4",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.36",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.36",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.28",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.11",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.10",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.39",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.39",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.39",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.39",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.29",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.29",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.20",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.17",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.14",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.16",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.13",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.36",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.36",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.27",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.21",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.9",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.7",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.5",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.2",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Stored Cross-Site Scripting via wp-mail.php",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Agenda – Prise de rendez-vous en ligne \u003c= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-agenda-prise-de-rendez-vous-en-ligne",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11781",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inspiro \u003c= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation",
    "slug": "inspiro",
    "type": "theme",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Front End Users \u003c= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode",
    "slug": "front-end-only-users",
    "type": "plugin",
    "affected_version": "* - 3.2.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13563",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Job Board \u003c= 2.12.5 - Unauthenticated Resumes Download",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "* - 2.12.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7762",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Animate It \u003c= 2.3.5 - Cross-Site Scripting",
    "slug": "animate-it",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17385",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML5 MP3 Player with Playlist Free \u003c= 3.0.0 - Authenticated (Author+) PHP Object Injecton",
    "slug": "html5-mp3-player-with-playlist",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-52207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52207",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Font Awesome \u003c= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "font-awesome",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4478",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export WP Page to Static HTML/CSS \u003c= 2.1.9 - Missing Authorization via Multiple AJAX Actions",
    "slug": "export-wp-page-to-static-html",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6369",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Tilda Publishing \u003c= 0.3.23 - Missing Authorization",
    "slug": "tilda-publishing",
    "type": "plugin",
    "affected_version": "* - 0.3.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31234",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "HTML5 Maps \u003c= 1.7.1.4 - Cross-Site Request Forgery",
    "slug": "html5-maps",
    "type": "plugin",
    "affected_version": "* - 1.7.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45650",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Side Menu Lite \u003c= 5.3.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "side-menu-lite",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24724",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nexter Blocks \u003c= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-block-editor",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50452",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accept Stripe Payments \u003c= 2.0.63 - Authenticated Stored Cross-Site Scripting",
    "slug": "stripe-payments",
    "type": "plugin",
    "affected_version": "* - 2.0.63",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.63",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2194",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Compress – Image Optimizer [All-In-One] \u003c= 6.20.01 - Missing Authorization",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.20.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.20.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4445",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "AdRotate – Ad manager \u0026 AdSense Ads \u003c= 5.8.17 - Admin+ SQL Injection",
    "slug": "adrotate",
    "type": "plugin",
    "affected_version": "* - 5.8.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0267",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Landing Pages \u003c= 1.8.4 - Cross-Site Scripting",
    "slug": "landing-pages",
    "type": "plugin",
    "affected_version": "[*, 1.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-4065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4065",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Social Media Shortcodes \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "social-media-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11871",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category of Posts \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "list-one-category-of-posts",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54427",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plenigo \u003c= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "plenigo",
    "type": "plugin",
    "affected_version": "* - 1.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51832",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) \u003c= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.10.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 1.6.5 - Cross-Site Scripting via wpf-dw-td-value class",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19112",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Cookie Kit \u003c= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-cookie-kit",
    "type": "plugin",
    "affected_version": "[*, 2.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-45608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45608",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ERP | Complete HR solution with recruitment \u0026 job listings | WooCommerce CRM \u0026 Accounting \u003c= 1.6.3 - Cross-Site Request Forgery Bypass",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "[*, 1.6.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36735",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.90",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.90",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4160",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customify \u003c= 0.4.11 - Cross-Site Request Forgery",
    "slug": "customify",
    "type": "theme",
    "affected_version": "* - 0.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8669",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product XML Feed Manager for WooCommerce \u003c= 2.9.3 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "product-xml-feeds-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49887",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Billplz Addon for Contact Form 7 \u003c= 1.2.0 - Reflected Cross-Site Scripting",
    "slug": "billplz-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31007",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Support System \u003c= 1.2.2 - Missing Authorization",
    "slug": "wc-support-system",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-41686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41686",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "ShopLentor \u003c= 2.8.8 - Missing Authorization to WordPress Option Modification",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4566",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "SportsPress \u003c= 2.7.8 - Reflected Cross-Site Scripting",
    "slug": "sportspress",
    "type": "plugin",
    "affected_version": "* - 2.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24578",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 5.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8552",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpDiscuz \u003c= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3998",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dropdown Content \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dropdown-content",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46478",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6488",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.3",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.4",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.2",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-5834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.14",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.14",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.12",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.11",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.11",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.8",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 4.6.4 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 4.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4447",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kognetiks Chatbot for WordPress \u003c= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion",
    "slug": "chatbot-chatgpt",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10529",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WebARX \u003c= 1.3.0 - Stored Cross-Site Scripting",
    "slug": "webarx",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17213",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c 1.8.4.3 - Multiple Cross-Site Scripting",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "[*, 1.8.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5532",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Attendance Manager \u003c= 0.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "attendance-manager",
    "type": "plugin",
    "affected_version": "* - 0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39515",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Tooltips \u003c= 9.4.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "wordpress-tooltips",
    "type": "plugin",
    "affected_version": "* - 9.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.4.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30243",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Coming soon and Maintenance mode \u003c= 3.7.3 - IP Address Spoofing via get_real_ip",
    "slug": "coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49741",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Taggbox \u003c= 3.1 - Missing Authorization",
    "slug": "taggbox-widget",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33215",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "mTouch Quiz \u003c 3.0.7 - SQL Injection",
    "slug": "mtouch-quiz",
    "type": "plugin",
    "affected_version": "[*, 3.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-100022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-100022",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Out of the Block: OpenStreetMap \u003c= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ootb_query Shortcode",
    "slug": "ootb-openstreetmap",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11827",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Blocks with Lightbox \u003c= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simply-gallery-block",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32176",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "affiliate-toolkit – WordPress Affiliate Plugin \u003c= 3.5.4 - Missing Authorization via atkp_import_product",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2298",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AdForest \u003c= 5.1.8 - Authentication Bypass",
    "slug": "adforest",
    "type": "theme",
    "affected_version": "* - 5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12857",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Amazon JS \u003c= 0.10 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode",
    "slug": "amazonjs",
    "type": "plugin",
    "affected_version": "* - 0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0075",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wordpress-seo-premium",
    "type": "plugin",
    "affected_version": "25.7 - 25.9",
    "from_version": "25.7",
    "from_inclusive": true,
    "to_version": "25.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11241",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Advanced Ticket System, Elite Support Helpdesk \u003c= 1.0.63 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wats",
    "type": "plugin",
    "affected_version": "[*, 1.0.64)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.64",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24623",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) \u003c= 4.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "gift-voucher",
    "type": "plugin",
    "affected_version": "* - 4.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9165",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Disqus Comment System \u003c 2.79 - Multiple Cross-Site Request Forgery",
    "slug": "disqus-comment-system",
    "type": "plugin",
    "affected_version": "[*, 2.79)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.79",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-5346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5346",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Advanced Booking Calendar \u003c= 1.6.6 - Reflected Cross-Site Scripting via calId Parameter",
    "slug": "advanced-booking-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.6.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24225",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.5.4 - Unauthenticated Information Exposure",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34556",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Grid Plus – Unlimited grid layout \u003c= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via grid_plus_load_by_category",
    "slug": "grid-plus",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10910",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Custom More Link Complete \u003c= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "custom-more-link-complete",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23788",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Car Demon \u003c= 1.8.1 - Reflected Cross-Site Scripting",
    "slug": "car-demon",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Field Bulk Editor \u003c= 1.9.1 - Reflected Cross-Site Scripting",
    "slug": "custom-field-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31091",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blocksy \u003c= 2.0.77 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blocksy",
    "type": "theme",
    "affected_version": "* - 2.0.77",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.77",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11420",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beauty \u0026 Clean \u003c= 1.0.8 - Cross-Site Request Forgery \u0026 Arbitrary File Upload",
    "slug": "beauty-premium",
    "type": "theme",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10997",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Import – Ultimate CSV XML Importer for WordPress 7.20 -  7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "7.20 - 7.28",
    "from_version": "7.20",
    "from_inclusive": true,
    "to_version": "7.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10057",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WC Vendors Marketplace \u003c= 2.4.4 - Authenticated (Contributor+) Stored Cross-Sites Scripting via Shortcode",
    "slug": "wc-vendors",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0072",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StreamWeasels YouTube Integration \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "streamweasels-youtube-integration",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11788",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom URL Shortener \u003c= 0.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-url-shorter",
    "type": "plugin",
    "affected_version": "* - 0.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51930",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magical Posts Display \u003c= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magical-posts-display",
    "type": "plugin",
    "affected_version": "* - 1.2.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54706",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crazy Call To Action Box \u003c= 1.05 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "crazy-call-to-action-box",
    "type": "plugin",
    "affected_version": "* - 1.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49236",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UpdraftPlus WordPress Backup Plugin \u003c 1.22.9 Reflected Cross-Site Scripting",
    "slug": "updraftplus",
    "type": "plugin",
    "affected_version": "[*, 1.22.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0864",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Use Memcached \u003c= 1.0.5 - Cross-Site Request Forgery",
    "slug": "use-memcached",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41670",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lead Octopus Power \u003c 1.1.1 - SQL Injection",
    "slug": "Lead-Octopus-Power",
    "type": "plugin",
    "affected_version": "[*, 1.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-5189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5189",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shopper \u003c= 3.2.5 - Unauthenticated SQL Injection",
    "slug": "shopper",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31534",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Login Configurator \u003c= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "login-configurator",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34369",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "W4 Post List \u003c= 2.4.5 - Reflected Cross-Site Scripting",
    "slug": "w4-post-list",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1373",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Vibes \u003c= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data",
    "slug": "form-vibes",
    "type": "plugin",
    "affected_version": "* - 1.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5325",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "de:branding \u003c= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "debranding",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11443",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VRPConnector \u003c= 2.0.1 - Unauthenticated PHP Object Injection",
    "slug": "vrpconnector",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56058",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ohio Extra \u003c= 3.4.7 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "ohio-extra",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26924",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Dør \u003c= 2.4 - Unauthenticated Local File Inclusion",
    "slug": "dor",
    "type": "theme",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39466",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PayPal Pro Add-on for iThemes Exchange \u003c 1.1.0 - Cross-Site Scripting",
    "slug": "exchange-addon-paypal-pro",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9373",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maintenance Page \u003c= 1.0.8 - Missing Authorization to Sensitive Information Exposure",
    "slug": "maintenance-page",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1370",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Event post \u003c= 5.9.10 - Cross-Site Request Forgery",
    "slug": "event-post",
    "type": "plugin",
    "affected_version": "* - 5.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1375",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Seraphinite Accelerator \u003c= 2.20.28 - Arbitrary Redirect via 'redir'",
    "slug": "seraphinite-accelerator",
    "type": "plugin",
    "affected_version": "* - 2.20.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5610",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "LetterPress \u003c= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "letterpress",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27415",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BestWebSoft's Twitter \u003c= 2.14 - Cross-Site Request Forgery",
    "slug": "twitter-plugin",
    "type": "plugin",
    "affected_version": "* - 2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-10015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10015",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPO365 | LOGIN \u003c= 11.6 - Authentication Bypass",
    "slug": "wpo365-login",
    "type": "plugin",
    "affected_version": "* - 11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-26511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-26511",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Display custom fields in the frontend – Post and User Profile Fields \u003c= 1.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure",
    "slug": "shortcode-to-display-post-and-user-data",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6983",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Link Library \u003c= 7.2.7 - Missing Authorization Checks",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25093",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unyson \u003c= 2.7.29 - Cross-Site Request Forgery",
    "slug": "unyson",
    "type": "plugin",
    "affected_version": "* - 2.7.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34814",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GoDaddy Email Marketing \u003c 1.1.4 - Cross-Site Request Forgery",
    "slug": "godaddy-email-marketing-sign-up-forms",
    "type": "plugin",
    "affected_version": "[*, 1.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10903",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ach Invoice App \u003c= 1.0.1 - Unauthenticated Local File Inclusion",
    "slug": "ach-invoice-app",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-22364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22364",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Live Forms \u003c= 4.8.4 - Missing Authorization",
    "slug": "liveforms",
    "type": "plugin",
    "affected_version": "* - 4.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39560",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mail Queue \u003c= 1.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject",
    "slug": "mail-queue",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3167",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Follow Us Badges \u003c= 3.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcode",
    "slug": "wpsite-follow-us-badges",
    "type": "plugin",
    "affected_version": "* - 3.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3280",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management System for Wordpress \u003c= 92.0.0 - Authenticated (Subscriber+) SQL Injection via 'mj_smgt_show_event_task'",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 92.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "92.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12607",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "DELUCKS SEO \u003c= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "delucks-seo",
    "type": "plugin",
    "affected_version": "* - 2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47686",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modernize \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "modernize",
    "type": "theme",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53342",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress Global Search \u003c= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "buddypress-global-search",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45755",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Directory Kit \u003c= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2351",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Visual Composer Premium \u003c= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "visualcomposer",
    "type": "plugin",
    "affected_version": "* - 45.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "45.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6880",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \u003c= 1.6.8.3 - Reflected Cross-Site Scripting",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.6.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13431",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mega Elements \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mega-elements-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32575",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soho Hotel \u003c= 4.2.5 - Reflected Cross-Site Scripting",
    "slug": "soho-hotel",
    "type": "theme",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39539",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Materialis \u003c= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update",
    "slug": "materialis",
    "type": "theme",
    "affected_version": "* - 1.1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3204",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Quick Shop \u003c= 1.3.1 - Reflected Cross-Site Scripting",
    "slug": "wp-quick-shop",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54344",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Calendar \u003c= 3.4.21 - Unauthenticated SQL Injection",
    "slug": "my-calendar",
    "type": "plugin",
    "affected_version": "* - 3.4.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.21",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6360",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Canto \u003c= 1.9.0 - Blind Server-Side Request Forgery via get.php",
    "slug": "canto",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28977",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Cross-Site Request Forgery via 'ajax_deactivate'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1341",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress MU \u003c 2.6 - Cross-Site Scripting",
    "slug": "wpmu",
    "type": "core",
    "affected_version": "[*, 2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2008-4671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-4671",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Discount Rules for WooCommerce \u003c= 2.4.1 - Reflected Cross-Site Scripting",
    "slug": "woo-discount-rules",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2090",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KI Live Video Conferences \u003c= 5.5.15 - Unauthenticated Information Disclosure",
    "slug": "ki-live-video-conferences",
    "type": "plugin",
    "affected_version": "* - 5.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23969",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Top Bar  \u003c= 3.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "top-bar",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31928",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup and Restore WordPress  WordPress \u003c= 1.45 - Unauthenticated Information Exposure via Log Files",
    "slug": "wp-backitup",
    "type": "plugin",
    "affected_version": "* - 1.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7232",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Amministrazione Trasparente \u003c= 9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via print_r Function",
    "slug": "amministrazione-trasparente",
    "type": "plugin",
    "affected_version": "* - 9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5083",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Offload Videos – Bunny.net, AWS S3 \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "offload-videos-bunny-netaws-s3",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6719",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rocket Maintenance Mode \u0026 Coming Soon Page \u003c= 4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "rocket-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49842",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YayExtra – WooCommerce Extra Product Options \u003c= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function",
    "slug": "yayextra",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-7257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hover Effects \u003c= 2.1.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "hover-effects",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53258",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Zikzag Core \u003c= 1.4.5 - Unauthenticated Local File Inclusion",
    "slug": "zikzag-core",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49886",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booking and Rental Manager \u003c= 2.2.8 - Missing Authorization",
    "slug": "booking-and-rental-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39457",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slick Popup: Contact Form 7 Popup Plugin \u003c= 1.7.14 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "slick-popup",
    "type": "plugin",
    "affected_version": "[*, 1.7.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-46824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46824",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Plugin For WordPress - ConvertPlus \u003c= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update",
    "slug": "convertplug",
    "type": "plugin",
    "affected_version": "* - 3.5.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.30",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13800",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Funnel Builder by CartFlows \u003c= 2.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via settings",
    "slug": "cartflows",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29813",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Boot Store \u003c= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode",
    "slug": "boot-store",
    "type": "theme",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5938",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "2.8.0 - 2.8.3",
    "from_version": "2.8.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5071",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 5.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6225",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid \u003c= 5.5.0 - Hardcoded Encryption Key",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3404",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core 5.4 - 5.8 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.5, 5.5.6)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-39201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39201",
    "auth_type": "Auth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core 5.4 - 5.8 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.6, 5.6.5)",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-39201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39201",
    "auth_type": "Auth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core 5.4 - 5.8 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.7, 5.7.3)",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-39201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39201",
    "auth_type": "Auth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core 5.4 - 5.8 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.8, 5.8.1)",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-39201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39201",
    "auth_type": "Auth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core 5.4 - 5.8 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.4, 5.4.7)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-39201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39201",
    "auth_type": "Auth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Custom Query Blocks \u003c= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-type-archive-mapping",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44059",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Export \u0026 Order Import for WooCommerce \u003c= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function",
    "slug": "order-import-export-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-13922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13922",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups \u003c= 4.9.7 - Missing Authorization to Unauthenticated Limited Options Update",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "* - 4.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10861",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WpEvently \u003c= 4.3.6 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 4.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32145",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_gmaps' Shortcode",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.15.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3341",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \u003c= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1991",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Project Manager \u003c= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10548",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Modal Window – create popup modal window \u003c= 5.2.1 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "modal-window",
    "type": "plugin",
    "affected_version": "[*, 5.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-25051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25051",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spice Starter Sites \u003c= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import",
    "slug": "spice-starter-sites",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8430",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Participants Database \u003c 1.5.4.9 - SQL Injection",
    "slug": "participants-database",
    "type": "plugin",
    "affected_version": "[*, 1.5.4.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-3961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3961",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WHIZZ \u003c 1.0.8 - Reflected Cross-Site Scripting",
    "slug": "whizz",
    "type": "plugin",
    "affected_version": "[*, 1.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-1000154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000154",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UserPlus \u003c= 2.0 - Unauthenticated Privilege Escalation",
    "slug": "userplus",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9518",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stripe Donation \u003c= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bin-stripe-donation",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53752",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Druco \u003c= 1.5.2 - Reflected Cross-Site Scripting",
    "slug": "druco",
    "type": "theme",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54055",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Masy Gallery \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "masy-gallery",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13586",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.3 - Missing Authorization to Information Exposure",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-36515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36515",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Post Grid and Gutenberg Blocks \u003c= 2.2.92 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.92",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9645",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bVerse Convert \u003c= 1.3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bverse-convert",
    "type": "plugin",
    "affected_version": "* - 1.3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49228",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARforms \u003c= 3.7.1 - Unauthenticated Arbitrary File Deletion",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16902",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Cost Calculator \u003c= 1.8 - Authenticated Local File Inclusion",
    "slug": "nd-projects",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24820",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zagg - Electronics \u0026 Accessories WooCommerce WordPress Theme \u003c= 1.4.1 - Unauthenticated Local File Inclusion",
    "slug": "bw-zagg",
    "type": "theme",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4200",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SuevaFree Essential Kit \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "suevafree-essential-kit",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11432",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SendGrid for WordPress \u003c= 1.4 - Missing Authorization",
    "slug": "wp-sendgrid-mailer",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23423",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Brave Popup Builder \u003c= 0.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "brave-popup-builder",
    "type": "plugin",
    "affected_version": "* - 0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51534",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Child Theme Creator by Orbisius \u003c= 1.5.5 - Missing Authorization to Authenticated (Subscriber+) Cloud Snippet Update/Delete",
    "slug": "orbisius-child-theme-creator",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12263",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tabs Shortcode and Widget \u003c= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "tabs-shortcode-and-widget",
    "type": "plugin",
    "affected_version": "* - 1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0719",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id GET",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4152",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id GET",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4152",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Broken Links Remover \u003c= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "broken-links-remover",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39440",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Marquee Elementor with Posts \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "marquee-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51584",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All in one Minifier \u003c= 3.2 - Unauthenticated SQL Injection",
    "slug": "all-in-one-minifier",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9073",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Social Share Boost \u003c= 4.5 - Cross-Site Request Forgery via 'syntatical_settings_content'",
    "slug": "social-share-boost",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25033",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Conversational Forms for ChatBot \u003c= 1.1.8 - Unauthenticated Arbitrary File Download",
    "slug": "conversational-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32729",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Bricks Builder \u003c= 1.9.8 - Insecure Direct Object Reference",
    "slug": "bricksbuilder",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4874",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Active Products Tables for WooCommerce \u003c= 1.0.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48266",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Support Ticket System \u003c= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "woocommerce-support-ticket-system",
    "type": "plugin",
    "affected_version": "* - 17.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10626",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.59 - Insufficient Access Control to Template Activation",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4705",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "jRSS Widget \u003c= 1.2 - Server-Side Request Forgery",
    "slug": "jrss-widget",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9292",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Move Addons for Elementor \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "move-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34562",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "only-tweet-like-share-and-google-1",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37388",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pet Manager \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "pet-manager",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3917",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Posts Lite \u003c= 1.12 - Cross-Site Request Forgery",
    "slug": "related-posts-lite",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9618",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mixlr Shortcode \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "mixlr-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11807",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Purge Varnish Cache \u003c= 2.6 - Cross-Site Request Forgery",
    "slug": "purge-varnish",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58807",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Meta Data Manager \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-meta-data-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6264",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cliengo - Chatbot \u003c= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update",
    "slug": "cliengo",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5993",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "JiangQie Official Website Mini Program \u003c 1.1.1 - SQL Injection",
    "slug": "jiangqie-official-website-mini-program",
    "type": "plugin",
    "affected_version": "[*, 1.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24303",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Count Per Day \u003c= 3.1.1 - Cross-Site Scripting",
    "slug": "count-per-day",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3434",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Listings Pro \u003c= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-listings-pro",
    "type": "plugin",
    "affected_version": "* - 3.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51903",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rich Snippet Site Report \u003c= 2.0.0105 - Authenticated (Admin+) SQL Injection",
    "slug": "easysnippet",
    "type": "plugin",
    "affected_version": "* - 2.0.0105",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0105",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10310",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP SuperBackup \u003c= 2.3.3 - Unauthenticated Arbitrary File Upload",
    "slug": "indeed-wp-superbackup",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56064",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Weblizar Pin Feeds \u003c 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "weblizar-pinterest-feeds",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5653",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms \u003c= 1.4.4 - Unauthenticated Full Path Disclosure",
    "slug": "cf7-salesforce",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4659",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.3.2 - Unauthenticated SQL Injection",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48274",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Video Directory \u003c= 1.4.2 - Unauthenticated SQL Injection",
    "slug": "simple-media-directory",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6809",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Amazon Product in a Post \u003c= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "amazon-product-in-a-post-plugin",
    "type": "plugin",
    "affected_version": "* - 5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47615",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode Factory \u003c= 2.7 - Local File Inclusion",
    "slug": "shortcode-factory",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-15322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15322",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Maintenance \u0026 Coming Soon Redirect Animation \u003c= 2.3.0 - IP Spoofing to Bypass",
    "slug": "maintenance-coming-soon-redirect-animation",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43944",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FL3R FeelBox \u003c= 8.1 - Unauthenticated SQL Injection",
    "slug": "fl3r-feelbox",
    "type": "plugin",
    "affected_version": "* - 8..1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8..1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4445",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Table \u0026 Contact Form 7 Database – Tablesome \u003c= 1.0.25 - Cross-Site Request Forgery",
    "slug": "tablesome",
    "type": "plugin",
    "affected_version": "* - 1.0.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31388",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Archivist – Custom Archive Templates \u003c= 1.7.5 - Reflected Cross-Site Scripting",
    "slug": "archivist-custom-archive-templates",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46194",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTTP Auth \u003c= 0.3.2 - Cross-Site Request Forgery",
    "slug": "http-auth",
    "type": "plugin",
    "affected_version": "* - 0.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27435",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Easy Custom Auto Excerpt \u003c= 2.4.12 - Sensitive Information Exposure",
    "slug": "easy-custom-auto-excerpt",
    "type": "plugin",
    "affected_version": "* - 2.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3312",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Travel \u003c= 9.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-travel",
    "type": "plugin",
    "affected_version": "* - 9.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44039",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.4 (Pro) \u0026 \u003c= 2.2.7 (Free) - Reflected Cross-Site Scripting",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0233",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.4 (Pro) \u0026 \u003c= 2.2.7 (Free) - Reflected Cross-Site Scripting",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0233",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMTP for Amazon SES – YaySMTP \u003c= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs",
    "slug": "smtp-amazon-ses",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3434",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nested Pages \u003c= 3.1.20 - Stored Cross-Site Scripting",
    "slug": "wp-nested-pages",
    "type": "plugin",
    "affected_version": "[*, 3.1.21)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.21",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1990",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drivr Lite – Google Drive Plugin plugin for WordPress \u003c= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "drivr-google-drive-file-picker",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27016",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajax Load More \u003c= 7.6.0.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 7.6.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59582",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPPizza \u003c= 3.17.1 - Reflected Cross-Site Scripting",
    "slug": "wppizza",
    "type": "plugin",
    "affected_version": "* - 3.17.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.17.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32105",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "About Author \u003c= 1.6.2 - Reflected Cross-Site Scripting",
    "slug": "about-author",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30808",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega - Absolute Addons for Elementor Page Builder \u003c= 1.5.5 - Contributor+ Stored Cross-Site Scripting",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24261",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NitroPack \u003c= 1.10.2 - Cross-Site Request Forgery",
    "slug": "nitropack",
    "type": "plugin",
    "affected_version": "* - 1.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52121",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ray Enterprise Translation \u003c= 1.7.1 - Missing Authorization",
    "slug": "lingotek-translation",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58785",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Zigaform – Price Calculator \u0026 Cost Estimation Form Builder Lite \u003c= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zigaform-calculator-cost-estimation-form-builder-lite",
    "type": "plugin",
    "affected_version": "* - 7.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13587",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kubio AI Page Builder \u003c= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation",
    "slug": "kubio",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8487",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "GamiPress \u003c= 2.5.6 - Cross-Site Request Forgery to User Earnings Deletion",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25697",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NEX-Forms Lite – WordPress Contact Form builder \u003c 3.4 - Cross-Site Scripting",
    "slug": "x-forms-express",
    "type": "plugin",
    "affected_version": "[*, 3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-7151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7151",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Photoswipe \u003c= 0.1 - Missing Authorization (Subscriber+) Settings Update",
    "slug": "simple-photoswipe",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5570",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Postie \u003c= 1.9.40 - Post Submission Spoofing \u0026 Stored Cross-Site Scripting",
    "slug": "postie",
    "type": "plugin",
    "affected_version": "[*, 1.9.41)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.41",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-20203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20203",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slider Revolution \u003c= 6.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via htmltag Parameter",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.33.3 - Cross-Site Request Forgery to plugin deactivation",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.33.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.33.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4247",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "LifePress \u003c= 2.1.3 - Missing Authorization",
    "slug": "lifepress",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53337",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Supreme Addons for Beaver Builder \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode",
    "slug": "supreme-addons-for-beaver-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3669",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Contact form 7 DB  \u003c= 2.0.8 \u0026 Import any XML, CSV or Excel File to WordPress \u003c= 3.8.0 - Use of Vulnerable Component (PHPExcel)",
    "slug": "advanced-cf7-db",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2014-2054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2054",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Contact form 7 DB  \u003c= 2.0.8 \u0026 Import any XML, CSV or Excel File to WordPress \u003c= 3.8.0 - Use of Vulnerable Component (PHPExcel)",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2014-2054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2054",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EXMAGE – WordPress Image Links \u003c= 1.0.6 - Admin+ Blind SSRF",
    "slug": "exmage-wp-image-links",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1037",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zarinpal Paid Downloads \u003c= 2.3 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "zarinpal-paid-downloads",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13544",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EWWW Image Optimizer \u003c= 7.2.0 - Unauthenticated Sensitive Information Exposure via Debug Log",
    "slug": "ewww-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 7.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40600",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Counter Box \u003c= 1.1.1 - Authenticated Local File Inclusion",
    "slug": "counter-box",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29446",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AppPresser – Mobile App Framework \u003c= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset",
    "slug": "apppresser",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11024",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfileGrid  \u003c= 5.9.5.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47478",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AdRotate – Ad manager \u0026 AdSense Ads \u003c= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Upload",
    "slug": "adrotate",
    "type": "plugin",
    "affected_version": "* - 5.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.13.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1206",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Launcher: Coming Soon \u0026 Maintenance Mode \u003c= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "launcher",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36829",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Account Funds Premium \u003c= 1.33.0 - Missing Authorization",
    "slug": "yith-woocommerce-account-funds-premium",
    "type": "plugin",
    "affected_version": "* - 1.33.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30470",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tock Widget \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "tock-widget",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22520",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Pricing and Discount Rules \u003c= 2.2.9 - Cross-Site Request Forgery",
    "slug": "discount-and-dynamic-pricing",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49077",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form \u0026 Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "2.0 - 2.13.9",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.13.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7775",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Slider \u003c= 3.7.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20368",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Redirection Plugin – 301 Redirect Manager \u003c= 8.9 - Cross-Site Request Forgery",
    "slug": "seo-redirection",
    "type": "plugin",
    "affected_version": "* - 8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38704",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Real Estate \u003c= 5.2.0 - Unauthenticated Local File Inclusion",
    "slug": "essential-real-estate",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30849",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via list_id parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-6095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6095",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Gravity Forms HubSpot \u003c= 1.2.5 - Open Redirect",
    "slug": "gf-hubspot",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60151",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Web Stories for WordPress \u003c= 1.31.0 - Insufficient Authorization",
    "slug": "web-stories",
    "type": "plugin",
    "affected_version": "[*, 1.32.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.32.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-1979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1979",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Improved User Search in Backend \u003c= 1.2.5 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "improved-user-search-in-backend",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-5196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5196",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XX2WP Integration Tools \u003c= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fb2wp-integration-tools",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11857",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 5.7.51 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11924",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tradetracker-Store \u003c 4.6.60 - Authenticated SQL Injection",
    "slug": "tradetracker-store",
    "type": "plugin",
    "affected_version": "[*, 4.6.60)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.60",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24778",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CanadaHelps Embedded Donation \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embedded-cdn",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11778",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pro Addons For Elementor \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pro-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51812",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conditional Menus \u003c= 1.2.0 - Reflected Cross-Site Scripting",
    "slug": "conditional-menus",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crowdsignal Dashboard \u003c= 2.0.24 - Cross-Site Scripting",
    "slug": "polldaddy",
    "type": "plugin",
    "affected_version": "* - 2.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4856",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Memphis Documents Library \u003c= 2.6.16 - Remote File Inclusion",
    "slug": "memphis-documents-library",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-10383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10383",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ELEX WooCommerce Dynamic Pricing and Discounts \u003c= 2.1.2 - Reflected Cross-Site Scripting",
    "slug": "elex-woocommerce-dynamic-pricing-and-discounts",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31255",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Calendly \u003c= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "embed-calendly-scheduling",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4995",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Generator Addon for Elementor Page Builder \u003c= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-generator-addon-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50449",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via Form",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.43",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2087",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "C9 Blocks \u003c= 1.7.7 - Unauthenticated Full Path Disclosure",
    "slug": "c9-blocks",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13537",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Before And After \u003c= 3.9 - Cross-Site Request Forgery",
    "slug": "before-and-after",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32084",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup Box – new WordPress popup plugin \u003c= 2.2.6 - Cross-Site Request Forgery",
    "slug": "popup-box",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3477",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "5280 Bootstrap Modal Contact Form \u003c= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages",
    "slug": "5280-bootstrap-modal-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0847",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RingCentral Communications \u003c= 1.6.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "rccp-free",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53770",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4971",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Store Kit Elementor Addons \u003c= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-store-kit",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58017",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Clover Payment Gateway \u003c= 1.3.1 - Missing Authorization via callback_handler",
    "slug": "woo-clover-gateway-by-zaytech",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0626",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Auto Poster \u003c= 5.3.15 - Reflected Cross-Site Scripting",
    "slug": "social-auto-poster",
    "type": "plugin",
    "affected_version": "* - 5.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47369",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMS Alert Order Notifications – WooCommerce \u003c= 3.4.6 - Cross-Site Scripting",
    "slug": "sms-alert",
    "type": "plugin",
    "affected_version": "[*, 3.4.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24588",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARI Fancy Lightbox \u003c= 1.3.8 - Reflected Cross-Site Scripting",
    "slug": "ari-fancy-lightbox",
    "type": "plugin",
    "affected_version": "[*, 1.3.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0161",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Breadcrumbs by menu \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "breadcrumbs-by-menu",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15865",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Democracy Poll \u003c= 6.0.3 - Missing Authorization",
    "slug": "democracy-poll",
    "type": "plugin",
    "affected_version": "* - 6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33920",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wp-D3 \u003c 2.4.1 - Cross-Site Request Forgery",
    "slug": "wp-d3",
    "type": "plugin",
    "affected_version": "[*, 2.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10946",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP ULike \u003c= 4.6.4 - Race Condition",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45842",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Laybuy Payment Extension for WooCommerce \u003c= 5.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "laybuy-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-21745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-21745",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin and Site Enhancements (ASE) Pro \u003c= 7.6.2.1 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "admin-site-enhancements",
    "type": "plugin",
    "affected_version": "* - 7.6.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43333",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Admin and Site Enhancements (ASE) Pro \u003c= 7.6.2.1 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "admin-site-enhancements-pro",
    "type": "plugin",
    "affected_version": "* - 7.6.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43333",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Admin Columns Free \u003c 4.3.2 and Pro \u003c 5.5.2 Authenticated Stored Cross-Site Scripting",
    "slug": "codepress-admin-columns",
    "type": "plugin",
    "affected_version": "[*, 4.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24365",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Columns Free \u003c 4.3.2 and Pro \u003c 5.5.2 Authenticated Stored Cross-Site Scripting",
    "slug": "admin-columns-pro",
    "type": "plugin",
    "affected_version": "[*, 5.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24365",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.23.2  - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.23.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.23.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4448",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.0 - Event deletion via Cross-Site Request Forgery",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "* - 4.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25599",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Movie Database \u003c= 1.0.11 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "movie-database",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43300",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetBlocks For Elementor \u003c= 1.3.18 - Authenticated (Subscriber+) Information Disclsoure",
    "slug": "jet-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53988",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP-Recall \u003c= 16.26.14 - Cross-Site Request Forgery",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30981",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Frontpage Manager \u003c= 1.3 - Cross-Site Request Forgery via admin_page",
    "slug": "frontpage-manager",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22285",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All-In-One Security (AIOS) \u003c= 5.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "* - 5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0157",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flexible Checkout Fields for WooCommerce \u003c= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update",
    "slug": "flexible-checkout-fields",
    "type": "plugin",
    "affected_version": "[*, 2.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36731",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Master \u003c= 3.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ajax-filter-posts",
    "type": "plugin",
    "affected_version": "* - 3.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34390",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Cool Flipbox – Shortcode \u0026 Gutenberg Block \u003c= 1.8.3 - Reflected Cross-Site Scripting",
    "slug": "flip-boxes",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32521",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Like box – Page Plugin \u003c 3.5.3 - SQL Injection",
    "slug": "ays-facebook-popup-likebox",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24460",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lytebox \u003c= 1.3 - Local File Inclusion",
    "slug": "wp-lytebox",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2009-4672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-4672",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP User Profile Avatar \u003c= 1.0.5 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-user-profile-avatar",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10789",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP SEO Tags \u003c= 2.2.7 - Reflected Cross-Site Scripting",
    "slug": "wp-seo-tags",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34665",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Powerpress \u003c= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 11.9.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.9.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9543",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lava Ajax Search \u003c= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "lava-ajax-search",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28937",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EasyCart 1.1.30 - 3.0.20 - Privilege Escalation",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "1.1.30 - 3.0.20",
    "from_version": "1.1.30",
    "from_inclusive": true,
    "to_version": "3.0.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2673",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Input Fields for WooCommerce  \u003c= 1.12.0 - Unauthenticated Limited File Upload",
    "slug": "product-input-fields-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13359",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Editor by Pixo \u003c= 2.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "image-editor-by-pixo",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58232",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Groups and Communities \u003c= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13741",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Rezgo Online Booking \u003c 1.4.3 - Cross-Site Scripting",
    "slug": "rezgo",
    "type": "plugin",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4546",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP JobHunt \u003c= 7.1 - Unauthenticated Insecure Direct Object Reference",
    "slug": "wp-jobhunt",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39537",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Saksh Escrow System \u003c= 2.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "saksh-escrow-system",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-55984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55984",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-CopyProtect [Protect your blog posts] \u003c= 3.1.0 - Cross-Site Request Forgery via CopyProtect_options_page",
    "slug": "wp-copyprotect",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25025",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OrangeBox \u003c= 3.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "orangebox",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23800",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Locatoraid Store Locator \u003c= 3.9.47 - Reflected Cross-Site Scripting",
    "slug": "locatoraid",
    "type": "plugin",
    "affected_version": "* - 3.9.47",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.47",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9652",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fusion Builder \u003c= 3.11.1 - Reflected Cross-Site Scripting via User Register Element",
    "slug": "fusion-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39306",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PublishPress Capabilities \u003c= 2.3 - Unauthenticated Arbitrary Options Update",
    "slug": "capability-manager-enhanced",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-25032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25032",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple 301 Redirects Addon Bulk Uploader \u003c= 1.2.4 - Missing Authentication on Option Changes",
    "slug": "simple-301-redirects-addon-bulk-uploader",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15818",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder – Contact forms and much more \u003c= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4208",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Donations \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nd-donations",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29433",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page \u003c= 1.13.4 - Missing Authorization to Information Disclosure",
    "slug": "advanced-post-block",
    "type": "plugin",
    "affected_version": "* - 1.13.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0908",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Posts Table with Search \u0026 Sort \u003c= 1.4.10 - Missing Authorization",
    "slug": "posts-data-table",
    "type": "plugin",
    "affected_version": "* - 1.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58613",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPForms \u003c= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 1.9.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7056",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Joy Of Text Lite – SMS messaging for WordPress \u003c= 2.3.0 - Unauthenticated SQL Injection",
    "slug": "joy-of-text",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4099",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gutenverse \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block",
    "slug": "gutenverse",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2893",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "New User Email Set Up \u003c= 0.5.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "new-user-email-set-up",
    "type": "plugin",
    "affected_version": "* - 0.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1790",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Anber Elementor Addon \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner button link",
    "slug": "anber-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7439",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Local Search SEO Contact Page \u003c= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "local-search-seo-contact-page",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27351",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hash Elements \u003c= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets",
    "slug": "hash-elements",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5177",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MarketKing \u003c= 2.0.92 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "marketking-multivendor-marketplace-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.92",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58702",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi Purpose Mail Form \u003c= 1.0.2 - Unauthenticated Arbitrary File Upload",
    "slug": "multi-purpose-mail-form",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50526",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kadence Blocks \u003c= 3.2.53 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10637",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Gallery with Slideshow \u003c= 1.5.2 - SQL Injection via selectMulGallery",
    "slug": "image-gallery-with-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002015",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MailChimp for WordPress \u003c= 4.0.10 - Authenticated Cross-Site Scripting",
    "slug": "mailchimp-for-wp",
    "type": "plugin",
    "affected_version": "[*, 4.0.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10871",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Order Export for WooCommerce \u003c= 3.1.7 - Cross-Site Scripting",
    "slug": "woo-order-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-27349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-27349",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Keap Official Opt-in Forms \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "infusionsoft-official-opt-in-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52192",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RBX Gallery \u003c 3.1 - Arbitrary File Upload",
    "slug": "rbxgallery",
    "type": "plugin",
    "affected_version": "[*, 3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-3575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3575",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery by BestWebSoft \u003c= 4.6.9 - Authenticated (Author+) SQL Injection",
    "slug": "gallery-plugin",
    "type": "plugin",
    "affected_version": "* - 4.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0765",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Classified Listing – Classified ads \u0026 Business Directory Plugin \u003c= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 3.1.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.15.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11194",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes \u003c= 1.1.6 - Reflected Cross-Site Scripting",
    "slug": "security-force",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11365",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallaxBackAdminSaveSlider Function",
    "slug": "ap-background",
    "type": "plugin",
    "affected_version": "3.8.1 - 3.8.2",
    "from_version": "3.8.1",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9561",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Page Access Restriction \u003c= 1.0.29 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "simple-page-access-restriction",
    "type": "plugin",
    "affected_version": "* - 1.0.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11295",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Copyright Proof \u003c= 4.16 - Reflected Cross-Site Scripting",
    "slug": "digiproveblog",
    "type": "plugin",
    "affected_version": "* - 4.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1906",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Showcase with Slick Slider \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "logo-showcase-with-slick-slider",
    "type": "plugin",
    "affected_version": "[*, 2.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24913",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cost Calculator Builder \u003c= 3.2.42 - Cross-Site Request Forgery to Settings Update",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "* - 3.2.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10892",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "affiliate-toolkit \u003c= 3.7.3 - Cross-Site Request Forgery",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46231",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Digital Goods \u003c 2.2 - Cross-Site Request Forgery",
    "slug": "woo-checkout-for-digital-goods",
    "type": "plugin",
    "affected_version": "[*, 2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-11633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11633",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Media Manager for UserPro \u003c= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "userpro-mediamanager",
    "type": "plugin",
    "affected_version": "* - 3.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12821",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bugs Go Viral : Facebook Promotion Generator \u003c= 1.3.4 - Cross-Site Scripting",
    "slug": "fbpromotions",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4528",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FastBook – Responsive Appointment Booking and Scheduling System \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "fastbook-responsive-appointment-booking-and-scheduling-system",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53762",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.27",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.17",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.12",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.11",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.8",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.27",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.24",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.7",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.25",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.24",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.21",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.16",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.15",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Categories \u003c= 1.1.1 - Unauthenticated Multiple Cross-Site Scripting",
    "slug": "media-library-categories",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-6630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6630",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shockingly Simple Favicon \u003c= 1.8.2 - Cross-Site Request Forgery",
    "slug": "shockingly-simple-favicon",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44246",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Profile Picture \u003c= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update",
    "slug": "metronet-profile-picture",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5639",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Email Subscribers by Icegram Express \u003c= 5.7.19 - Missing Authorization in handle_ajax_request",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4010",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Code Snippets \u003c= 3.5.0 - Cross-Site Request Forgery via load",
    "slug": "code-snippets",
    "type": "plugin",
    "affected_version": "[*, 3.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-47666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47666",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Login by Auth0 \u003c= 3.11.3 - CSV Injection",
    "slug": "auth0",
    "type": "plugin",
    "affected_version": "* - 3.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-7947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7947",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SupportCandy \u003c= 2.2.4 - Unauthenticated Arbitrary Ticket Deletion",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24839",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "DearFlip \u003c= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via force_fit",
    "slug": "3d-flipbook-dflip-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29807",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c= 3.4.6 - Cross-Site Scripting",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "[*, 3.4.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20978",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking for Appointments and Events Calendar – Amelia \u003c= 1.2 - Unauthenticated Full Path Disclosure",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6552",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Extend Themes \u003c= (Multiple Versions) - Cross-Site Request Forgery",
    "slug": "consus",
    "type": "theme",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34810",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Extend Themes \u003c= (Multiple Versions) - Cross-Site Request Forgery",
    "slug": "skyline-wp",
    "type": "theme",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34810",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Extend Themes \u003c= (Multiple Versions) - Cross-Site Request Forgery",
    "slug": "oasis",
    "type": "theme",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34810",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Extend Themes \u003c= (Multiple Versions) - Cross-Site Request Forgery",
    "slug": "ketos",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34810",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Extend Themes \u003c= (Multiple Versions) - Cross-Site Request Forgery",
    "slug": "zeka",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34810",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Extend Themes \u003c= (Multiple Versions) - Cross-Site Request Forgery",
    "slug": "niveau",
    "type": "theme",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34810",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Forms Puzzle Captcha \u003c= 4.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "wp-forms-puzzle-captcha",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48278",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdFoxly – Ad Manager, AdSense Ads \u0026 Ads.txt \u003c= 1.8.4 - Reflected Cross-Site Scripting",
    "slug": "adfoxly",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30754",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OTP Login Woocommerce \u0026 Gravity Forms \u003c= 2.2 - Authentication Bypass to Privilege Escalation",
    "slug": "mobile-login-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2706",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Useful Tab Block – Responsive \u0026 AMP-Compatible \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter",
    "slug": "useful-tab-block-responsive-amp-compatible",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5754",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eRoom – Zoom Meetings \u0026 Webinar \u003c= 1.4.6 - Missing Authorization via stm_wpcfto_get_settings_callback",
    "slug": "eroom-zoom-meetings-webinar",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43472",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Accordion Image Menu \u003c= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "accordion-image-menu",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8092",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential WP Real Estate \u003c= 1.1.3 - Reflected Cross-Site Scripting",
    "slug": "essential-wp-real-estate",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13347",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Media Feather \u003c= 2.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "social-media-feather",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36848",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Becustom \u003c= 1.0.5.2 - Cross-Site Request Forgery",
    "slug": "becustom",
    "type": "plugin",
    "affected_version": "* - 1.0.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3747",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MetForm – Contact Form, Survey, Quiz, \u0026 Custom Form Builder for Elementor \u003c= 3.8.8 - Unauthenticated Sensitive Information Exposure",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4266",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Elementor Pro \u003c= 2.0.9 - Cross-Site Scripting",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "[*, 2.0.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-18379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-18379",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 4.4.6 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-31567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-31567",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WP News \u003c= 1.1.9 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "wp-news-magazine",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0502",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woocommerce Quote Calculator \u003c= 1.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "woo-quote-calculator-order",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51626",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Productive Commerce \u003c= 1.1.22 - Unauthenticated SQL Injection",
    "slug": "productive-commerce",
    "type": "plugin",
    "affected_version": "* - 1.1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47657",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Estatik Real Estate Plugin \u003c= 4.1.0 - Reflected Cross-Site Scripting",
    "slug": "estatik",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6050",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premmerce Redirect Manager \u003c= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "premmerce-redirect-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23789",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Tesseract \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-tesseract",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60176",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Forms Puzzle Captcha \u003c= 4.1 - Cross-Site Request Forgery",
    "slug": "wp-forms-puzzle-captcha",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44997",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "PDF Viewer for Elementor \u003c= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via render",
    "slug": "pdf-viewer-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0845",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AntiSpam by CleanTalk \u003c= 5.185 - Authenticated (Administrator+) SQL Injection",
    "slug": "cleantalk-spam-protect",
    "type": "plugin",
    "affected_version": "* - 5.185",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.185",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3302",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Responsive Preview \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-responsive-preview",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4594",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.7",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-7989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.7",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-7989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.4",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-7989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-7989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-7989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.10",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-7989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.10",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-7989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.8",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-7989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ThemeFuse Maintenance Mode \u003c= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "themefuse-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51645",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Store Locator Plus \u003c= 5.5.15 - Authenticated Privilege Escalation",
    "slug": "store-locator-le",
    "type": "plugin",
    "affected_version": "* - 5.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24289",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Notice Bar \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "notice-bar",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41847",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NanoSupport \u003c= 0.6.0 - Missing Authorization",
    "slug": "nanosupport",
    "type": "plugin",
    "affected_version": "* - 0.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31376",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder \u003c= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting",
    "slug": "supreme-modules-for-divi",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4334",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reaction Buttons \u003c= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "reaction-buttons",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13848",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.97 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.97",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6536",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZoloBlocks \u003c= 2.3.11 - Unauthenticated Sever-Side Request Forgery",
    "slug": "zoloblocks",
    "type": "plugin",
    "affected_version": "* - 2.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-60161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60161",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Wallet \u003c= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "wc-wallet",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23527",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "AI Quiz \u003c= 1.1 - Missing Authorization",
    "slug": "ai-quiz",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53708",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Malware Scanner \u003c= 4.7.2 and Web Application Firewall \u003c= 2.1.1 - Unauthenticated Privilege Escalation",
    "slug": "web-application-firewall",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-2172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2172",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Malware Scanner \u003c= 4.7.2 and Web Application Firewall \u003c= 2.1.1 - Unauthenticated Privilege Escalation",
    "slug": "miniorange-malware-protection",
    "type": "plugin",
    "affected_version": "* - 4.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-2172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2172",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TS Poll – Best Poll Plugin for WordPress \u003c1.3.4 - Missing Authorization",
    "slug": "poll-wp",
    "type": "plugin",
    "affected_version": "[*, 1.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-11673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11673",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Developer \u003c= 1.2.6 - Cross-Site Request Forgery",
    "slug": "developer",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57924",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RomethemeKit For Elementor \u003c= 1.5.2 - Missing Authorization",
    "slug": "rometheme-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24743",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stop Spammers Security \u003c= 2022.6 - Reflected Cross-Site Scripting",
    "slug": "stop-spammer-registrations-plugin",
    "type": "plugin",
    "affected_version": "* - 2022.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2022.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2488",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My WP Customize Admin/Frontend \u003c= 1.24.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "my-wp",
    "type": "plugin",
    "affected_version": "* - 1.24.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55864",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile \u0026 User signup \u003c= 4.0.26 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-30222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30222",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ShopLentor – WooCommerce Builder for Elementor \u0026 Gutenberg +10 Modules – All in One Solution (formerly WooLentor) \u003c= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1057",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Customer Reviews \u003c= 3.5.5 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-customer-reviews",
    "type": "plugin",
    "affected_version": "* - 3.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24296",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Export \u0026 Order Import for WooCommerce \u003c= 2.4.3 - Authenticated (Shop Manager+) Arbitrary File Upload via upload_import_file",
    "slug": "order-import-export-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22135",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SKT Page Builder \u003c= 4.1 - Missing Authorization to Authenticated(Subscriber+) Content Injection",
    "slug": "skt-builder",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1337",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 3.2.6.8 - Authenticated Page Creation and Status Modification",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 3.2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-11510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11510",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Droip \u003c= 1.1.1 - Unauthenticated Arbitrary File Deletion",
    "slug": "droip",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43955",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Easy Quotes \u003c= 1.2.2 - Unauthenticated SQL Injection",
    "slug": "easy-quotes",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26943",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Pods \u003c= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9883",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Poll Maker \u003c= 3.2.8 – Reflected Cross-Site Scripting",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34635",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Time Slots Booking Form \u003c= 1.1.82 - Improper Authorization Checks",
    "slug": "wp-time-slots-booking-form",
    "type": "plugin",
    "affected_version": "* - 1.1.82",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.82",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23895",
    "auth_type": "Privileged",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Back Button Widget \u003c= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "back-button-widget",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51399",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada \u003c= 7.11.1 - Missing Authorization",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39922",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Documentor – Create Product Documentation \u003c= 1.5.3 - Unauthenticated SQL Injection",
    "slug": "documentor-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0773",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ELEX WordPress HelpDesk \u0026 Customer Ticketing System \u003c= 3.2.9 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "elex-helpdesk-customer-support-ticket-system",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47658",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Carousel, Slider, Gallery by WP Carousel – Image Carousel \u0026 Photo Gallery, Post Carousel \u0026 Post Grid, Product Carousel \u0026 Product Grid for WooCommerce \u003c= 2.6.3 - Authenticated (Admin+) PHP Object Injection",
    "slug": "wp-carousel-free",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3020",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Like Button Rating ♥ LikeBtn \u003c 2.6.32 - Server-Side Request Forgery",
    "slug": "likebtn-like-button",
    "type": "plugin",
    "affected_version": "[*, 2.6.32)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.32",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24150",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AB Google Map Travel (AB-MAP) \u003c 4.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "ab-google-map-travel",
    "type": "plugin",
    "affected_version": "[*, 4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-2755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2755",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Feed Them Social \u003c= 1.6.9 - Arbitrary Shortcode Execution",
    "slug": "feed-them-social",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9351",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PPOM for WooCommerce \u003c= 18.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "woocommerce-product-addon",
    "type": "plugin",
    "affected_version": "[*, 18.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-14948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14948",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Split Test For Elementor \u003c= 1.6.9 - Cross-Site Request Forgery",
    "slug": "split-test-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51407",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OK Poster Group \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "ok-poster-group",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30544",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calendar \u003c= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "calendar",
    "type": "plugin",
    "affected_version": "* - 1.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2831",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Save as PDF \u003c= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "save-as-pdf-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 4.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59552",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integration for WooCommerce and QuickBooks \u003c= 1.3.1 - Cross-Site Request Forgery",
    "slug": "wp-woocommerce-quickbooks",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39600",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Run Contests, Raffles, and Giveaways with ContestsWP \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "contest-code-checker",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11456",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ParcelPanel \u003c= 4.3.2 - Reflected Cross-Site Scripting",
    "slug": "parcelpanel",
    "type": "plugin",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43163",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cooked – Recipe Management \u003c= 1.7.15.4 - Cross-Site Request Forgery to Template Apply",
    "slug": "cooked",
    "type": "plugin",
    "affected_version": "* - 1.7.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.15.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39681",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Chartify \u003c= 2.0.6 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "chart-builder",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47526",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clean Login \u003c= 1.14.5 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "clean-login",
    "type": "plugin",
    "affected_version": "* - 1.14.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8252",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.2 - Cross-Site Request Forgery via permalink_setup",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2517",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP File Download Light \u003c= 1.3.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-file-download-light",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32539",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple File List \u003c= 6.1.11 - Reflected Cross-Site Scripting",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "* - 6.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10146",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Post Types and Custom Fields creator \u003c= 2.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wck-custom-fields-and-custom-post-types-creator",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4442",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WishSuite \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wishsuite",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29927",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Client Portal – Private user pages and login \u003c= 1.1.8 - Cross-Site Request Forgery via cp_create_private_pages_for_all_users function",
    "slug": "client-portal",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25968",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Push Notifications for WordPress (Lite) \u003c 6.0.1 - Cross-Site Request Forgery",
    "slug": "push-notifications-for-wp",
    "type": "plugin",
    "affected_version": "[*, 6.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-20846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20846",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NextGEN Gallery \u003c= 3.39.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.39.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.39.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6393",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Telecash Ricaricaweb \u003c= 2.2 - Unauthenticated PHP Object Injection",
    "slug": "telecash-ricaricaweb",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-48030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48030",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dashing Memberships \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "dashing-memberships",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51760",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embedder 1.3 - 1.3.5 - Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "embedder",
    "type": "plugin",
    "affected_version": "1.3 - 1.3.5",
    "from_version": "1.3",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3417",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BU Section Editing \u003c= 0.9.9 - Reflected Cross-Site Scripting",
    "slug": "bu-section-editing",
    "type": "plugin",
    "affected_version": "* - 0.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12736",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Academy LMS \u003c= 1.9.16 - Missing Authorization",
    "slug": "academy",
    "type": "plugin",
    "affected_version": "* - 1.9.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32714",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Devexhub Gallery \u003c= 2.0.1 - Unauthenticated Arbitrary File Upload",
    "slug": "devexhub-gallery",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52373",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ni Sales Commission For WooCommerce \u003c= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update",
    "slug": "ni-woo-sales-commission",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13424",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Yet Another Related Posts Plugin (YARPP) \u003c= 5.30.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "yet-another-related-posts-plugin",
    "type": "plugin",
    "affected_version": "* - 5.30.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.30.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0602",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps \u0026 One Click Upsells \u003c= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "funnel-builder",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5192",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "White Label \u003c= 2.9.0 - Cross-Site Request Forgery via white_label_reset_wl_admins",
    "slug": "white-label",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52128",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Notification for Telegram \u003c= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message",
    "slug": "notification-for-telegram",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9685",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bard Extra \u003c= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import",
    "slug": "bard-extra",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10532",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Domnoo \u003c= 1.49 - Unauthenticated Local File Inclusion",
    "slug": "domnoo",
    "type": "theme",
    "affected_version": "* - 1.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.49",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52812",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Webmaster Tools \u003c= 2.0 - Cross-Site Request Forgery vin lionscripts_plg_f",
    "slug": "webmaster-tools",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46092",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Testimonials \u003c= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "super-testimonial",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31348",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Post Grid \u003c= 7.7.4 - Missing Authorization via save_block_css",
    "slug": "the-post-grid",
    "type": "plugin",
    "affected_version": "* - 7.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37483",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Addonify – Quick View For WooCommerce \u003c= 1.2.16 - Unauthenticated Full Path Dislcosure",
    "slug": "addonify-quick-view",
    "type": "plugin",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6560",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "NP Quote Request for WooCommerce \u003c= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure",
    "slug": "woo-rfq-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.179",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.179",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13558",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Simple Shop \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "webful-simple-grocery-shop",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38340",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plus Addons for Elementor Page Builder \u003c= 4.1.6 - Authentication Bypass",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "[*, 4.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24175",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MStore API – Create Native Android \u0026 iOS Apps On The Cloud \u003c= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.15.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8242",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Support Genix \u003c= 1.2.3 - Missing Authorization",
    "slug": "support-genix-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49742",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Settings \u003c= 3.1.1 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "advanced-settings",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58996",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Vertical Carousel \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "vertical-carousel-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53756",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bloggie \u003c= 2.0.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "bloggie",
    "type": "theme",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31054",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ad Blocking Detector  \u003c= 1.2.1 -  Full Path Disclosure",
    "slug": "ad-blocking-detector",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-125093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-125093",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "The Business \u003c= 1.6.1 - Unauthenticated PHP Object Injection",
    "slug": "nrgbusiness",
    "type": "theme",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31430",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cooked – Recipe Management \u003c= 1.7.15.4 - Cross-Site Request Forgery to Template Reset",
    "slug": "cooked",
    "type": "plugin",
    "affected_version": "* - 1.7.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.15.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39679",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Truemag (Unknown Versions) - Reflected Cross-Site Scripting",
    "slug": "truemag",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10994",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HUSKY – Products Filter for WooCommerce (formerly WOOF) \u003c= 1.3.4.2 - Unauthenticated SQL Injection via search terms",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-40010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40010",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zip Attachments \u003c= 1.6 - Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure",
    "slug": "zip-attachments",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11701",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "myCred \u003c= 2.7.2 - Unauthenticated Information Exposure",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43214",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Formidable PRO2PDF \u003c= 3.09 - Authenticated (Admin+) SQL Injection",
    "slug": "formidablepro-2-pdf",
    "type": "plugin",
    "affected_version": "* - 3.09",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.09",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28663",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Website Builder by SeedProd \u003c= 6.15.13.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "coming-soon",
    "type": "plugin",
    "affected_version": "* - 6.15.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.15.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4975",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woo Inquiry \u003c= 0.1 - Unauthenticated SQL Injection",
    "slug": "woo-inquiry",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-7854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7854",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "wpDataTables – WordPress Data Table, Dynamic Tables \u0026 Table Charts Plugin \u003c= 3.4.2.2 - Reflected Cross-Site Scripting.",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "* - 3.4.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0591",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAF \u003c= 4.6.10 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "beaf-before-and-after-gallery",
    "type": "plugin",
    "affected_version": "* - 4.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47549",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Breaking News WP \u003c= 1.3 - Cross-Site Request Forgery to Settings Update",
    "slug": "breaking-news-wp",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31751",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Permalinks Customizer \u003c= 2.8.2 - Reflected Cross-Site Scripting",
    "slug": "permalinks-customizer",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47773",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVPMarker  \u003c= 11.4.5 - Missing Authorization",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 11.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24600",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Online Users Stats \u003c= 1.0.0 - Unauthenticated SQL Injection",
    "slug": "wp-online-users-stats",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32603",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.17",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.9",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.1",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.26",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.2",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.29",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.27",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.23",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.13",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.13",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.29",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.26",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.19",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.18",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.10",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Cross-Site Scripting via Media Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.5",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Use-Your-Drive \u003c 1.18.3 - Reflected Cross-Site Scripting",
    "slug": "use-your-drive",
    "type": "plugin",
    "affected_version": "[*, 1.18.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-42546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42546",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Logs Book \u003c= 1.0.1 - Cross-Site Request Forgery to Log Clearing",
    "slug": "wp-logs-book",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4475",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MapPress Maps for WordPress \u003c= 2.88.15 - Insufficient Authorization to Information Disclosure",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.88.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.88.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0421",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Awesome Shortcodes \u003c= 1.7.2 - Reflected Cross-Site Scripting",
    "slug": "awesome-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54209",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Remote Users Sync \u003c= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log View",
    "slug": "wp-remote-users-sync",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4374",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.5.18.727 - Stored Cross-Site Scripting",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.18.727",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.18.727",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25613",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Falling things \u003c= 1.08 - Authenticated (Editor+) SQL Injection",
    "slug": "falling-things",
    "type": "plugin",
    "affected_version": "* - 1.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32203",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Zoho CRM Lead Magnet \u003c= 1.7.2.4 - Cross-Site Scripting",
    "slug": "zoho-crm-forms",
    "type": "plugin",
    "affected_version": "* - 1.7.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-33849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-33849",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support Board \u003c= 3.8.0 - Unauthenticated Local File Inclusion",
    "slug": "supportboard",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54031",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5  \u0026 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status'",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "5.8.10 - 5.12.5",
    "from_version": "5.8.10",
    "from_inclusive": true,
    "to_version": "5.12.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30777",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5  \u0026 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status'",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "6.0.0 - 6.1.5",
    "from_version": "6.0.0",
    "from_inclusive": true,
    "to_version": "6.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30777",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5  \u0026 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status'",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "5.8.10 - 5.12.5",
    "from_version": "5.8.10",
    "from_inclusive": true,
    "to_version": "5.12.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30777",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5  \u0026 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status'",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "6.0.0 - 6.1.5",
    "from_version": "6.0.0",
    "from_inclusive": true,
    "to_version": "6.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30777",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OpenAI Tools for WordPress \u0026 WooCommerce \u003c= 2.1.5 - Missing Authorization",
    "slug": "openai-tools-for-wp-wc",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31843",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Filter Custom Fields \u0026 Taxonomies Light \u003c= 1.05 - Missing Authorization",
    "slug": "filter-custom-fields-taxonomies-light",
    "type": "plugin",
    "affected_version": "* - 1.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32081",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NEX-Forms - Ultimate Form Builder \u003c= 8.4.3 - Authenticated Stored Cross-Site Scripting via Form Name",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0439",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \u003c= 4.89 - Unauthenticated SQL Injection",
    "slug": "ap-plugin-scripteo",
    "type": "plugin",
    "affected_version": "* - 4.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4381",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Goftino \u003c= 1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "goftino",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38697",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Style \u003c= 3.2 - Cross-Site Request Forgery Bypass",
    "slug": "contact-form-7-style",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4390",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newsletter Popup \u003c= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "newsletter-popup",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3644",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Cirrus \u003c= 0.6.11 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-cirrus",
    "type": "plugin",
    "affected_version": "* - 0.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36692",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Field For WP Job Manager \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "custom-field-for-wp-job-manager",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30856",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Pro \u003c 6.3.7 - Missing Authorization",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "[*, 6.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-46434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46434",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Check \u0026 Log Email \u003c= 1.0.9 - Unauthenticated Hook Injection",
    "slug": "check-email",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0866",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spider Facebook \u003c= 1.0.15 - Cross-Site Request Forgery",
    "slug": "spider-facebook",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46619",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Quick Paypal Payments \u003c= 5.7.25 - Unauthenticated Stored Cross Site Scripting",
    "slug": "quick-paypal-payments",
    "type": "plugin",
    "affected_version": "[*, 5.7.26)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.26",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-25713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25713",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Charitable \u003c= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "* - 1.8.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30770",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Google Feed Manager \u003c= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Deletion",
    "slug": "wp-product-feed-manager",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7258",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.8.3 - Missing Authorization to Notice Dismissal",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33570",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ImageMagick Engine \u003c= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution",
    "slug": "imagemagick-engine",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2441",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder \u003c= 8.7.8 - Authenticated (Administrator+) SQL Injection",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53808",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Woocommerce Category Banner Management \u003c= 1.1.0 - Missing Authorization",
    "slug": "banner-management-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-11579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11579",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP User Merger \u003c= 1.5.2 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-user-merger",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3865",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Visitors \u003c= 0.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "visitors-app",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24350",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Plugin by Squirrly SEO \u003c= 12.3.20 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "squirrly-seo",
    "type": "plugin",
    "affected_version": "* - 12.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10515",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WOOCS \u003c= 1.3.7.2 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.3.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25043",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Ultra \u003c= 7.3.5 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "themify-ultra",
    "type": "theme",
    "affected_version": "* - 7.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46147",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FV Flowplayer Video Player 7.5.0.727 - 7.5.2.727 - Reflected Cross-Site Scripting via player_id Parameter",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "7.5.0.727 - 7.5.2.727",
    "from_version": "7.5.0.727",
    "from_inclusive": true,
    "to_version": "7.5.2.727",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39350",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Author WIP Progress Bar \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "author-work-in-progress-bar",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39516",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Benevolent \u003c= 1.3.4 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "benevolent",
    "type": "theme",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37450",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Search Unleashed \u003c= 0.2.10 - Cross-Site Scripting",
    "slug": "search-unleashed",
    "type": "plugin",
    "affected_version": "* - 0.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-0837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quotes and Tips by BestWebSoft \u003c= 1.44 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "quotes-and-tips",
    "type": "plugin",
    "affected_version": "* - 1.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.44",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3112",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HTML5 MP3 Player with Playlist \u003c= 2.7.0 - Full Path Disclosure",
    "slug": "html5-mp3-player-with-playlist",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9177",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Booking for Appointments and Events Calendar – Amelia \u003c= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.0.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6808",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 3.7.5 - Reflected Cross-Site Scripting",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 3.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30782",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YouTube Playlist Player \u003c= 4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "youtube-playlist-player",
    "type": "plugin",
    "affected_version": "* - 4.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45049",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Database Sync \u003c= 0.5.1 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "database-sync",
    "type": "plugin",
    "affected_version": "* - 0.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23486",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "6Storage Rentals \u003c= 2.19.4 - Missing Authorization",
    "slug": "6storage-rentals",
    "type": "plugin",
    "affected_version": "* - 2.19.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.19.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47619",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ResAds \u003c= 2.0.6 - Reflected Cross-Site Scripting via Multiple Parameters",
    "slug": "resads",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12122",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Google Photos album \u003c= 2.1.9 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "embed-google-photos-album-easily",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32775",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "404 Solution \u003c= 2.35.7 - Authenticated (Admin+) SQL Injection",
    "slug": "404-solution",
    "type": "plugin",
    "affected_version": "* - 2.35.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.35.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-1068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1068",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Real Estate 7 Theme \u003c= 3.3.1 - Stored Cross-Site Scripting",
    "slug": "realestate-7",
    "type": "theme",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47146",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mail Log \u003c= 1.1.2 - Incorrect Authorization to Authenticated (Contributor+) Data Viewing and Deletion",
    "slug": "wp-mail-log",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5644",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HashBar – WordPress Notification Bar \u003c= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "hashbar-wp-notification-bar",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4650",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3DPrint Lite \u003c= 2.0.9.9 - Cross-Site Request Forgery to Settings Update",
    "slug": "3dprint-lite",
    "type": "plugin",
    "affected_version": "* - 2.0.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10480",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Maintenance Page \u003c= 1.0.8 - Security Mechanism Bypass via REST API",
    "slug": "maintenance-page",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1462",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GSheetConnector for Forminator Forms \u003c= 1.0.12 - Reflected Cross-Site Scripting",
    "slug": "gsheetconnector-forminator",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22752",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram \u003c= 3.1.21 - Missing Authorization",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 3.1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-21748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-21748",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bulk Resize Media \u003c= 1.1 - Cross-Site Request Forgery via bulk_resize_resize_image",
    "slug": "bulk-resize-media",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46865",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UPS Live Rates and Access Points \u003c= 2.3.12 - Missing Authorization to Plugin API key reset",
    "slug": "flexible-shipping-ups",
    "type": "plugin",
    "affected_version": "* - 2.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9109",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Optimizer, Resizer and CDN – Sirv \u003c= 7.2.6 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "* - 7.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5853",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Smart Maintenance Mode \u003c= 1.5.3 - Cross-Site Request Forgery",
    "slug": "smart-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33638",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Query Wrangler \u003c= 1.5.54 - Cross-Site Request Forgery",
    "slug": "query-wrangler",
    "type": "plugin",
    "affected_version": "* - 1.5.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.54",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31779",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PostX - Gutenberg Blocks for Post Grid \u003c= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "[*, 2.4.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24659",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LDD Directory Lite \u003c= 3.3 - Reflected Cross-Site Scripting",
    "slug": "ldd-directory-lite",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54288",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-in-One Addons for Elementor - WidgetKit \u003c= 2.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "widgetkit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4256",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextGEN Gallery \u003c= 3.28 - Cross-Site Request Forgery leading to  Post Thumbnail Change",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38468",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Content Audit Exporter \u003c= 1.1 - Unauthenticated Sensitive Information Exposure",
    "slug": "content-audit-exporter",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53768",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Elementor Website Builder Pro \u003c= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.20.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2781",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.75 - Authenticated (Administrator+) Path Traversal",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.75",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.75",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2863",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Booster Plus for WooCommerce \u003c 7.1.3 - Missing Authorization to Arbitrary Options Disclosure",
    "slug": "booster-plus-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 7.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-52230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52230",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 4.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3267",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Convert Post Types  \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "convert-post-types",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32108",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Coronavirus (COVID-19) Outbreak Data Widgets \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "coronavirus-data-widgets",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23851",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spice Blocks \u003c= 2.0.7.4 - Missing Authorization",
    "slug": "spice-blocks",
    "type": "plugin",
    "affected_version": "* - 2.0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39532",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Coming Soon \u0026 Maintenance Mode Page \u003c= 1.57 - Cross-Site Request Forgery Bypass",
    "slug": "nifty-coming-soon-and-under-construction-page",
    "type": "plugin",
    "affected_version": "* - 1.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.57",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36752",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UltraAddons Elementor Lite \u003c= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ultraaddons-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49277",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopLentor – WooCommerce Builder for Elementor \u0026 Gutenberg +20 Modules – All in One Solution (formerly WooLentor) \u003c= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1527",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Random Banner \u003c= 4.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "random-banner",
    "type": "plugin",
    "affected_version": "* - 4.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53787",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Classified Listings \u003c= 1.5 - Cross-Site Request Forgery to Account Takeover",
    "slug": "ultimate-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13753",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
  },
  {
    "title": "WordPress Auction Plugin \u003c= 3.7 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-auctions",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54207",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.32",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.29",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.12",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.13",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.5",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.17",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.16",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.32",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.30",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.26",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.21",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.20",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.8",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.4",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.2",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.29",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Password Reset Link Non-Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.22",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WP ADA Compliance Check Basic – Most Comprehensive Web Accessibility Solution for WordPress \u003c= 3.1.3 - Cross-Site Request Forgery",
    "slug": "wp-ada-compliance-check-basic",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32947",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP 2FA \u003c= 2.6.3 - Unauthenticated Information Exposure via Log File",
    "slug": "wp-2fa",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44587",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 2.9.8 - Stored Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-13865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13865",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Taxi Booking Manager for WooCommerce – WordPress plugin | Ecab \u003c= 1.1.8 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "ecab-taxi-booking-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24661",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Calendar \u003c= 3.3.24.1 - Cross-Site Request Forgery",
    "slug": "my-calendar",
    "type": "plugin",
    "affected_version": "* - 3.3.24.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.24.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47427",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.3 - Missing Authorization in 'checkAllCategoryInSitemap'",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1027",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.4 - Multiple Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36905",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YaySMTP \u003c= 1.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "smtp-sendinblue",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48161",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Video Conferencing with Zoom \u003c= 4.4.4 - Open Redirect",
    "slug": "video-conferencing-with-zoom-api",
    "type": "plugin",
    "affected_version": "* - 4.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33584",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Pro \u003c= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementskit",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4452",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP DSGVO Tools (GDPR) \u003c= 2.2.18 - Cross-Site Scripting",
    "slug": "shapepress-dsgvo",
    "type": "plugin",
    "affected_version": "[*, 2.2.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15777",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mega Elements – Addons for Elementor \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget",
    "slug": "mega-elements-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8200",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crayon Syntax Highlighter \u003c 2.8.4 - Cross-Site Scripting",
    "slug": "crayon-syntax-highlighter",
    "type": "plugin",
    "affected_version": "[*, 2.8.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10893",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crawlomatic Multisite Scraper Post Generator \u003c= 2.6.8.2 - Missing Authorization",
    "slug": "crawlomatic-multipage-scraper-post-generator",
    "type": "plugin",
    "affected_version": "* - 2.6.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49293",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c=1.3.55 - Missing Authorization to Subscriber+ Arbitrary Post Creation",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.55",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4103",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "ProfileGrid \u003c= 5.1.7 - Authenticated (Subscriber+) CSV Injection",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41791",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WPLMS \u003c 1.9.9.5.3 - Authenticated (Instructor+) SQL Injection",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "[*, 1.9.9.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-56053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56053",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Multi Uploader for Gravity Forms \u003c= 1.1.3 - Unauthenticated Arbitrary File Upload",
    "slug": "gf-multi-uploader",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-23921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23921",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Shopify \u003c= 1.5.3 - Reflected Cross-Site Scripting",
    "slug": "wp-shopify",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7808",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Link Directory \u003c= 8.4.5 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "simple-link-directory",
    "type": "plugin",
    "affected_version": "* - 8.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12417",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BulletProof Security \u003c .51.1 - SQL Injection",
    "slug": "bulletproof-security",
    "type": "plugin",
    "affected_version": "[*, .51.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": ".51.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-7959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7959",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11911",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Portugal CTT Tracking for WooCommerce \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "portugal-ctt-tracking-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24878",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Click \u0026 Tweet \u003c= 0.8.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "click-tweet",
    "type": "plugin",
    "affected_version": "* - 0.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60179",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wordfence Security – Firewall \u0026 Malware Scan \u003c= 5.1.3 - Cross-Site Scripting",
    "slug": "wordfence",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4664",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tiempo.com \u003c= 0.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "tiempocom",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0058",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Admin Management Xtended \u003c= 2.4.0 - Missing Authorization Checks",
    "slug": "admin-management-xtended",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9390",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Entrada \u003c= 5.7.7 - Unauthenticated SQL Injection",
    "slug": "entrada",
    "type": "theme",
    "affected_version": "* - 5.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39484",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Product page shipping calculator for WooCommerce \u003c= 1.3.25 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings",
    "slug": "product-page-shipping-calculator-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32575",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PagBank / PagSeguro Connect para WooCommerce \u003c= 4.44.3 - Authenticated (Shop Manager+) SQL Injection",
    "slug": "pagbank-connect",
    "type": "plugin",
    "affected_version": "* - 4.44.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.44.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10142",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Newsletter Popup \u003c= 1.2 - Cross-Site Request Forgery to Record Deletion",
    "slug": "newsletter-popup",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0766",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wetterwarner \u003c= 2.7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wetterwarner",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32489",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Evangelische Termine \u003c= 3.3 - Reflected Cross-Site Scripting",
    "slug": "evangtermine",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28960",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Maps \u003c= 9.0.29 - Reflected Cross-Site Scripting",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29931",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Base64 Encoder/Decoder \u003c= 0.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "base64-encoderdecoder",
    "type": "plugin",
    "affected_version": "* - 0.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3823",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by WD \u003c= 1.13.4 - Cross-Site Request Forgery",
    "slug": "contact-form-maker",
    "type": "plugin",
    "affected_version": "[*, 1.13.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-11591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11591",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sitekit \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe ' shortcode",
    "slug": "sitekit",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27628",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ruven Toolkit \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "ruven-toolkit",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4548",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyCurator Content Curation \u003c= 3.74 - Cross-Site Request Forgery",
    "slug": "mycurator",
    "type": "plugin",
    "affected_version": "* - 3.74",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.74",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32104",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Doofinder for WooCommerce \u003c= 2.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "doofinder-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25596",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation",
    "slug": "wpshop",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.6.0",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3853",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Paid Membership Subscriptions \u003c= 2.15.5 - Unauthenticated Local File Inclusion",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54017",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Instant Breaking News \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "instant-breaking-news",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58217",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Botnet Attack Blocker \u003c= 2.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "botnet-attack-blocker",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23975",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "yPHPlista \u003c= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "yphplista",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53717",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Hide Pages \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "wp-hide-pages",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44232",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Good LMS \u003c= 2.1.4 - Unauthenticated SQL Injection",
    "slug": "goodlms",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-27481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-27481",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1007",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1007",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1441",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Besa \u003c= 2.3.8 - Unauthenticated Local File Inclusion",
    "slug": "besa",
    "type": "theme",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49252",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TextMe SMS \u003c= 1.9.1 - Missing Authorization",
    "slug": "textme-sms-integration",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31789",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "FW Gallery \u003c= 8.0.0 - Unauthenticated Local File Inclusion",
    "slug": "fw-gallery",
    "type": "plugin",
    "affected_version": "* - 8.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49416",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Spreadplugin \u003c= 4.8.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-spreadplugin",
    "type": "plugin",
    "affected_version": "* - 4.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49266",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Translate WordPress with GTranslate \u003c= 2.9.6 - Reflected Cross-Site Scripting",
    "slug": "gtranslate",
    "type": "plugin",
    "affected_version": "[*, 2.9.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25103",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebLibrarian \u003c 3.4.8.6 - Cross-Site Scripting",
    "slug": "weblibrarian",
    "type": "plugin",
    "affected_version": "[*, 3.4.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18539",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Front-End-Only-Users \u003c= 3.2.32 - Unauthenticated Arbitrary File Upload",
    "slug": "front-end-only-users",
    "type": "plugin",
    "affected_version": "* - 3.2.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.32",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2005",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "blu Logistics \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "blu-logistics",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23591",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Street View (with 360° virtual tour) \u0026 Google maps + Local SEO \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-google-street-view",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13542",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Test Email \u003c= 1.1.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-test-email",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2325",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.2.12 - Unauthenticated SQL Injection",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5057",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Export and Import Users and Customers \u003c= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload",
    "slug": "users-customers-import-export-for-wp-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6558",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hide Admin Bar From Front End \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "hide-admin-bar-from-front-end",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53267",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flexible Wishlist for WooCommerce – Ecommerce Wishlist \u0026 Save for later \u003c= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification",
    "slug": "flexible-wishlist",
    "type": "plugin",
    "affected_version": "* - 1.2.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13718",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dynamic Pricing \u0026amp; Discounts Lite for WooCommerce \u003c= 2.0.3 - Cross-Site Request Forgery",
    "slug": "woo-dynamic-pricing-discounts-lite",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48342",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes - Worldwide Express Edition \u003c= 5.0.20 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-worldwide-express-edition",
    "type": "plugin",
    "affected_version": "* - 5.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13473",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Help Center by BestWebSoft \u003c 0.1.5 - Reflected Cross-Site Scripting",
    "slug": "timesheet",
    "type": "plugin",
    "affected_version": "[*, 0.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18590",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blockspare \u003c= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blockspare",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47363",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crypto \u003c= 2.15 - Cross-Site Request Forgery to Authentication Bypass",
    "slug": "crypto",
    "type": "plugin",
    "affected_version": "* - 2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9990",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Floating Buttons for WooCommerce \u003c= 2.8.8 - Missing Authorization",
    "slug": "shop-assistant-for-woocommerce-jarvis",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52395",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.982 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.982",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.982",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44001",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Post URL \u003c= 2.1.0 - Cross-Site Request Forgery",
    "slug": "wp-posturl",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1913",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Easy Appointments \u003c 1.12.0 - Cross-Site Scripting",
    "slug": "easy-appointments",
    "type": "plugin",
    "affected_version": "[*, 1.12.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-15812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-15812",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial WordPress Plugin \u003c 1.4.7 - Reflected Cross-Site Scripting",
    "slug": "ap-custom-testimonial",
    "type": "plugin",
    "affected_version": "[*, 1.4.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-23912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23912",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Page Generator Plugin \u003c= 3.3.17 - Authenticated (Administrator+) SQL Injection",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 3.3.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2607",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Armour Extended \u003c= 1.26 - Cross-Site Request Forgery",
    "slug": "wp-armour-extended",
    "type": "plugin",
    "affected_version": "* - 1.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43947",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "amoCRM WebForm \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "amocrm-webform",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28870",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend File Manager Plugin \u003c= 21.2 - Cross-Site Request Forgery to File Upload",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "* - 21.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3126",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Maps \u003c= 0.98 - Cross-Site Request Forgery",
    "slug": "interactive-maps",
    "type": "plugin",
    "affected_version": "* - 0.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.98",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39424",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Customer Email Verification for WooCommerce \u003c= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient Randomness",
    "slug": "emails-verification-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4185",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Word Count \u003c= 3.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-word-count",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3408",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVPMarker  \u003c= 11.6.2 - Unauthenticated SQL Injection",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 11.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31552",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GD Mylist \u003c= 1.1.1 - Stored Cross-Site Scripting",
    "slug": "gd-mylist",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0703",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Event Manager \u003c= 3.1.41 - Reflected Cross-Site Scripting via plugin",
    "slug": "wp-event-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0976",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Educenter \u003c= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "educenter",
    "type": "theme",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5529",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor \u003c= 3.13.2 Authenticated(Contributor+) Arbitrary Post Type Creation via save_item",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "[*, 3.13.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-33922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33922",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Persian WooCommerce SMS \u003c= 7.0.2 - Reflected Cross-Site Scripting",
    "slug": "persian-woocommerce-sms",
    "type": "plugin",
    "affected_version": "* - 7.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9213",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goolytics – Simple Google Analytics \u003c= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "goolytics-simple-google-analytics",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3132",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BulletProof Security \u003c= 5.1 - Sensitive Information Disclosure",
    "slug": "bulletproof-security",
    "type": "plugin",
    "affected_version": "* - 5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39327",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "TheRoof \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "theroof",
    "type": "theme",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29430",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YaMaps \u003c= 0.6.25 - Authenticaterd (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "yamaps",
    "type": "plugin",
    "affected_version": "* - 0.6.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0270",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Away \u003c= 3.9.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "file-away",
    "type": "plugin",
    "affected_version": "* - 3.9.9.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0431",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant and Cafe \u003c= 1.2.1 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "restaurant-and-cafe",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34379",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Geo Mashup \u003c= 1.13.16 - Unauthenticated Local File Inclusion",
    "slug": "geo-mashup",
    "type": "plugin",
    "affected_version": "* - 1.13.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48293",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ekiline Block Collection \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ekiline-block-collection",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51934",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Moving Media Library \u003c= 1.22 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Deletion",
    "slug": "moving-media-library",
    "type": "plugin",
    "affected_version": "* - 1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13897",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Post Carousel \u0026 Slider \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "post-types-carousel-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22750",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LuckyWP Table of Contents \u003c= 2.1.10 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "luckywp-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2299",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chartjs \u003c= 2023.2 - Authenticated(Editor+) Stored Cross-Site Scripting via chart",
    "slug": "enigma-chartjs",
    "type": "plugin",
    "affected_version": "* - 2023.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2023.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6082",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Erident Custom Login and Dashboard \u003c= 3.5.8 - Authenticated Stored Cross-Site Scripting",
    "slug": "erident-custom-login-and-dashboard",
    "type": "plugin",
    "affected_version": "* - 3.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24658",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Contact Form 7 DB \u003c= 1.6.2 - SQL Injection",
    "slug": "advanced-cf7-db",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-13571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13571",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modal Window – create popup modal window \u003c= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "modal-window",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2457",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clipr \u003c= 1.2.3 - Admin+ Stored Cross-Site Scripting",
    "slug": "clipr",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1559",
    "auth_type": "Privileged",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Icons for Features \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "icons-for-features",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10104",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49333",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c 2.3.16 - SQL Injection",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 2.3.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10942",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate WP Mail \u003c= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-wp-mail",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53454",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Libsyn Publisher Hub \u003c= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "libsyn-podcasting",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32140",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Checker \u003c= 2.4.0 - Reflected Cross-Site Scripting",
    "slug": "broken-link-checker",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8981",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Leaky Paywall \u003c= 4.20.8 - Missing Authorization to Price Manipulation",
    "slug": "leaky-paywall",
    "type": "plugin",
    "affected_version": "* - 4.20.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.20.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33594",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BMLT Meeting Map \u003c= 2.6.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "bmlt-meeting-map",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13593",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Magical Blocks \u003c= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magical-blocks",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31844",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-DownloadCounter \u003c= 1.01 - Cross-Site Request Forgery",
    "slug": "wp-downloadcounter",
    "type": "plugin",
    "affected_version": "* - 1.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52790",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Spoiler \u003c= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-spoiler",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35639",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.4, 5.4.5)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29450",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.7, 4.7.20)",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.20",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29450",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.0, 5.0.12)",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29450",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.1, 5.1.9)",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29450",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.2, 5.2.10)",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29450",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.5, 5.5.4)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29450",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.6, 5.6.3)",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29450",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.7, 5.7.1)",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29450",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.8, 4.8.16)",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29450",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.9, 4.9.17)",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29450",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.3, 5.3.7)",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29450",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Easy Social Feed \u003c= 6.5.6 - Cross-Site Request Forgery",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 6.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30526",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "cformsII \u003c= 15.0.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "cforms2",
    "type": "plugin",
    "affected_version": "* - 15.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22149",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "persian-woocommerce-shipping \u003c= 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "persian-woocommerce-shipping",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30898",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WOLF – WordPress Posts Bulk Editor and Manager Professional \u003c= 1.0.8.1 - Cross-Site Request Forgery",
    "slug": "bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0790",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Houzez CRM \u003c= 1.4.2 - Authenticated (Seller+) SQL Injection",
    "slug": "houzez-crm",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5792",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Syntax \u003c= 1.2 - Authenticated (Author+) Regex Denial of Service",
    "slug": "wp-syntax",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor \u003c= 4.0.1 -  Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5571",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Members \u003c= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7495",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feather Login Page \u003c= 1.1.3 - Cross-Site Request Forgery",
    "slug": "feather-login-page",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46777",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPML 2.9.3-3.2.6 - Cross-Site Scripting in Accept-Language Header",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "2.9.3 - 3.2.6",
    "from_version": "2.9.3",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9416",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Encoder – Protect Email Addresses and Phone Numbers \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "email-encoder-bundle",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1282",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "atec Debug \u003c= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletion",
    "slug": "atec-debug",
    "type": "plugin",
    "affected_version": "* - 1.2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9518",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HTML5 Webcam Microphone Recorder Forms \u003c 1.55 - Cross-Site Scripting",
    "slug": "video-comments-webcam-recorder",
    "type": "plugin",
    "affected_version": "* - 1.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.55",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4567",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress \u003c= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2113",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Awesome Gallery \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "awesome-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47632",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "QR Redirector \u003c 1.6.1 - Stored Cross-Site Scripting",
    "slug": "qr-redirector",
    "type": "plugin",
    "affected_version": "[*, 1.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24854",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Active Directory Integration / LDAP Integration \u003c= 4.1.0 - Unauthenticated Information Disclosure",
    "slug": "ldap-login-for-intranet-sites",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0812",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Bukza \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bukza",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11759",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Smart Messages for WooCommerce \u003c= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation",
    "slug": "wpc-smart-messages",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10437",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-BlackCheck \u003c= 2.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-blackcheck",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23511",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.5 - Authenticated Stored Cross-Site Scripting",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 6.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45429",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.5 - Authenticated Stored Cross-Site Scripting",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "* - 6.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45429",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coupon API \u003c= 6.2.9 - Authenticated (Administrator+) SQL Injection via 'log_duration'",
    "slug": "couponapi",
    "type": "plugin",
    "affected_version": "* - 6.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8692",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Count per Day \u003c 3.2.6 - Cross-Site Scripting",
    "slug": "count-per-day",
    "type": "plugin",
    "affected_version": "[*, 3.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-7472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7472",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCOM Member \u003c= 1.5.4 - Reflected Cross-Site Scripting",
    "slug": "wpcom-member",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47378",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group, Photo Stack, \u0026 Horizontal Timeline",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Additional Custom Emails \u0026amp; Recipients for WooCommerce \u003c= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-emails-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48251",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paytium: Mollie payment forms \u0026 donations \u003c= 4.3.7 - Missing Authorization in 'update_profile_preference'",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7288",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Powerplay Gallery \u003c= 3.3 - Arbitrary File Upload",
    "slug": "wp-powerplaygallery",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-5682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5682",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1074",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EnvíaloSimple \u003c= 2.2 - Cross-Site Request Forgery",
    "slug": "envialosimple-email-marketing-y-newsletters-gratis",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51416",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ARI Fancy Lightbox \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ari-fancy-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58784",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Maker \u003c= 1.16.4 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1104",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hubbub Lite \u003c= 1.31.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "social-pug",
    "type": "plugin",
    "affected_version": "* - 1.31.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7154",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 5.3.58 - Cross-Site Request Forgery",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 5.3.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49291",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "News \u0026 Blog Designer Pack – WordPress Blog Plugin  \u003c= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion",
    "slug": "blog-designer-pack",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5815",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form DB - Elementor \u003c= 1.7 - Reflected Cross-Site Scripting",
    "slug": "sb-elementor-contact-form-db",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2116",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP MultiTasking \u003c= 0.1.12 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-multitasking",
    "type": "plugin",
    "affected_version": "* - 0.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6852",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WhyDoWork AdSense \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "whydowork-adsense",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9099",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Login with phone number \u003c= 1.7.26 - Authentication Bypass due to Missing Empty Value Check",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "* - 1.7.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5150",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EMI Calculator \u003c= 1.1 - Missing Authorization to Unauthenticated Settings Change",
    "slug": "emi-calculator",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22265",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Qards (All Versions) - Stored Cross-Site Scripting",
    "slug": "qards",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-18598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18598",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Admin by DynamiApps \u003c= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation",
    "slug": "acf-frontend-form-element",
    "type": "plugin",
    "affected_version": "* - 3.19.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3729",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3550",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ChatBot 4.8.6 - 4.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "4.8.6 - 4.9.6",
    "from_version": "4.8.6",
    "from_inclusive": true,
    "to_version": "4.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5606",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infility Global \u003c= 2.12.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "infility-global",
    "type": "plugin",
    "affected_version": "* - 2.12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47651",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Easy Magazine \u003c= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "filtr8-magazine",
    "type": "plugin",
    "affected_version": "* - 2.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31741",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cooked – Recipe Management \u003c= 1.7.15.4 - Cross-Site Request Forgery via cooked_get_recipe_ids",
    "slug": "cooked",
    "type": "plugin",
    "affected_version": "* - 1.7.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.15.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39678",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Latest Post Shortcode \u003c= 14.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "latest-post-shortcode",
    "type": "plugin",
    "affected_version": "* - 14.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58609",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App \u003c=7.0.3.0 - Reflected Cross-Site Scripting",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 7.0.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11447",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 3.4.12 - Cross-Site Scripting",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 3.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-0602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0602",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accordions – Multiple Accordions or FAQs Builder \u003c= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'pages' parameter",
    "slug": "accordions-or-faqs",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45082",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Home Services \u003c= 1.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "home-services",
    "type": "theme",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26930",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Find Your Reps \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "find-your-reps",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23557",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Watu Quiz \u003c= 3.3.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25022",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Plugin Stats \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-plugin-stats",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7652",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Webinar Plugin – WebinarPress \u003c= 1.33.20 - Cross-Site Request Forgery",
    "slug": "wp-webinarsystem",
    "type": "plugin",
    "affected_version": "* - 1.33.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34818",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "QuickCab \u003c= 1.3.3 - Missing Authorization",
    "slug": "quickcab",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48337",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 2.1.5 - Authentication Bypass",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "[*, 2.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-36713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36713",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Split Test For Elementor \u003c= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "split-test-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32135",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles \u0026 User Role Editor \u003c= 3.12.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.12.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12738",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile Site Redirect \u003c= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mobile-site-redirect",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9884",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit Form Pro \u003c= 2.6.4 - Unauthenticated Arbitrary File Deletion",
    "slug": "bitformpro",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43248",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Thinkific Uploader \u003c= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "thinkific-uploader",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2426",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Astra \u003c= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name",
    "slug": "astra",
    "type": "theme",
    "affected_version": "* - 4.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2347",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Breakdance \u003c= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "breakdance",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5330",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Increase Sociability \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "increase-sociability",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54395",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Geo Controller \u003c= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion",
    "slug": "cf-geoplugin",
    "type": "plugin",
    "affected_version": "* - 8.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7380",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Alphabetical List \u003c= 1.0.3 - Cross-Site Request Forgery to Settings Update",
    "slug": "alphabetical-list",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8157",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mail Control \u003c= 0.2.8 - Unauthenticated Stored Cross-Site Scripting via Email Subject",
    "slug": "mail-control",
    "type": "plugin",
    "affected_version": "* - 0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3158",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDataTables - Tables \u0026 Table Charts (Premium) \u003c= 6.3.1 - Unauthenticated SQL Injection",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "* - 6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3820",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Shield Security \u003c= 18.5.7 - Unauthenticated Stored Cross-Site Scripting via getColumnContent_Page",
    "slug": "wp-simple-firewall",
    "type": "plugin",
    "affected_version": "* - 18.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22163",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.3.1 - Cross-Site Request Forgery to Plugin Activation",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23834",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP-Database-Optimizer-Tools \u003c= 0.2 - Cross-Site Request Forgery",
    "slug": "wp-database-optimizer-tools",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53219",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flexible Woocommerce Checkout Field Editor \u003c= 2.0.1 - Missing Authorization",
    "slug": "flexible-woocommerce-checkout-field-editor",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49817",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tealium \u003c= 2.1.20 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tealium",
    "type": "plugin",
    "affected_version": "* - 2.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50018",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Google Static Map \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-google-static-map",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27334",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link To Bible \u003c= 2.5.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "link-to-bible",
    "type": "plugin",
    "affected_version": "* - 2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37538",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 4.4.10 - Open Redirect and Reflected Cross-Site Scripting",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 4.4.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25102",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… \u003c= 4.4 - Cross-Site Request Forgery via publish_lp()",
    "slug": "ladipage",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4729",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_save_settings_callback'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1919",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Activity Log Pro \u003c= 2.3.3 - Unauthenticated Stored Cross-Site Scripting via User-Agent header",
    "slug": "user-activity-log-pro",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5167",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Triton Lite \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode",
    "slug": "triton-lite",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5789",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoomify embed for WP \u003c= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zoom-image-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58863",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Portfolio Plugin \u003c= 2.04 - Cross-Site Request Forgery",
    "slug": "portfolio-by-lisa-westlund",
    "type": "plugin",
    "affected_version": "* - 2.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-10017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10017",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Easy Post Mailer \u003c= 0.64 - Reflected Cross-Site Scripting",
    "slug": "wp-mailer",
    "type": "plugin",
    "affected_version": "* - 0.64",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.64",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23956",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rio Photo Gallery \u003c= 0.1 - Reflected Cross-Site Scripting",
    "slug": "rio-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23597",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ListingPro \u003c= 2.9.3 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "listingpro",
    "type": "theme",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-39624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39624",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pinpoint Booking System  \u003c= 2.9.9.2.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "* - 2.9.9.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0220",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simplified Content \u003c 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "simplified-content",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-1000150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.9.9.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30921",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Shopping Cart \u0026 eCommerce Store \u003c= 5.4.2 - Authenticated (Admin+) Local File Inclusion via import_file_url",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1124",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1590",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "TagDiv Composer \u003c= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13645",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Prevent files / folders access \u003c= 2.5.1 - Authenticated (Administrator+) Arbitrary File Upload in mo_media_restrict_page",
    "slug": "prevent-file-access",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4238",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventPrime \u003c 3.2.0 - Cross-Site Request Forgery",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "[*, 3.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4251",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Visualizer: Tables and Charts Manager for WordPress \u003c= 3.3.0 - Stored Cross-Site Scripting",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16931",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mingle Forum \u003c= 1.0.32.1 - SQL Injection",
    "slug": "mingle-forum",
    "type": "plugin",
    "affected_version": "[*, 1.0.33)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.33",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-5328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5328",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Database Peek  \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "database-peek",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0619",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Forms for Mailchimp 3.0 - 5.0.6 - Cross-Site Scripting",
    "slug": "yikes-inc-easy-mailchimp-extender",
    "type": "plugin",
    "affected_version": "3.0 - 5.0.6",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-7152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7152",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extra Product Options Builder for WooCommerce \u003c= 1.2.133 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "additional-product-fields-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.133",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.133",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9214",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RoyalSlider \u003c= 3.4.2 - Reflected Cross-Site Scripting",
    "slug": "new-royalslider",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30195",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.1.5 - Cross-Site Request Forgery via handleSubmitAction function",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40203",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Easy!Appointments \u003c= 1.4.0 - Authenticated(Subscriber+) Arbitrary File Deletion via 'disconnect'",
    "slug": "easyappointments",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32295",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "LiveAgent \u003c= 4.4.7 - Cross-Site Request Forgery",
    "slug": "liveagent",
    "type": "plugin",
    "affected_version": "* - 4.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47667",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "診断ジェネレータ作成プラグイン \u003c= 1.4.16 - Missing Authorization",
    "slug": "os-diagnosis-generator",
    "type": "plugin",
    "affected_version": "* - 1.4.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30934",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Buooy Sticky Header \u003c= 0.5.2 - Reflected Cross-Site Scripting",
    "slug": "buooy-sticky-header",
    "type": "plugin",
    "affected_version": "* - 0.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51699",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1028",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1028",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5338",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager Pro \u003c= 6.2.9 - Unauthenticated Information Disclosure",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "[4.0, 6.3.0)",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "6.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-1809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1809",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce Shipping Per Product \u003c= 2.5.4 - Missing Authorization",
    "slug": "woocommerce-shipping-per-product",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51499",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "eExamhall \u003c= 4.0 - Cross Site Request Forgery",
    "slug": "eexamhall",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-22681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22681",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TweetScroll Widget \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tweetscroll-widget",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33948",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ELEX WooCommerce Request a Quote \u003c= 2.3.5 - Missing Authorization",
    "slug": "elex-request-a-quote",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31406",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1926",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Greenshift – animation and page builder blocks \u003c= 8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 8.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35765",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz and Survey Master \u003c= 7.1.13 - Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-20792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20792",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce – Recent Purchases \u003c= 1.0.1 - Authenticated (Admin+) Local File Inclusion",
    "slug": "woo-recent-purchases",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-35634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35634",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YouTube Embed \u003c= 5.2.1 - Contributor+ Stored Cross-Site Scripting",
    "slug": "youtube-embed",
    "type": "plugin",
    "affected_version": "* - 5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24471",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration, User Profiles, Login \u0026 Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.1.3",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-34623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34623",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 6.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 6.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27848",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Futurio Extra \u003c= 1.8.2 - Cross-Site Request Forgery via 'futurio_extra_reset_mod'",
    "slug": "futurio-extra",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40201",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Jitsi Shortcode \u003c= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-jitsi-shortcodes",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3978",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AutomateWoo \u003c= 5.7.5 - Cross-Site Request Forgery",
    "slug": "automatewoo",
    "type": "plugin",
    "affected_version": "* - 5.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36513",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Recall – Registration, Profile, Commerce \u0026 More \u003c= 16.26.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1324",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget for Google Reviews \u003c= 1.0.15 - Unauthenticated Local File Inclusion",
    "slug": "business-reviews-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53565",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stylish Internal Links \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stylish-internal-links",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51939",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid, Post Carousel, \u0026 List Category Posts \u003c= 2.4.27 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "post-carousel",
    "type": "plugin",
    "affected_version": "* - 2.4.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3996",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARForms \u003c= 6.4.1 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Read",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "* - 6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54216",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Five Minute Webshop \u003c= 1.3.2 - Authenticated (Admin+) SQL Injection via orderby",
    "slug": "five-minute-webshop",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1685",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Joy Of Text Lite \u003c= 2.3.1 - Cross-Site Request Forgery",
    "slug": "joy-of-text",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7984",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Arconix FAQ \u003c= 1.9.4 - Missing Authorization",
    "slug": "arconix-faq",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38783",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u0026 WordPress MU \u003c 2.8.1 - Username Enumeration",
    "slug": "wpmu",
    "type": "core",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-2335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2335",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u0026 WordPress MU \u003c 2.8.1 - Username Enumeration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-2335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2335",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Display Post Metadata \u003c= 1.4.0 - Stored Cross-Site Scripting",
    "slug": "display-post-metadata",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24855",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Include URL \u003c= 0.3.5 - Authenticated (Contributor+) Arbitrary File Download",
    "slug": "include-url",
    "type": "plugin",
    "affected_version": "* - 0.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30594",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "EventPrime – Events Calendar, Bookings and Tickets \u003c= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 4.0.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12024",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCafe \u003c= 2.2.28 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-cafe",
    "type": "plugin",
    "affected_version": "* - 2.2.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43135",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooODT Lite \u003c= 2.4.6 - Reflected Cross-Site Scripting",
    "slug": "byconsole-woo-order-delivery-time",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45006",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bbp style pack \u003c= 5.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "bbp-style-pack",
    "type": "plugin",
    "affected_version": "[*, 5.6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44984",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Simple PayPal Shopping Cart \u003c= 5.1.3 - Insecure Direct Object Reference",
    "slug": "wordpress-simple-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3874",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPC Shop as a Customer for WooCommerce \u003c= 1.2.6 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "wpc-shop-as-customer",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50416",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MyBookProgress by Stormhill Media \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via book Parameter",
    "slug": "mybookprogress",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12598",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Feed PRO for WooCommerce \u003c= 12.4.0 - Cross-Site Request Forgery via update_project",
    "slug": "woo-product-feed-pro",
    "type": "plugin",
    "affected_version": "* - 12.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46793",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ocean Extra \u003c= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3457",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload – Contact Form 7 \u003c= 1.3.6.4 - File Upload Size Limit Bypass",
    "slug": "drag-and-drop-multiple-file-upload-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3282",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SB Breadcrumbs \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "sb-breadcrumbs",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28978",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2104",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Auto Poster \u003c= 5.3.14 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "social-auto-poster",
    "type": "plugin",
    "affected_version": "* - 5.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6753",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swift Performance Lite \u003c= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'",
    "slug": "swift-performance-lite",
    "type": "plugin",
    "affected_version": "* - 2.3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10516",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ocean Extra \u003c= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3472",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "FormCraft \u003c= 1.2.10 - Missing Authorization",
    "slug": "formcraft-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43157",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wonder Video Embed \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wonderplugin-video-embed",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13743",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1054",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wp2syslog \u003c= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp2syslog",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-25974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25974",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Microsoft Clarity \u003c= 0.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "microsoft-clarity",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-33850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-33850",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Modal \u003c 2.1.0 - SQL Injection",
    "slug": "easy-modal",
    "type": "plugin",
    "affected_version": "[*, 2.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-12947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-12947",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Forum Server \u003c 1.7.5 - Cross-Site Scripting",
    "slug": "forum-server",
    "type": "plugin",
    "affected_version": "[*, 1.7.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-6623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6623",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Pallet Packaging for WooCommerce \u003c= 1.1.15 - Missing Authorization",
    "slug": "pallet-packaging-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22285",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Prayer \u003c= 1.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-prayer",
    "type": "plugin",
    "affected_version": "[*, 1.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24313",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login as User or Customer (User Switching) \u003c= 3.8 - Authentication Bypass",
    "slug": "login-as-customer-or-user",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51484",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Table of Contents \u003c= 2.0.67 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "easy-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 2.0.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.67",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6334",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CarZine \u003c= 1.4.6 - Reflected Cross-Site Scripting",
    "slug": "carzine",
    "type": "theme",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23981",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HurryTimer \u003c= 2.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Name",
    "slug": "hurrytimer",
    "type": "plugin",
    "affected_version": "* - 2.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13735",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Members \u003c 3.1.8 - Cross-Site Scripting",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "[*, 3.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2222",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Githuber MD \u003c= 1.16.2 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "wp-githuber-md",
    "type": "plugin",
    "affected_version": "* - 1.16.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47846",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VibeBP \u003c= 1.9.9.4.1 - Unauthenticated Privilege Escalation",
    "slug": "vibebp",
    "type": "plugin",
    "affected_version": "* - 1.9.9.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56040",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yame | Link In Bio \u003c= 0.9.0 - Unauthenticated Information Exposure",
    "slug": "yame-linkinbio",
    "type": "plugin",
    "affected_version": "* - 0.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2880",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "IG Shortcodes \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ig-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30597",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unnamed \u003c 1.2.17.1 and Unnamed SE \u003c 1.0.3  - Cross-Site Scripting",
    "slug": "unnamed",
    "type": "theme",
    "affected_version": "* - 1.2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4166",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unnamed \u003c 1.2.17.1 and Unnamed SE \u003c 1.0.3  - Cross-Site Scripting",
    "slug": "unnamed-se",
    "type": "theme",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4166",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13342",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mandrill WP \u003c= 1.0.5 - Cross-Site Request Forgery",
    "slug": "email-form-under-post",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54394",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme \u003c= 1.4.0 - Unauthenticated Privilege Escalation to Editor",
    "slug": "lisfinity-core",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6042",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4223",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OptimizePress \u003c 1.6 - Arbitrary File Upload",
    "slug": "optimizepress",
    "type": "theme",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-7102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7102",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Soledad \u003c= 8.4.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-49825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49825",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "La Boom \u003c= 2.7 - Unauthenticated Local File Inclusion",
    "slug": "laboom",
    "type": "theme",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31632",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Magical Addons For Elementor \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magical-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54212",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Filter Post Category \u003c= 2.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-filter-post-categories",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46524",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 \u003c= 3.7.2 - Authenticated (Admin+) SQL Injection",
    "slug": "alipay",
    "type": "plugin",
    "affected_version": "* - 3.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24390",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 \u003c= 1.0.1 - Unauthenticated Information Exposure",
    "slug": "wp2speed",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37924",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WpEvently \u003c= 4.4.6 - Missing Authorization",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54705",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OmniLeads Scripts and Tags Manager \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "omnileads-scripts-and-tags-manager",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31460",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Meta Data and Taxonomies Filter (MDTF) \u003c= 1.3.3 - Missing Authorization",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32818",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.20",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.17",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.14",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.10",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.9",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.8",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.20",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.18",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.17",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.5",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.4",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9066",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Stock Ticker \u003c= 3.23.2 - Reflected Cross-Site Scripting in ajax_stockticker_symbol_search_test",
    "slug": "stock-ticker",
    "type": "plugin",
    "affected_version": "* - 3.23.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.23.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45365",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c=1.3.70 - Unauthenticated MailChimp API Key Disclosure",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3709",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload",
    "slug": "order-attachments-for-woocommerce",
    "type": "plugin",
    "affected_version": "2.0 - 2.4.1",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9756",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, \u0026 Flip Box",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shoutcast Icecast HTML5 Radio Player \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shoutcast-icecast-html5-radio-player",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8666",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-EMail \u003c= 2.69.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-email",
    "type": "plugin",
    "affected_version": "[*, 2.69.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.69.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-3721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3721",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Common Tools for Site \u003c= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "common-tools-for-site",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9115",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1759",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My WP Translate \u003c= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "my-wp-translate",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8425",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Tables \u003c= 1.3.9 - Reflected Cross-Site Scripting via error_msg",
    "slug": "wptables",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25453",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4485",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow Gallery \u003c= 1.6.5 - Reflected Cross-Site Scripting",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-17946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17946",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "tarteaucitron.js – Cookies legislation \u0026 GDPR \u003c= 1.5.4 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "tarteaucitronjs",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36887",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Everest Forms – Contact Form, Quiz, Survey, Newsletter \u0026 Payment Form Builder for WordPress \u003c= 3.1.1 - Unauthenticated PHP Object Injection",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3439",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themify Event Post \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themify-event-post",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30832",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.1.7.3.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.1.7.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45820",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post in page for Elementor \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-in-page-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46225",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brooklyn \u003c= 4.9.9.2 - Reflected Cross-Site Scripting",
    "slug": "brooklyn",
    "type": "theme",
    "affected_version": "* - 4.9.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24927",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Super Assistent \u003c= 1.5.3 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "amazonsimpleadmin",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8478",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Advanced Floating Content \u003c= 3.8.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "advanced-floating-content",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12031",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.0.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2010-5294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-5294",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Smiley \u003c= 1.4.1 - Cross-Site Scripting",
    "slug": "wp-smiley",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-4139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4139",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prayer Times Anywhere \u003c= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "prayer-times-anywhere",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22590",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajax Search Pro \u003c= 4.26.1 - Reflected Cross-Site Scripting",
    "slug": "ajax-search-pro",
    "type": "plugin",
    "affected_version": "* - 4.26.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.26.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Header \u0026 Footer Builder \u003c= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4634",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Raisely Donation Form \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcode",
    "slug": "raisely-donation-form",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3781",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.1.16 - Missing Authorization to Setting Manipulation",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2782",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "TemplatesNext ToolKit \u003c= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "templatesnext-toolkit",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4678",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ad Injection \u003c= 1.2.0.19 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ad-injection",
    "type": "plugin",
    "affected_version": "* - 1.2.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0661",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Terms Before Download \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "terms-before-download",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31614",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Graphina \u003c= 3.0.4 - Cross-Site Request Forgery to Local File Inclusion",
    "slug": "graphina-elementor-charts-and-graphs",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47533",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Software License Manager \u003c 4.4.6 - Cross-Site Request Forgery",
    "slug": "software-license-manager",
    "type": "plugin",
    "affected_version": "[*, 4.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-20782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20782",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.8.3 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2009-2853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2853",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "PowerPress \u003c= 6.0.0 - Cross-Site Scripting",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 6.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-1385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1385",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON \u003c= 2.1 - Missing Authorization to Event Access",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2796",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar \u003c= 5.8 - Missing Authorization",
    "slug": "mp3-music-player-by-sonaar",
    "type": "plugin",
    "affected_version": "* - 5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56266",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Premium SEO Pack – WP SEO Plugin \u003c= 1.6.002 - Unauthenticated Information Exposure",
    "slug": "premium-seo-pack",
    "type": "plugin",
    "affected_version": "* - 1.6.002",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.002",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3679",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Build App Online \u003c= 1.0.20 - Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update",
    "slug": "build-app-online",
    "type": "plugin",
    "affected_version": "* - 1.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51479",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Firelight Lightbox \u003c= 2.3.3 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "easy-fancybox",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50460",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Writesonic \u003c= 1.0.4 - Cross-Site Request Forgery",
    "slug": "writesonic",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53262",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Clinked Client Portal \u003c= 1.10 - Reflected Cross-Site Scripting",
    "slug": "clinked-client-portal",
    "type": "plugin",
    "affected_version": "* - 1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32615",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Activity Log \u003c= 1.6.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "user-activity-log",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-37966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37966",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Survey Maker – Customer Satisfaction Survey, Chat Survey, Calculaton Form, Payment Surveys \u003c= 4.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 4.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4061",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVP and Event Management \u003c= 2.7.7 - Unauthenticated Sensitive Information Disclosure",
    "slug": "rsvp",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1054",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contests by Rewards Fuel \u003c= 2.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting via update_rewards_fuel_api_key",
    "slug": "contests-from-rewards-fuel",
    "type": "plugin",
    "affected_version": "* - 2.0.64",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.64",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1787",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Primer MyData for Woocommerce \u003c= 4.2.1 - Reflected Cross-Site Scripting",
    "slug": "primer-mydata",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11809",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flash Video Player \u003c= 5.0.4 - Cross-Site Request Forgery",
    "slug": "flash-video-player",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32537",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content Function",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6455",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Dokan \u003c= 3.0.8 - Cross-Site Request Forgery Bypass",
    "slug": "dokan-lite",
    "type": "plugin",
    "affected_version": "[*, 3.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36748",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NS WooCommerce Watermark \u003c= 2.11.3 - Abuse of Functionality",
    "slug": "ns-woocommerce-watermark",
    "type": "plugin",
    "affected_version": "* - 2.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0989",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Advanced Woo Labels – Product Labels for WooCommerce \u003c= 1.93 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-woo-labels",
    "type": "plugin",
    "affected_version": "* - 1.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35675",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced AJAX Product Filters \u003c= 1.5.4.6 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-ajax-filters",
    "type": "plugin",
    "affected_version": "* - 1.5.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24432",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bunny’s Print CSS \u003c= 0.95 - Cross-Site Request Forgery to Settings Update",
    "slug": "bunnys-print-css",
    "type": "plugin",
    "affected_version": "* - 0.95",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.95",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5925",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Maniac SEO \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "maniac-seo",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23549",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackWPup \u003c 3.0.13 - Cross-Site Scripting",
    "slug": "backwpup",
    "type": "plugin",
    "affected_version": "[*, 3.0.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-4626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4626",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PW WooCommerce Bulk Edit \u003c= 2.134 - Cross-Site Request Forgery",
    "slug": "pw-bulk-edit",
    "type": "plugin",
    "affected_version": "* - 2.134",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.134",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47473",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Membership Subscriptions – Effortless Memberships, Recurring Payments \u0026 Content Restriction \u003c= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.13.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11291",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SEO Help \u003c= 6.6.1 - Missing Authorization",
    "slug": "seo-help",
    "type": "plugin",
    "affected_version": "* - 6.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32244",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.0.9 - Reflected Cross-Site Scripting",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29915",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GS Testimonial Slider \u003c= 3.2.9 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "gs-testimonial",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47481",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "eID Easy \u003c= 4.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "smart-id",
    "type": "plugin",
    "affected_version": "* - 4.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9128",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More \u003c= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update",
    "slug": "reviews-feed",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8199",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Short URL \u003c= 1.6.8 - Cross-Site Request Forgery",
    "slug": "shorten-url",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45058",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Field Template \u003c= 2.5.8 - Cross-Site Request Forgery via Plugin Options Update",
    "slug": "custom-field-template",
    "type": "plugin",
    "affected_version": "* - 2.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22695",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Awesome Logos \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "awesome-logos",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31899",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OpenPGP Form Encryption for WordPress \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "openpgp-form-encryption",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3919",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Edwiser Bridge \u003c= 3.0.5 - Authentication Bypass due to Missing Empty Value Check",
    "slug": "edwiser-bridge",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4186",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Salon Booking System \u003c= 10.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 10.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9882",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aparat Responsive \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "aparat-responsive",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26558",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Store Finder \u003c= 7.0 - Unauthenticated SQL Injection to Stored Cross-Site Scripting",
    "slug": "superstorefinder-wp",
    "type": "plugin",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13440",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "Exit Notifier \u003c= 1.10.4 - Reflected Cross-Site Scripting",
    "slug": "exit-notifier",
    "type": "plugin",
    "affected_version": "* - 1.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8730",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Category Dropdown \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-category-dropdown",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58239",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YourChannel \u003c= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "yourchannel",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1869",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid \u003c= 5.0.4 - Cross-Site Request Forgery in rttpg_spare_me",
    "slug": "the-post-grid",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46853",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Travelpayouts: All Travel Brands in One Place \u003c= 1.1.16 - Open Redirect",
    "slug": "travelpayouts",
    "type": "plugin",
    "affected_version": "* - 1.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0337",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPMobile.App — Android and iOS Mobile Application \u003c= 11.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "wpappninja",
    "type": "plugin",
    "affected_version": "* - 11.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22702",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "secure-files \u003c= 1.1 - Directory Traversal",
    "slug": "secure-files",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2005-10002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2005-10002",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Magic Post Voice \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "magic-post-voice",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39315",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OSM – OpenStreetMap \u003c= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "osm",
    "type": "plugin",
    "affected_version": "* - 6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3603",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPJobBoard \u003c= 4.5.1 - Cross-Site Scripting",
    "slug": "wpjobboard",
    "type": "plugin",
    "affected_version": "* - 4.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-15375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-15375",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CryoKey \u003c= 2.4 - Reflected Cross-Site Scripting via 'ckemail' Parameter",
    "slug": "cryokey",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2477",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Shortcodes Actions And Filters \u003c= 2.10 - Reflected Cross-Site Scripting",
    "slug": "add-actions-and-filters",
    "type": "plugin",
    "affected_version": "* - 2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30558",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eMagicOne Store Manager for WooCommerce \u003c= 1.2.5 - Unauthenticated Arbitrary File Deletion",
    "slug": "store-manager-connector",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4603",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "JS Job Manager \u003c= 2.0.0 - Missing Authorization",
    "slug": "js-jobs",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28689",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1571",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon Booking System \u003c= 10.20 - Missing Authorization to Unauthenticated AJAX Actions Execution",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 10.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8492",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ruven Themes: Shortcodes \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ruven-themes-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7648",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "glomex oEmbed \u003c= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "glomex-oembed",
    "type": "plugin",
    "affected_version": "* - 0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11873",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Parallax Scrolling Enllax.js \u003c= 0.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "parallax-scrolling-enllax-js",
    "type": "plugin",
    "affected_version": "* - 0.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58830",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eTemplates \u003c= 0.2.1 - Unauthenticated SQL Injection",
    "slug": "etemplates",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-55972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55972",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fast Custom Social Share by CodeBard \u003c= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "fast-custom-social-share-by-codebard",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48329",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OSD Subscribe \u003c= 1.2.3 - Reflected Cross-Site Scripting",
    "slug": "osd-subscribe",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38351",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Attach Accounts to Orders \u003c= 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "edd-attach-accounts-to-orders",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9507",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Time Clock \u003c= 1.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "time-clock",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47516",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c= 8.6.03.004 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 8.6.03.004",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.03.004",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31286",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "SEOPress – On-site SEO \u003c= 7.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6290",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spot.IM Comments \u003c 4.0.4 - Cross-Site Scripting",
    "slug": "spotim-comments",
    "type": "plugin",
    "affected_version": "[*, 4.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18608",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Piotnet Addons For Elementor Pro \u003c= 7.1.17 - Unauthenticated Server-Side Request Forgery",
    "slug": "piotnet-addons-for-elementor-pro",
    "type": "plugin",
    "affected_version": "* - 7.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-33634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33634",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ApplyOnline – Application Form Builder and Manager \u003c= 2.6.2 - Missing Authorization to Sensitive Information Exposure",
    "slug": "apply-online",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2036",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YAWPP (Yet Another WordPress Petition Plugin) \u003c= 1.2.1 - Authenticated SQL Injection",
    "slug": "yawpp",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5182",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cricket Live Score \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cricket-score",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11877",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accordions – Multiple Accordions or FAQs Builder \u003c= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'rawdata' parameter",
    "slug": "accordions-or-faqs",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45082",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Glossy \u003c= 2.3.5 - Reflected Cross-Site Scripting",
    "slug": "glossy",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13325",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Music Sheet Viewer \u003c= 4.1 - Unauthenticated Arbitrary File Read",
    "slug": "music-sheet-viewer",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13671",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "postMash Custom – custom post order \u003c= 1.0.3 - Unauthenticated SQL Injection",
    "slug": "postmash-custom",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30622",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Login Logout Menu \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "baw-login-logout-menu",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Localization \u003c= 0.1.0 - Reflected Cross-Site Scripting",
    "slug": "quick-localization",
    "type": "plugin",
    "affected_version": "* - 0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30607",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bg Orthodox Calendar \u003c= 0.13.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "bg-orthodox-calendar",
    "type": "plugin",
    "affected_version": "* - 0.13.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.13.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28958",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c=1.8.2 - SQL Injection via tutor_quiz_builder_get_answers_by_question",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24182",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[7.1.0, 7.1.1)",
    "from_version": "7.1.0",
    "from_inclusive": true,
    "to_version": "7.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[7.2.0, 7.2.1)",
    "from_version": "7.2.0",
    "from_inclusive": true,
    "to_version": "7.2.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[5.5.0, 5.5.1)",
    "from_version": "5.5.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[5.7.0, 5.7.1)",
    "from_version": "5.7.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[6.3.0, 6.3.1)",
    "from_version": "6.3.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[6.6.0, 6.6.1)",
    "from_version": "6.6.0",
    "from_inclusive": true,
    "to_version": "6.6.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[6.8.0, 6.8.1)",
    "from_version": "6.8.0",
    "from_inclusive": true,
    "to_version": "6.8.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "7.4.0",
    "from_version": "7.4.0",
    "from_inclusive": true,
    "to_version": "7.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[5.8.0, 5.8.2)",
    "from_version": "5.8.0",
    "from_inclusive": true,
    "to_version": "5.8.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[6.0.0, 6.0.1)",
    "from_version": "6.0.0",
    "from_inclusive": true,
    "to_version": "6.0.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[6.1.0, 6.1.1)",
    "from_version": "6.1.0",
    "from_inclusive": true,
    "to_version": "6.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[6.9.0, 6.9.1)",
    "from_version": "6.9.0",
    "from_inclusive": true,
    "to_version": "6.9.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[7.3.0, 7.3.1)",
    "from_version": "7.3.0",
    "from_inclusive": true,
    "to_version": "7.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[5.9.0, 5.9.1)",
    "from_version": "5.9.0",
    "from_inclusive": true,
    "to_version": "5.9.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[6.2.0, 6.2.1)",
    "from_version": "6.2.0",
    "from_inclusive": true,
    "to_version": "6.2.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[6.7.0, 6.7.1)",
    "from_version": "6.7.0",
    "from_inclusive": true,
    "to_version": "6.7.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[7.0.0, 7.0.3)",
    "from_version": "7.0.0",
    "from_inclusive": true,
    "to_version": "7.0.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[5.6.0, 5.6.3)",
    "from_version": "5.6.0",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[6.4.0, 6.4.4)",
    "from_version": "6.4.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[6.5.0, 6.5.2)",
    "from_version": "6.5.0",
    "from_inclusive": true,
    "to_version": "6.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "User Registration \u003c 2.0.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-user-manager",
    "type": "plugin",
    "affected_version": "[*, 2.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24654",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "National Weather Service Alerts \u003c= 1.3.5 - Unauthenticated Local File Inclusion",
    "slug": "national-weather-service-alerts",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52809",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup box \u003c= 4.5.1 - Missing Authorization",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "* - 4.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37096",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SEOPress \u003c= 7.7.2 - Authenticated (Contributor+) Open Redirect",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 7.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4900",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Flow Plus \u003c= 5.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-imageflow2",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49695",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Revolution Video Player With Bottom Playlist \u003c= 2.9.2 - Reflected Cross-Site Scripting",
    "slug": "revolution_video_player",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53212",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10365",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Nota Fiscal Eletrônica WooCommerce \u003c= 3.4.0.6 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "nota-fiscal-eletronica-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60158",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EU/UK VAT Manager for WooCommerce \u003c= 2.12.12 - Reflected Cross-Site Scripting",
    "slug": "eu-vat-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.12.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8788",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SingSong \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "singsong",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez \u003c= 2.7.1 - Privilege Escalation",
    "slug": "houzez",
    "type": "theme",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-26540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26540",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Add Google +1 (Plus one) social share Button \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "add-google-plus-one-social-share-button",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3866",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPB Show Core \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "wpb-show-core",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3484",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP GDPR \u003c= 2.1.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-gdpr-core",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-20628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-20628",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Automatic User Roles Switcher \u003c= 1.1.1 - Missing Authorization to Privilege Escalation",
    "slug": "automatic-user-roles-switcher",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3419",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Youtube Channel Gallery \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "youtube-channel-gallery",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4783",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31892",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Popups \u003c= 2.1.4.7 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode",
    "slug": "wp-popups-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4716",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Toolpage \u003c= 1.6.1 - Cross-Site Scripting",
    "slug": "toolpage",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4560",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARForms \u003c= 6.4 - Missing Authorization to Arbitrary Plugin Activation/Deactivation",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32705",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Poll Maker \u003c= 5.5.0 - Missing Authorization",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24577",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ChatBot \u003c= 6.7.3 - Missing Authorization",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 6.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53200",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Link Library \u003c= 7.5.13 - Reflected Cross-Site Scripting via 'link_price' and 'link_tags'",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.5.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24879",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Directory Plugin \u003c= 5.11.1 - Cross-Site Request Forgery to Arbitrary Payment History Update",
    "slug": "business-directory-plugin",
    "type": "plugin",
    "affected_version": "* - 5.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24251",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4937",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2560",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frisbii Pay \u003c= 1.8.2.1 - Missing Authorization",
    "slug": "reepay-checkout-gateway",
    "type": "plugin",
    "affected_version": "* - 1.8.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58616",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via filter_list parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6572",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP User Frontend Pro \u003c= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wp-user-frontend-pro",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3055",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "CTT Expresso para WooCommerce \u003c= 3.2.12 - Information Exposure via Unprotected Directory",
    "slug": "ctt-expresso-para-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6687",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Depicter Slider \u003c= 3.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "depicter",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37414",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TM Islamic Helper \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "tm-islamic-helper",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52458",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SureDash \u003c= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "suredash",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48164",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder – Contact forms and much more \u003c= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3468",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vikinghammer Tweet \u003c= 0.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "vikinghammer-tweet",
    "type": "plugin",
    "affected_version": "* - 0.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8043",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPeMatico RSS Feed Fetcher \u003c= 2.8.10 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "wpematico",
    "type": "plugin",
    "affected_version": "* - 2.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57937",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… \u003c= 4.4 - Missing Authorization on publish_lp()",
    "slug": "ladipage",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4728",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Accordion \u003c= 2.2.8 - Unprotected AJAX Action to Stored/Reflected Cross-Site Scripting",
    "slug": "accordions",
    "type": "plugin",
    "affected_version": "[*, 2.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-13644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13644",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Manage User Columns \u003c= 1.0.5 - Cross-Site Request Forgery",
    "slug": "manage-user-columns",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Master Slider – Responsive Touch Slider \u003c= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13757",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePro \u003c= 1.3 - Authenticated (Subscriber+) Stored Cross Site Scripting",
    "slug": "profilepro",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6668",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP BASE Booking of Appointments, Services and Events \u003c= 4.9.2 - Reflected Cross-Site Scripting",
    "slug": "wp-base-booking-of-appointments-services-and-events",
    "type": "plugin",
    "affected_version": "* - 4.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12737",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8961",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker \u003c= 4.0.6 - Reflected Cross-Site Scripting",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29918",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XT Floating Cart for WooCommerce \u003c= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "woo-floating-cart-lite",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9178",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update",
    "slug": "checkout-mestres-wp",
    "type": "plugin",
    "affected_version": "8.6.5 - 8.7.5",
    "from_version": "8.6.5",
    "from_inclusive": true,
    "to_version": "8.7.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2266",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP DataTable \u003c= 0.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-datatable",
    "type": "plugin",
    "affected_version": "* - 0.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53292",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon \u0026 Maintenance Mode by Colorlib \u003c= 1.0.99 - Information Exposure",
    "slug": "colorlib-coming-soon-maintenance",
    "type": "plugin",
    "affected_version": "* - 1.0.99",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.99",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1473",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Hospital Management System \u003c= 47.0(20-11-2023) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "hospital-management",
    "type": "plugin",
    "affected_version": "[*, 47.0(20-11-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "47.0(20-11-2023)",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47631",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BSK Forms Blacklist \u003c= 3.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bsk-gravityforms-blacklist",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5980",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Sales in Google Analytics and other tools \u003c= 2.0.0 - Open Redirect",
    "slug": "wecantrack",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12561",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KiviCare \u003c= 3.6.6 - Authenticated (Patient+) Insecure Direct Object Reference",
    "slug": "kivicare-clinic-management-system",
    "type": "plugin",
    "affected_version": "* - 3.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35659",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9888",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins \u003c= 2.0.59 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "related-post",
    "type": "plugin",
    "affected_version": "2.0.59",
    "from_version": "2.0.59",
    "from_inclusive": true,
    "to_version": "2.0.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12634",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event post \u003c= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "event-post",
    "type": "plugin",
    "affected_version": "* - 5.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24585",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Calendar for GeoDirectory \u003c= 2.3.14 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "events-for-geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26967",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup with fancybox \u003c= 3.5 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "popup-with-fancybox",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5465",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YourChannel \u003c= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Update",
    "slug": "yourchannel",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1870",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AZAN Plugin \u003c= 0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "azan",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3993",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Thumbnails \u003c= 2.12.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "video-thumbnails",
    "type": "plugin",
    "affected_version": "* - 2.12.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3828",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kleo \u003c 5.4.4 - Reflected Cross-Site Scripting",
    "slug": "kleo",
    "type": "theme",
    "affected_version": "[*, 5.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-56209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56209",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AfterShip Tracking \u003c= 1.17.17 - Missing Authorization",
    "slug": "aftership-woocommerce-tracking",
    "type": "plugin",
    "affected_version": "* - 1.17.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58201",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mavis HTTPS to HTTP Redirection \u003c= 1.4.3 - Cross-Site Request Forgery",
    "slug": "mavis-https-to-http-redirect",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58261",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Medical Addon for Elementor \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "medical-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44024",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quentn WP \u003c= 1.2.8 - Unauthenticated SQL Injection",
    "slug": "quentn-wp",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39595",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Custom Content Scrollbar \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-content-scrollbar",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31574",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UltimateAI \u003c= 2.8.3 - Authentication Bypass",
    "slug": "Ultimate_AI",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9105",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "404 SEO Redirection \u003c= 1.3 - Cross-Site Request Forgery",
    "slug": "404-redirection-manager",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24324",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Points and Rewards for WooCommerce \u003c= 1.5.0 - Missing Authorization",
    "slug": "points-and-rewards-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27608",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Church Admin \u003c= 4.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30197",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Timely Booking Button \u003c= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "timely-booking-button",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44987",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Tickets with Ticket Scanner \u003c= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "event-tickets-with-ticket-scanner",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9866",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GamiPress – Vimeo integration \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gamipress-vimeo-integration",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0154",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Optimization by Optimole – Lazy Load, CDN, Convert WebP \u0026 AVIF \u003c= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "optimole-wp",
    "type": "plugin",
    "affected_version": "* - 3.12.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4636",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cardealer \u003c= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "cardealer",
    "type": "theme",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1682",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "QR Redirector \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "qr-redirector",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24853",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons \u003c= 5.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47392",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Glossary by WPPedia \u003c= 1.3.0 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "wppedia",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4803",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Team Members \u003c= 3.4.4 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "wps-team",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32686",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Double Opt-In for Download \u003c= 2.0.8 - SQL Injection",
    "slug": "double-opt-in-for-download",
    "type": "plugin",
    "affected_version": "[*, 2.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-7517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7517",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ally - Web Accessibility \u0026 Usability \u003c= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "pojo-accessibility",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10700",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PCA Predict \u003c= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "address-email-and-phone-validation",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40195",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetWooBuilder \u003c= 2.1.18 - Missing Authorization",
    "slug": "jet-woo-builder",
    "type": "plugin",
    "affected_version": "* - 2.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39449",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Admin Page Spider \u003c= 3.31 -  Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "admin-page-spider",
    "type": "plugin",
    "affected_version": "* - 3.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2401",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Views Count \u003c= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "baw-post-views-count",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4761",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Shortcodes Plugin — Shortcodes Ultimate \u003c= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "[*, 5.10.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24525",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carrot \u003c= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "carrrot",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40328",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Database Toolset \u003c= 1.8.4 - Unauthenticated Arbitrary File Deletion",
    "slug": "database-toolset",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3065",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "OS BXSlider \u003c= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "os-bxslider",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52342",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Envato Elements \u003c= 2.0.10 \u0026 Template Kit \u003c= 1.0.13  - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "template-kit-import",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4330",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Envato Elements \u003c= 2.0.10 \u0026 Template Kit \u003c= 1.0.13  - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "envato-elements",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4330",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "nBlocks \u003c= 1.0.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "nblocks",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52450",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "USS Upyun \u003c= 1.5.0 - Cross-Site Request Forgery",
    "slug": "uss-upyun",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9629",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder – More than Just a Page Builder \u003c= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.25.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10453",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flytedesk Digital \u003c= 20181101 - Cross-Site Request Forgery",
    "slug": "flytedesk-digital",
    "type": "plugin",
    "affected_version": "* - 20181101",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20181101",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60172",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5583",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Marketing Twitter Bot \u003c= 1.11 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting",
    "slug": "wordpress-twitterbot",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7197",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Encryption – One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect to Force HTTPS, SSL Score \u003c= 7.0 - Sensitive Information Exposure via insufficiently protected files",
    "slug": "wp-letsencrypt-ssl",
    "type": "plugin",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7046",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Accurate Form Data \u003c= 1.2 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "accurate-form-data-real-time-form-validation",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9443",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AnyComment \u003c= 0.2.17 - Race Condition",
    "slug": "anycomment",
    "type": "plugin",
    "affected_version": "[*, 0.2.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0279",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Filter Portfolio Gallery \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "filter-portfolio-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24795",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8910",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin \u003c= 3.1.0 - Unauthenticated SQL Injection",
    "slug": "users-ultra",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0769",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RSVPMaker \u003c= 9.2.6 - Unauthenticated SQL Injection",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 9.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1505",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slider \u0026 Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel \u003c= 3.1.1 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "depicter",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4389",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Page Access Restriction \u003c= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters",
    "slug": "simple-page-access-restriction",
    "type": "plugin",
    "affected_version": "* - 1.0.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5142",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "viral-news",
    "type": "theme",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33923",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "hashone",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33923",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "viral",
    "type": "theme",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33923",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Team Manager \u003c= 2.3.16 - Missing Authorization",
    "slug": "wp-team-manager",
    "type": "plugin",
    "affected_version": "* - 2.3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58222",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Marketo Forms and Tracking \u003c= 1.0.2 - Cross-Site Request Forgery",
    "slug": "marketo-forms-and-tracking",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-6849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-6849",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Site Audit \u003c= 1.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "site-audit",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24445",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rating Widget \u003c= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes",
    "slug": "rating-widget",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23831",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Message Filter for Contact Form 7 \u003c= 1.6.3.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "cf7-message-filter",
    "type": "plugin",
    "affected_version": "* - 1.6.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46252",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.3.3 - Improper Authorization Checks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-0664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0664",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 4.4.3 - Authorization Bypass",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "1.0.15 - 4.4.3",
    "from_version": "1.0.15",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24964",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Get Post Content Shortcode \u003c= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcode",
    "slug": "get-post-content-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12447",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "The Ultimate Video Player For WordPress \u003c= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "presto-player",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2428",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "tagDiv Composer \u003c= 4.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3170",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IWS - Geo Form Fields \u003c= 1.0 - Unauthenticated SQL Injection",
    "slug": "iws-geo-form-fields",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4117",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NAVER Analytics \u003c= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "naver-analytics",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51700",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Moving Users \u003c= 1.05 - Unauthenticated Sensitive Information Exposure",
    "slug": "moving-users",
    "type": "plugin",
    "affected_version": "* - 1.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12637",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Strong Testimonials \u003c= 3.1.10 - Cross-Site Request Forgery",
    "slug": "strong-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52123",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "2.9.36 - 2.9.42",
    "from_version": "2.9.36",
    "from_inclusive": true,
    "to_version": "2.9.42",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-1209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1209",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CommonsBooking \u003c 2.6.8 - Unauthenticated SQL Injection",
    "slug": "commonsbooking",
    "type": "plugin",
    "affected_version": "[*, 2.6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0658",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appointment Calendar \u003c= 2.9.6 - Reflected Cross-Site Scripting",
    "slug": "appointment-calendar",
    "type": "plugin",
    "affected_version": "* - 2.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30561",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Testimonial Widget \u003c= 3.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-testimonial-widget",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43967",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Portfolio Builder – Portfolio Gallery \u003c= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "uber-grid",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49302",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ColorMag \u003c= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation",
    "slug": "colormag",
    "type": "theme",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0679",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) \u003c= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read",
    "slug": "delicious-recipes",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7626",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "WooCommerce Box Office \u003c= 1.1.50 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woocommerce-box-office",
    "type": "plugin",
    "affected_version": "* - 1.1.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34004",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 3.4.2.3 - Cross-Site Request Forgery",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 3.4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37235",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elfsight Yottie Lite \u003c= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "yottie-lite",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26561",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twitter Shortcode \u003c= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "twitter-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23618",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blocksy Companion \u003c= 1.8.81 - Authenticated(Subscriber+) Sensitive Information Exposure via blocksy_posts shortcode",
    "slug": "blocksy-companion",
    "type": "plugin",
    "affected_version": "* - 1.8.81",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.81",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1911",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Aruba HiSpeed Cache \u003c= 2.0.6 - Sensitive Information Exposure via Log File",
    "slug": "aruba-hispeed-cache",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44983",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Favicon by RealFaviconGenerator \u003c= 1.3.21 - Reflected Cross-Site Scripting",
    "slug": "favicon-by-realfavicongenerator",
    "type": "plugin",
    "affected_version": "[*, 1.3.21)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.21",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24437",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bootscraper \u003c= 3.0.0 - Unauthenticated Local File Inclusion",
    "slug": "wp-bootscraper",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52449",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MailCWP \u003c= 1.100 - Arbitrary File Upload",
    "slug": "mailcwp",
    "type": "plugin",
    "affected_version": "* - 1.100",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.100",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-1000000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000000",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Reset \u003c= 1.86 - Authenticated Stored Cross-Site Scripting via extra_data Parameter",
    "slug": "wp-reset",
    "type": "plugin",
    "affected_version": "* - 1.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24424",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.21.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.21.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.21.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2215",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Missing Authorization in 'wpfc_preload_single_callback'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1928",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP JobHunt \u003c= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover",
    "slug": "wp-jobhunt",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11284",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MM-email2image \u003c= 0.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mm-email2image",
    "type": "plugin",
    "affected_version": "* - 0.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3076",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YouTube Showcase \u003c= 3.5.1 - Unauthenticated PHP Object Injection",
    "slug": "youtube-showcase",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54731",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CformsII \u003c=11.5 - Cross-Site Scripting",
    "slug": "cforms2",
    "type": "plugin",
    "affected_version": "* - 11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2010-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-3977",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider  \u003c= 3.92.0 - Cross-Site Request Forgery",
    "slug": "ml-slider",
    "type": "plugin",
    "affected_version": "* - 3.92.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.92.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24533",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LoginPress Pro \u003c 3.0 - Captcha Bypass",
    "slug": "loginpress-pro",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-32676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32676",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Asset CleanUp: Page Speed Booster \u003c= 1.3.8.4 - Reflected Cross-Site Scripting",
    "slug": "wp-asset-clean-up",
    "type": "plugin",
    "affected_version": "* - 1.3.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36899",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP2LEADS \u003c= 3.2.7 - Missing Authorization",
    "slug": "wp2leads",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31375",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Header Images \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-header-images",
    "type": "plugin",
    "affected_version": "[*, 2.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24798",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Next \u003c= 1.1.0 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "the-next",
    "type": "theme",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7561",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cost Calculator Builder \u003c= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "* - 3.5.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.32",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9243",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Easy Pricing Tables \u003c= 3.1.2 - Arbitrary Post Removal via Cross-Site Request Forgery",
    "slug": "easy-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25098",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "BackupBuddy \u003c 3.0 - Authentication Bypass",
    "slug": "backupbuddy",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-2742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2742",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Submitted Posts \u003c 20160215 - Reflected Cross-Site Scripting",
    "slug": "user-submitted-posts",
    "type": "plugin",
    "affected_version": "[*, 20160215)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20160215",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-11001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11001",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Key4ce osTicket Bridge \u003c= 1.4.0 - Reflected Cross-Site Scripting",
    "slug": "key4ce-osticket-bridge",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28877",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 5.2.63 - Denial of Service",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 5.2.63",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.63",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12601",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Transposh WordPress Translation \u003c= 1.0.9.6 - Unauthorized Settings Change",
    "slug": "transposh-translation-filter-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2461",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13616",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple ServMask Plugins \u003c= (Various Versions) - Missing Authorization to Access Token Update",
    "slug": "all-in-one-wp-migration-dropbox-extension",
    "type": "plugin",
    "affected_version": "* - 3.75",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.75",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40004",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple ServMask Plugins \u003c= (Various Versions) - Missing Authorization to Access Token Update",
    "slug": "all-in-one-wp-migration-onedrive-extension",
    "type": "plugin",
    "affected_version": "* - 1.66",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.66",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40004",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple ServMask Plugins \u003c= (Various Versions) - Missing Authorization to Access Token Update",
    "slug": "all-in-one-wp-migration-gdrive-extension",
    "type": "plugin",
    "affected_version": "* - 2.79",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.79",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40004",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple ServMask Plugins \u003c= (Various Versions) - Missing Authorization to Access Token Update",
    "slug": "all-in-one-wp-migration-box-extension",
    "type": "plugin",
    "affected_version": "* - 1.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40004",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Captain Slider \u003c= 1.0.6 - Stored Cross-Site Scripting",
    "slug": "captain-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9419",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Layer Slider \u003c= 1.1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slider-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23798",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "heateor-social-comments",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23977",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by emarket-design \u003c= Multiple Versions - Unauthenticated Limited Remote Code Execution",
    "slug": "software-issue-manager",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8420",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by emarket-design \u003c= Multiple Versions - Unauthenticated Limited Remote Code Execution",
    "slug": "campus-directory",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8420",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by emarket-design \u003c= Multiple Versions - Unauthenticated Limited Remote Code Execution",
    "slug": "employee-staff-directory",
    "type": "plugin",
    "affected_version": "* - 4.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8420",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by emarket-design \u003c= Multiple Versions - Unauthenticated Limited Remote Code Execution",
    "slug": "youtube-showcase",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8420",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by emarket-design \u003c= Multiple Versions - Unauthenticated Limited Remote Code Execution",
    "slug": "wp-easy-contact",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8420",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by emarket-design \u003c= Multiple Versions - Unauthenticated Limited Remote Code Execution",
    "slug": "request-a-quote",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8420",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by emarket-design \u003c= Multiple Versions - Unauthenticated Limited Remote Code Execution",
    "slug": "wp-easy-events",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8420",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by emarket-design \u003c= Multiple Versions - Unauthenticated Limited Remote Code Execution",
    "slug": "wp-ticket",
    "type": "plugin",
    "affected_version": "* - 6.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8420",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Product Multi-Action \u003c= 1.3 - Unauthenticated PHP Object Injection",
    "slug": "Woo-product-multiaction",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49417",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Share And Social Locker \u003c= 1.4.1 - Reflected Cross-Site Scripting",
    "slug": "social-share-and-social-locker-arsocial",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31902",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator \u003c= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)",
    "slug": "feedzy-rss-feeds",
    "type": "plugin",
    "affected_version": "* - 4.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6805",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Estate Manager \u003c= 7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "real-estate-manager",
    "type": "plugin",
    "affected_version": "* - 7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58253",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "* - 9.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26762",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce SagePay Direct Payment Gateway \u003c 0.1.6.7 - Cross-Site Scripting",
    "slug": "sagepay-direct-for-woocommerce-payment-gateway",
    "type": "plugin",
    "affected_version": "[*, 0.1.6.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.6.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-4549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4549",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 6.3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9529",
    "auth_type": "Privileged",
    "cvss_score": 5.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "6.3.8",
    "from_version": "6.3.8",
    "from_inclusive": true,
    "to_version": "6.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9529",
    "auth_type": "Privileged",
    "cvss_score": 5.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 6.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9529",
    "auth_type": "Privileged",
    "cvss_score": 5.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "6.3.7",
    "from_version": "6.3.7",
    "from_inclusive": true,
    "to_version": "6.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9529",
    "auth_type": "Privileged",
    "cvss_score": 5.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "* - 6.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9529",
    "auth_type": "Privileged",
    "cvss_score": 5.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Campaign URL Builder \u003c= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "campaign-url-builder",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0538",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cost Calculator Builder PRO \u003c= 3.2.1 -  Unauthenticated Price Manipulation",
    "slug": "cost-calculator-builder-pro",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6010",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hive Support – WordPress Help Desk \u003c= 1.1.6 - Missing Authorization",
    "slug": "hive-support",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22298",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple URLs \u003c= 117 - Reflected Cross-Site Scripting via 'post_id'",
    "slug": "simple-urls",
    "type": "plugin",
    "affected_version": "* - 117",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "117",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40667",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms and User Login \u003c= 4.6.0.3 - Authenticated Email Injection",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 4.6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-9455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9455",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-reCAPTCHA-bp \u003c= 4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-recaptcha-bp",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46541",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Login \u003c= 5.9.0 - Authentication Bypass via Disqus OAuth provider",
    "slug": "oa-social-login",
    "type": "plugin",
    "affected_version": "* - 5.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10961",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ForumWP – Forum \u0026 Discussion Board Plugin \u003c= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover",
    "slug": "forumwp",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8428",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Order Delivery Date for WooCommerce \u003c= 3.21.0 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "order-delivery-date-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.21.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32434",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gutenify \u003c= 1.5.4 - Unauthenticated Local File Inclusion",
    "slug": "gutenify",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53326",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Uk Cookie \u003c= 1.1 - Cross-Site Scripting",
    "slug": "uk-cookie",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-5856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5856",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop File Upload for Elementor Forms \u003c= 1.4.3 - Unauthenticated Arbitrary File Deletion",
    "slug": "drag-and-drop-file-upload-for-elementor-forms",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47492",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking \u003c= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposure",
    "slug": "easync-booking",
    "type": "plugin",
    "affected_version": "* - 1.3.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4691",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Remove Duplicate Posts \u003c= 1.3.5 - Missing Authorization to Post Deletion",
    "slug": "remove-duplicate-posts",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29237",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WOLF \u003c= 1.0.7 - Cross-Site Request Forgery via create_profile",
    "slug": "bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34028",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Herd Effects \u003c= 5.2.3 - Cross-Site Request Forgery to Effect Deletion",
    "slug": "mwp-herd-effect",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4318",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Project Source Code Download \u003c= 1.0.0 - Unauthenticated Backup Download",
    "slug": "project-source-code-download",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1585",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Sticky Bar \u003c= 2.6.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "UNKNOWN-CVE-2023-5509-1",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2643",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Computer Repair Shop \u003c= 3.8115 - Unauthenticated Arbitrary File Upload",
    "slug": "computer-repair-shop",
    "type": "plugin",
    "affected_version": "* - 3.8115",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8115",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-51793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51793",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EELV Newsletter  \u003c= 4.8.2 - Reflected Cross-Site Scripting",
    "slug": "eelv-newsletter",
    "type": "plugin",
    "affected_version": "* - 4.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23602",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Blog Designer \u003c= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "sp-blog-designer",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31606",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GMAce \u003c= 1.5.2 - Cross-Site Request Forgery to Arbitrary File Modification (Creation/Overwrite/Deletion)",
    "slug": "gmace",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1509",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Landing pages and Domain aliases for WordPress \u003c= 0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "landing-pages-and-domain-aliases",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46533",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sapa \u003c= 1.1.14 - Unauthenticated Local File Inclusion",
    "slug": "sapa",
    "type": "theme",
    "affected_version": "* - 1.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.14",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49256",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP All Import Pro \u003c= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "wp-all-import-pro",
    "type": "plugin",
    "affected_version": "* - 4.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8722",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EditorsKit \u003c= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "block-options",
    "type": "plugin",
    "affected_version": "* - 1.40.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.40.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6635",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FancyBox for WordPress 3.0.2 - 3.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "fancybox-for-wordpress",
    "type": "plugin",
    "affected_version": "3.0.2 - 3.3.3",
    "from_version": "3.0.2",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0662",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Website Logo \u003c= 1.1 - Missing Authorization",
    "slug": "simple-website-logo",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32258",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Stripe Checkout \u003c= 1.2.2.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-stripe-checkout",
    "type": "plugin",
    "affected_version": "* - 1.2.2.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3986",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mancx AskMe Widget \u003c= 0.3 - Reflected Cross-Site Scripting",
    "slug": "mancx-askme-widget",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23718",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Image Gallery, Gallery Album \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "gallery-album",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30550",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podcast Importer SecondLine \u003c= 1.1.4 - Server-Side Request Forgery",
    "slug": "podcast-importer-secondline",
    "type": "plugin",
    "affected_version": "[*, 1.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-24149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24149",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Verge3D \u003c= 4.8.0 - Reflected Cross-Site Scripting",
    "slug": "verge3d",
    "type": "plugin",
    "affected_version": "* - 4.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22709",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Skimlinks Affiliate Marketing Tool \u003c= 1.3 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "skimlinks",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57943",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Box \u003c= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "[*, 3.8.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5874",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic URL SEO \u003c= 1.0 - Unauthenticated Cross-Site Scripting",
    "slug": "dynamic-url-seo",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52470",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fast Tube \u003c= 2.3.1 - Reflected Cross-Site Scripting",
    "slug": "fast-tube",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23770",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget for Google Reviews \u003c= 1.0.15 - Authenticated (Subscriber+) Directory Traversal to Local File Inclusion",
    "slug": "business-reviews-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7327",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Admin side data storage for Contact Form 7 \u003c= 1.1.2 - Stored Cross-Site Scripting",
    "slug": "admin-side-data-storage-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-24420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24420",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redux Converter \u003c= 1.1.3.1 - Reflected Cross-Site Scripting",
    "slug": "redux-converter",
    "type": "plugin",
    "affected_version": "* - 1.1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23427",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailUp Auto Subscription \u003c= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mailup-auto-subscribtion",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13521",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.3.13 - CSV Injection",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-16308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16308",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Be Shortcodes \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "be-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51881",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Insert Pages \u003c= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "insert-pages",
    "type": "plugin",
    "affected_version": "* - 3.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4483",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopSite \u003c= 1.5.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "shopsite-plugin",
    "type": "plugin",
    "affected_version": "* - 1.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13510",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accounting for WooCommerce \u003c= 1.6.6 - Reflected Cross-Site Scripting",
    "slug": "accounting-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11324",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ghost \u003c= 5.4.01 - Unauthenticated Limited File Read",
    "slug": "hide-my-wp",
    "type": "plugin",
    "affected_version": "* - 5.4.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.01",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2056",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Voting Record \u003c= 2.0 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting",
    "slug": "voting-record",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7083",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Trust Payments Gateway for WooCommerce \u003c= 1.1.4 - Unauthenticated SQL Injection",
    "slug": "trust-payments-hosted-payment-pages-integration",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28942",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Elementor AI Addons \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ai-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22758",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 2.3.3 - Unprotected AJAX Actions",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "[*, 2.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24282",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Publish to Schedule \u003c= 4.4.2 - Cross-Site Request Forgery leading to Plugin Option Changes",
    "slug": "publish-to-schedule",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25994",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 5.9.5 - Authenticated Stored Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 5.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16523",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recover abandoned cart for WooCommerce \u003c= 2.2 - Cross-Site Request Forgery",
    "slug": "recover-wc-abandoned-cart",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46243",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Content Audit \u003c= 1.6.0 - Authenticated (Admin+) SQL Injection",
    "slug": "content-audit",
    "type": "plugin",
    "affected_version": "[*, 1.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-5389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5389",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) \u003c= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10493",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Puca \u003c= 2.6.33 - Unauthenticated Local File Inclusion",
    "slug": "puca",
    "type": "theme",
    "affected_version": "* - 2.6.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.33",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30992",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YaySMTP 2.4.9 - 2.6.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "yaysmtp",
    "type": "plugin",
    "affected_version": "2.4.9 - 2.6.3",
    "from_version": "2.4.9",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0916",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add to Calendar Button \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "add-to-calendar-button",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46613",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form builder with drag \u0026 drop for WordPress – Kali Forms \u003c= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kali-forms",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3201",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Omnishop \u003c= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint",
    "slug": "omnishop",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6215",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HelloAsso \u003c= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update",
    "slug": "helloasso",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7605",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WP Hotel Booking \u003c= 1.10.3 - Remote Code Execution",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 1.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-29047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-29047",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Funnelforms Free \u003c= 3.4 - Missing Authorization to New Category Creation",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5415",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2438",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Calls to Action \u003c 2.5.1 - Cross-Site Scripting",
    "slug": "cta",
    "type": "plugin",
    "affected_version": "[*, 2.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-8350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-8350",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Watu Quiz \u003c= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0873",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.105 - Sensitive Information Exposure",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.105",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.105",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7315",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1534",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Compliance \u0026 Cookie Consent \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "gdpr-compliance-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45815",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Total \u003c= 2.1.59 - Missing Authorization to Authenticated (Subscriber+) Sections Update",
    "slug": "total",
    "type": "theme",
    "affected_version": "* - 2.1.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1771",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.6.20 - Missing Authorization",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59576",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Honeypot for WP Comment \u003c= 2.2.3 - Directory Traversal to Unauthenticated Arbitrary File Deletion",
    "slug": "honeypot-for-wp-comment",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-1350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1350",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Astra Widgets \u003c= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "astra-widgets",
    "type": "plugin",
    "affected_version": "* - 1.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56274",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3DPrint \u003c= 3.5.6.8 - Cross-Site Request Forgery to Arbitrary File Download",
    "slug": "3dprint",
    "type": "plugin",
    "affected_version": "* - 3.5.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4023",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
  },
  {
    "title": "External Login \u003c= 1.11.2 - Unauthenticated SQL Injection via log",
    "slug": "external-login",
    "type": "plugin",
    "affected_version": "* - 1.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-11177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11177",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "FastBook \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "fastbook-responsive-appointment-booking-and-scheduling-system",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26593",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic \u003c= 1.9 - Missing Authorization",
    "slug": "vagonic-sortable",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32236",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 13.1.0.9 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 13.1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27853",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: Pagelayer \u003c= 1.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via Header/Footer",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5087",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Calendar Events \u003c= 3.2.5 - Cross-Site Request Forgery via bulk_actions",
    "slug": "google-calendar-events",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46189",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Themify Builder \u003c= 7.0.5 - Cross-Site Request Forgery",
    "slug": "themify-builder",
    "type": "plugin",
    "affected_version": "* - 7.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24872",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal Widget",
    "slug": "essential-addons-elementor",
    "type": "plugin",
    "affected_version": "* - 5.8.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5612",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CodePen Embed Block \u003c= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "codepen-embed-block",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50023",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anchor Episodes Index (Spotify for Podcasters) \u003c= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor_episodes Shortcode",
    "slug": "anchor-episodes-index",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10189",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member – User Profile, User Registration, Login \u0026 Membership Plugin \u003c= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3383",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Progressive WordPress (PWA) \u003c= 2.1.13 - Missing Authorization",
    "slug": "progressive-wp",
    "type": "plugin",
    "affected_version": "* - 2.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33937",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stops Core Theme And Plugin Updates \u003c= 8.0.4 - Insufficient Restrictions on Option Changes",
    "slug": "stops-core-theme-and-plugin-updates",
    "type": "plugin",
    "affected_version": "* - 8.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15650",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder \u003c= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.20.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10583",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdsMiddle \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "adsmiddle",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23648",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Five Star Restaurant Menu and Food Ordering \u003c= 2.4.10 - Unauthenticated PHP Object Injection",
    "slug": "food-and-drink-menu",
    "type": "plugin",
    "affected_version": "* - 2.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5340",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Reading Library \u003c= 1.0 - Unauthenticated PHP Object Injection",
    "slug": "my-reading-library",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49318",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woocommerce Addon by Greenshift\u003c 1.9.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "greenshiftwoo",
    "type": "plugin",
    "affected_version": "[*, 1.9.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2024-43943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43943",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Event Expresso Free \u003c= 3.1.37.11.L - Authenticated SQL Injection",
    "slug": "event-espresso-free",
    "type": "plugin",
    "affected_version": "* - 3.1.37.11.L",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.37.11.L",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1002026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002026",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Get Quote For Woocommerce – Request A Quote For Woocommerce \u003c= 1.0.0 - Missing Authorization to Unauthenticated Quote PDF and CSV Download",
    "slug": "get-a-quote-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9430",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "LearnDash LMS \u003c= 4.10.1 - Sensitive Information Exposure via API",
    "slug": "sfwd-lms",
    "type": "plugin",
    "affected_version": "* - 4.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1210",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Vasaio QR Code \u003c= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "vasaio-qr-code",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46504",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Table Lite \u003c= 3.9.5 - Missing Authorization",
    "slug": "wc-product-table-lite",
    "type": "plugin",
    "affected_version": "* - 3.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39602",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Seo Free \u003c= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "seo-free",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51642",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCB \u003c= 2.4.8 - Reflected Cross-Site Scripting",
    "slug": "wpcb",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4581",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Pricing Table \u003c 5.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "dk-pricr-responsive-pricing-table",
    "type": "plugin",
    "affected_version": "[*, 5.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4810",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Sticky Bar \u003c= 2.7.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mystickymenu",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7133",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contexto \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "contexto",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23663",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy SVG Support \u003c= 3.2.0 - Cross-Site Scripting via SVG Upload",
    "slug": "easy-svg",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1964",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "MM Forms Community \u003c= 2.2.6 - Arbitrary File Upload",
    "slug": "mm-forms-community",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-3574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3574",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "URL Params \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "url-params",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0274",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Go Pricing - WordPress Responsive Pricing Tables \u003c= 3.3.19 - Improper Authorization to Arbitrary File Upload",
    "slug": "go_pricing",
    "type": "plugin",
    "affected_version": "* - 3.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2496",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Powerful Auto Chat \u003c= 1.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "powers-triggers-of-woo-to-chat",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22292",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Publish for Google My Business \u003c= 3.7 - Cross-Site Request Forgery",
    "slug": "wp-google-my-business-auto-publish",
    "type": "plugin",
    "affected_version": "[*, 3.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-47237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47237",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Correos Oficial \u003c= 1.3.0.0 - Unauthenticated Arbitrary File Download",
    "slug": "correos-oficial",
    "type": "plugin",
    "affected_version": "* - 1.3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0331",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ThemeMove Core \u003c= 1.4.2 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "thememove-core",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53303",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "School Management System – WPSchoolPress \u003c= 2.1.9 - SQL Injection",
    "slug": "wpschoolpress",
    "type": "plugin",
    "affected_version": "[*, 2.1.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24575",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SimpleSchema \u003c= 1.7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simpleschema-free",
    "type": "plugin",
    "affected_version": "* - 1.7.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53771",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Product Design \u003c= 1.0.0 - Unauthenticated Arbitrary File Download",
    "slug": "woo-product-design",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50508",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Vandana Lite \u003c= 1.1.9 - Cross Site Request Forgery to Notice Dismissal",
    "slug": "vandana-lite",
    "type": "theme",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37243",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 3.4.134 - Cross-Site Request Forgery leading to Plugin Backup Disclosure",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "[*, 3.4.135)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.135",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0833",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Sign-up Sheets \u003c= 2.3.0.1 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "sign-up-sheets",
    "type": "plugin",
    "affected_version": "* - 2.3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26996",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Featured Image from URL (FIFU) \u003c= 3.9.9 - Cross-Site Request Forgery",
    "slug": "featured-image-from-url",
    "type": "plugin",
    "affected_version": "* - 3.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2241",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension \u003c= 3.0.2 - Unauthenticated Arbitrary Options Update",
    "slug": "shortcode-addons",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-34487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34487",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Directory Kit \u003c= 1.2.6 - Missing Authorization",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41875",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Relevanssi – A Better Search \u003c= 3.5.7.1 - Stored Cross-Site Scripting",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "[*, 3.5.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-1000038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000038",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Atarim \u003c= 4.0.1 - Missing Authorization via remove_feedbacktool_notice()",
    "slug": "atarim-visual-collaboration",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43290",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "file-manager-advanced",
    "type": "plugin",
    "affected_version": "5.2.12 - 5.2.13",
    "from_version": "5.2.12",
    "from_inclusive": true,
    "to_version": "5.2.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13333",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LearnDash LMS \u003c= 4.5.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "sfwd-lms",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28777",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Masteriyo LMS PRO \u003c= 2.20.0 - Unauthenticated Privilege Escalation",
    "slug": "learning-management-system-pro",
    "type": "plugin",
    "affected_version": "* - 2.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-53209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53209",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Maspik – Spam blacklist \u003c= 0.9.2 - Unauthenticated Stored Cross-Site Scripting via efas_add_to_log",
    "slug": "contact-forms-anti-spam",
    "type": "plugin",
    "affected_version": "* - 0.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48272",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MihanPanel \u003c= 12.4 - Cross-Site Request Forgery",
    "slug": "mihanpanel-lite",
    "type": "plugin",
    "affected_version": "* - 12.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31389",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Odoo Form Integrator \u003c= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-odoo-form-integrator",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30620",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ad Inserter Pro \u003c= 2.7.39 - Reflected Cross-Site Scripting",
    "slug": "ad-inserter-pro",
    "type": "plugin",
    "affected_version": "* - 2.7.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22680",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajar in5 Embed \u003c= 3.1.3 - Unauthenticated Arbitrary File Upload",
    "slug": "ajar-productions-in5-embed",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50473",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Diza \u003c= 1.3.8 - Unauthenticated Local File Inclusion",
    "slug": "diza",
    "type": "theme",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49261",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.0.10 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.0.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2007-1599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi CryptoCurrency Payments \u003c= 2.0.3 - Unauthenticated SQL Injection",
    "slug": "multi-crypto-currency-payment",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48141",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Themify - WooCommerce Product Filter \u003c= 1.3.7 - Reflected Cross-Site Scripting",
    "slug": "themify-wc-product-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1532",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BadgeOS \u003c= 3.7.0 - Unauthenticated SQL Injection",
    "slug": "badgeos",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0817",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CultBooking Hotel Booking Engine \u003c= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cultbooking-booking-engine",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53753",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plethora Plugins Tabs + Accordions \u003c= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor",
    "slug": "plethora-tabs-accordions",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13721",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.8 (Pro) \u0026 \u003c= 2.2.7 (Free) - Missing Authorization via eventon_save_virtual_event_settings",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0237",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.8 (Pro) \u0026 \u003c= 2.2.7 (Free) - Missing Authorization via eventon_save_virtual_event_settings",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0237",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.19 - Unauthenticated Arbitrary File Upload",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "[*, 1.15.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.20",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-4666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4666",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Switcher \u003c= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "image-switcher",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23940",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPress Podcasting \u003c= 11.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 11.12.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.12.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32690",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pay with Contact Form 7 \u003c= 1.0.4 - Cross-Site Request Forgery",
    "slug": "pay-with-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24772",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress HTML \u003c= 0.51 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-html-bodyhead",
    "type": "plugin",
    "affected_version": "* - 0.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48315",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Backup Manager \u003c= 1.13.1 - Reflected Cross-Site Scripting",
    "slug": "wp-backup-manager",
    "type": "plugin",
    "affected_version": "* - 1.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35775",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print-O-Matic \u003c= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "print-o-matic",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33936",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Global Gallery \u003c= 8.8.0 - Reflected Cross-Site Scripting",
    "slug": "global-gallery",
    "type": "plugin",
    "affected_version": "* - 8.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22263",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster Elementor Addons \u003c= 1.4.9 - Missing Authorization",
    "slug": "booster-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38480",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9035",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.4",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9035",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.4",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9035",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.2",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9035",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9035",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0370",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wholesale Market \u003c= 2.2.0 - Information Disclosure via Unauthenticated Arbitrary File Download",
    "slug": "wholesale-market",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4298",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Multiple Plugins by eMarket Design \u003c= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "employee-spotlight",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58915",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by eMarket Design \u003c= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "youtube-showcase",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58915",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by eMarket Design \u003c= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "request-a-quote",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58915",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by eMarket Design \u003c= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-ticket",
    "type": "plugin",
    "affected_version": "* - 6.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58915",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CTT Expresso para WooCommerce \u003c= 3.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ctt-expresso-para-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47589",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Userpro \u003c= 5.1.9 - Authenticated (Contributor+) SQL Injection",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56212",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CAS Maestro \u003c= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cas-maestro",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30561",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Force SSL \u0026 HTTPS SSL Redirect \u003c= 1.66 - Missing Authorization to Settings Update",
    "slug": "wp-force-ssl",
    "type": "plugin",
    "affected_version": "* - 1.66",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.66",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5770",
    "auth_type": "Auth",
    "cvss_score": 4.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "YITH Essential Kit for WooCommerce #1 \u003c= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation",
    "slug": "yith-essential-kit-for-woocommerce-1",
    "type": "plugin",
    "affected_version": "* - 2.34.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.34.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6799",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Forms for ACF \u003c= 1.9.3.2 - Missing Authorization to Unauthenticated Form Settings Export",
    "slug": "advanced-forms",
    "type": "plugin",
    "affected_version": "* - 1.9.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1121",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Estatik Mortgage Calculator \u003c= 2.0.12 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "estatik-mortgage-calculator",
    "type": "plugin",
    "affected_version": "* - 2.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26907",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder \u003c= 8.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37512",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amazon Affiliate \u003c= 3.12.2 - Reflected File Download",
    "slug": "aawp",
    "type": "plugin",
    "affected_version": "* - 3.12.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4794",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CM Download Manager \u003c= 2.0.6 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "cm-download-manager",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9129",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamics 365 Integration \u003c= 1.3.13 - Missing Authorization via init",
    "slug": "integration-dynamics",
    "type": "plugin",
    "affected_version": "* - 1.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29422",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP OnlineSupport, Essential Plugin Popup Anything \u003c= 2.2.1 - Cross Site Request Forgery",
    "slug": "popup-anything-on-click",
    "type": "plugin",
    "affected_version": "[*, 2.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-38077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38077",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Extender All In One For Elementor \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "extender-all-in-one-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51575",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Activity Plus Reloaded for BuddyPress \u003c= 1.1.2 - Missing Authorization",
    "slug": "bp-activity-plus-reloaded",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30957",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rootspersona \u003c= 3.7.5 - Cross-Site Request Forgery",
    "slug": "rootspersona",
    "type": "plugin",
    "affected_version": "* - 3.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48344",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.15.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.15.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9808",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Login using WordPress Users ( WP as SAML IDP ) \u003c= 1.15.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "miniorange-wp-as-saml-idp",
    "type": "plugin",
    "affected_version": "* - 1.15.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9887",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Code Explorer \u003c= 1.4.5 - Authenticated (Admin+) External File Reading",
    "slug": "code-explorer",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Job Board \u003c 2.3.16 - Unauthenticated Privilege Escalation via process_register",
    "slug": "wp-job-board",
    "type": "plugin",
    "affected_version": "[*, 2.3.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.16",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2024-12213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12213",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Timetable and Event Schedule by MotoPress \u003c= 2.3.8 - Missing Authorization",
    "slug": "mp-timetable",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36840",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c= 2.2.1 - Arbitrary File Upload",
    "slug": "wpmu",
    "type": "core",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-3544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-3544",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 2.2.1 - Arbitrary File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-3544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-3544",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Coming Soon by Supsystic \u003c= 1.7.5 - Reflected Cross-Site Scripting",
    "slug": "coming-soon-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-46781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-46781",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yoo Slider – Image Slider \u0026 Video Slider \u003c= 2.0.0 - Cross-Site Request Forgery",
    "slug": "yoo-slider",
    "type": "plugin",
    "affected_version": "[*, 2.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-25608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25608",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "dbview \u003c= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dbview",
    "type": "plugin",
    "affected_version": "* - 0.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10182",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-PostRatings \u003c= 1.91 - IP Spoofing",
    "slug": "wp-postratings",
    "type": "plugin",
    "affected_version": "* - 1.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40332",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Order Delivery Date for WP e-Commerce Pro \u003c= 12.4.0 - Reflected Cross-Site Scripting",
    "slug": "order-delivery-date",
    "type": "plugin",
    "affected_version": "[*, 12.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-2929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2929",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unconfirmed \u003c 1.2.5 - Reflected Cross-Site Scripting",
    "slug": "unconfirmed",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-100018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-100018",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Agile Video Player Lite \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "agile-video-player",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49636",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF24 Article To PDF \u003c= 4.2.2 - Cross-Site Request Forgery",
    "slug": "pdf24-post-to-pdf",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1827",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LiteSpeed Cache \u003c= 4.4.3 - Reflected Cross-Site Scripting via qc_res",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "1.0.15 - 4.4.3",
    "from_version": "1.0.15",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24963",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "reCAPTCHA Jetpack \u003c= 0.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "recaptcha-jetpack",
    "type": "plugin",
    "affected_version": "* - 0.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3941",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accessibility Suite \u003c= 4.19 - Missing Authorization",
    "slug": "online-accessibility",
    "type": "plugin",
    "affected_version": "* - 4.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30636",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Keep Backup Daily \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "keep-backup-daily",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1820",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Register Plus \u003c= 3.5.11 - Sensitive Information Disclosure",
    "slug": "register-plus",
    "type": "plugin",
    "affected_version": "* - 3.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2010-4403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4403",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SKT Addons for Elementor \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Page Title",
    "slug": "skt-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FormFlow \u003c= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-form",
    "type": "plugin",
    "affected_version": "* - 2.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3113",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 5.2.5.0 - Form Submission Limit Bypass",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51544",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CloudFlare(R) Cache Purge \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "cloudflare-cache-purge",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22332",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4277",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Lightbox \u003c= 2.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via name",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49174",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventin \u003c= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4796",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP24 Domain Check \u003c= 1.10.14 - Reflected Cross-Site Scripting",
    "slug": "wp24-domain-check",
    "type": "plugin",
    "affected_version": "* - 1.10.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24602",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Latest Tweets Widget \u003c= 1.1.4 - Arbitrary Settings Update via Cross-Site Request Forgery",
    "slug": "latest-tweets-widget",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1624",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NEX Forms \u003c= 7.8.7 - Authentication Bypass for PDF Reports",
    "slug": "nex-forms",
    "type": "plugin",
    "affected_version": "* - 7.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-34675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34675",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Watu Quiz \u003c= 2.6.7 - Authenticated (Admin+) SQL Injection",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-10111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10111",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Site PIN \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "site-pin",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22576",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sassy Social Share \u003c= 3.3.3 - Reflected Cross-Site Scripting",
    "slug": "sassy-social-share",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4971",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "illi Link Party! \u003c= 1.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "link-party",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7229",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Pixel \u003c= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "social-pixel",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4005",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Septera \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "septera",
    "type": "theme",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45452",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailerLite – Signup forms (official) \u003c= 1.7.6 - Missing Authorization",
    "slug": "official-mailerlite-sign-up-forms",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2797",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP SVG Icons \u003c= 3.2.2 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "svg-vector-icon-plugin",
    "type": "plugin",
    "affected_version": "[*, 3.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-14216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14216",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Integration for Contact Form 7 HubSpot \u003c=1.3.1 - Cross-Site Request Forgery",
    "slug": "cf7-hubspot",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34756",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WebinarPress \u003c= 1.33.27 - Missing Authorization",
    "slug": "wp-webinarsystem",
    "type": "plugin",
    "affected_version": "* - 1.33.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31882",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \u003c= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site Scripting",
    "slug": "post-and-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.26.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4400",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Active Products Tables for WooCommerce. Professional products tables for WooCommerce store \u003c= 1.0.6.1 - Missing Authorization",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0797",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Registration \u0026 Membership – Custom Registration Form, Login Form, and User Profile \u003c= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3292",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better Messages \u003c= 1.9.10.68 - Server-Side Request Forgery",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "* - 1.9.10.68",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10.68",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41609",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Events Manager \u0026#8211; OpenStreetMaps \u003c= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stonehenge-em-osm",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58265",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "King Addons for Elementor \u003c= 24.12.58 - Missing Authorization",
    "slug": "king-addons",
    "type": "plugin",
    "affected_version": "* - 24.12.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.12.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 1.1.29 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "easy-notify-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.5.7 - Unprotected REST-API to Sensitive Information Disclosure",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34647",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "wpDataTables (Premium) \u003c= 1.5.3 - SQL Injection",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-9175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9175",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blog, Posts and Category Filter for Elementor \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter Widget",
    "slug": "blog-posts-and-category-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4667",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Catalog Feed by PixelYourSite \u003c= 2.1.0 - Reflected Cross-Site Scripting via 'page'",
    "slug": "product-catalog-feed",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1805",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Prayer II \u003c= 2.4.7 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-prayers-request",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4751",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sticky banner \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sticky-banner",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35170",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "10Web Social Photo Feed \u003c= 1.4.28 - Reflected Cross-Site Scripting",
    "slug": "wd-instagram-feed",
    "type": "plugin",
    "affected_version": "* - 1.4.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25047",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI \u003c= 26.1.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 26.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7725",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bitly \u003c= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-bitly",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58231",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Benchmark Email Lite \u003c= 4.1 - Cross-Site Request Forgery via page_settings()",
    "slug": "benchmark-email-lite",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31360",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Friends \u003c= 2.8.5 - Authenticated (Admin+) Blind Server-Side Request Forgery",
    "slug": "friends",
    "type": "plugin",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1978",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core 2.2.1 - Backdoor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "2.2.1",
    "from_version": "2.2.1",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2007-1277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1277",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Google Review Slider \u003c= 16.0 - Cross-Site Request Forgery to SQL Injection",
    "slug": "wp-google-places-review-slider",
    "type": "plugin",
    "affected_version": "* - 16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30783",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Martins Free \u0026 Easy SEO BackLink Link Building Network \u003c= 1.2.29 - Reflected Cross-Site Scripting via _wpnonce",
    "slug": "martins-link-network",
    "type": "plugin",
    "affected_version": "* - 1.2.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5641",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OwnID Passwordless Login \u003c= 1.3.4 - Authentication Bypass",
    "slug": "ownid-passwordless-login",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-10294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10294",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder \u003c= 8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25593",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "affiliate-toolkit – WordPress Affiliate Plugin \u003c= 3.4.3 - Reflected Cross-Site Scripting via keyword",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46086",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Doc Embedder \u003c 2.5.17 - SQL Injection",
    "slug": "google-document-embedder",
    "type": "plugin",
    "affected_version": "[*, 2.5.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.17",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-9173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9173",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "17TRACK for WooCommerce \u003c= 1.2.10 - Reflected Cross-Site Scripting",
    "slug": "17track",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27324",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Actionwear products sync \u003c= 2.3.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "actionwear-products-sync",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31619",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Mortgage Calculator / Loan Calculator \u003c 1.5.17 - Cross-Site Scripting",
    "slug": "mortgage-loan-calculator",
    "type": "plugin",
    "affected_version": "[*, 1.5.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24828",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Neom Blog \u003c= 0.0.9 - Reflected Cross-Site Scripting",
    "slug": "neom-blog",
    "type": "theme",
    "affected_version": "* - 0.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49274",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "pushBIZ – Push Notification \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "pushbiz",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13629",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel \u003c= 9.6.0 - Missing Authorization",
    "slug": "wp-travel",
    "type": "plugin",
    "affected_version": "* - 9.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53813",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Web Directory Free \u003c= 1.7.8 - Reflected Cross-Site Scripting",
    "slug": "web-directory-free",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39567",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mihdan: No External Links \u003c= 4.7.4 - Cross-Site Scripting",
    "slug": "mihdan-no-external-links",
    "type": "plugin",
    "affected_version": "* - 4.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1095",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GoUrl Bitcoin Payment Gateway \u0026amp; Paid Downloads \u0026amp; Membership \u003c= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gourl-bitcoin-payment-gateway-paid-downloads-membership",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48102",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vulnerability: SMTP for Amazon SES \u003c= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs",
    "slug": "smtp-amazon-ses",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0957",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export All URLs \u003c= 4.1 - Reflected Cross-Site Scripting",
    "slug": "export-all-urls",
    "type": "plugin",
    "affected_version": "[*, 4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0892",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newspack Campaigns \u003c= 2.31.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "newspack-popups",
    "type": "plugin",
    "affected_version": "* - 2.31.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.31.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37476",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CP Polls \u003c= 1.0.71 - Unauthenticated Content Injection",
    "slug": "cp-polls",
    "type": "plugin",
    "affected_version": "* - 1.0.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24874",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Product Gallery Slider \u003c= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "smart-product-gallery-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31392",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Custom Admin Bar \u003c= 1.0 - Reflected Cross-Site Scripting via msg Parameter",
    "slug": "easy-custom-admin-bar",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2479",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Alone – Charity Multipurpose Non-profit WordPress Theme \u003c= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation",
    "slug": "alone",
    "type": "theme",
    "affected_version": "* - 7.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5394",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cookie Notice \u0026 Compliance for GDPR / CCPA \u003c= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cookies_policy_link' Shortcodes",
    "slug": "cookie-notice",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24400",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Plugin by Squirrly SEO \u003c= 12.4.07 - Missing Authorization",
    "slug": "squirrly-seo",
    "type": "plugin",
    "affected_version": "* - 12.4.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.4.07",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24654",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ultimate Multi Design Video Carousel \u003c= 1.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "ultimate-multi-design-video-carousel",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9372",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ad Inserter \u003c= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe",
    "slug": "ad-inserter",
    "type": "plugin",
    "affected_version": "* - 2.7.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4668",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.6.35 - Authenticated (Subscriber+) SQL Injection",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.6.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.35",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47593",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4156",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles'",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "[*, 4.13.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.13.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-41954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41954",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "ElementsKit PRO \u003c= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "elementskit",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4404",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "jQuery Reply to Comment \u003c= 1.31 - Cross-Site Request Forgery",
    "slug": "jquery-reply-to-comment",
    "type": "plugin",
    "affected_version": "* - 1.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24543",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Download Monitor \u003c= 4.7.60 - Sensitive Information Exposure via REST API",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 4.7.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45354",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "The Erudite \u003c= 2.7.8 - Cross-Site Scripting",
    "slug": "the-erudite",
    "type": "theme",
    "affected_version": "* - 2.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3864",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Controlled Admin Access \u003c 1.5.6 - Privilege Escalation",
    "slug": "controlled-admin-access",
    "type": "plugin",
    "affected_version": "[*, 1.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4360",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Tooltip \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-tooltip",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46532",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CAOS | Host Google Analytics Locally \u003c= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings Update",
    "slug": "host-analyticsjs-local",
    "type": "plugin",
    "affected_version": "* - 4.7.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6637",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Homepage Popup \u003c= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "homepage-pop-up",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43480",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Weekly Schedule \u003c= 3.4.2 - Stored Cross-Site Scripting",
    "slug": "weekly-schedule",
    "type": "plugin",
    "affected_version": "[*, 3.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24309",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quotes llama \u003c= 0.7 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "quotes-llama",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1566",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Starbox \u003c= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings",
    "slug": "starbox",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6806",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Livemesh Addons for Elementor \u003c= 8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via animated_text_class",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25598",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XStore Core \u003c= 5.3.8 - Unauthenticated Privilege Escalation",
    "slug": "et-core-plugin",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33552",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "mTouch Quiz \u003c= 3.1.2 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "mtouch-quiz",
    "type": "plugin",
    "affected_version": "[*, 3.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9388",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Interactive SVG Image Map Builder \u003c= 1.0 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "interactive-image-map-builder",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25704",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Language Translate Widget for WordPress – ConveyThis \u003c= 266 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "conveythis-translate",
    "type": "plugin",
    "affected_version": "* - 266",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "266",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57919",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ForumWP \u003c= 2.1.0 - Unauthenticated PHP Object Injection",
    "slug": "forumwp",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54367",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Media Library Assistant \u003c= 3.27 - Authenticated (Author+) Limited File Deletion",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8357",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Team Showcase \u003c= 1.22.15 - Stored Cross-Site Scripting",
    "slug": "team",
    "type": "plugin",
    "affected_version": "[*, 1.22.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-35936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35936",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Brizy \u003c= 2.4.29 - Cross-Site Scripting",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51396",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Report Post \u003c= 2.1.2 - Cross-Site Request Forgery",
    "slug": "wp-report-post",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34171",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MagicForm \u003c= 0.1 - Cross-Site Scripting",
    "slug": "magicform",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47592",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress \u003c= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "* - 2.0.78",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.78",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8267",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bello - Directory \u0026 Listing \u003c= 1.5.9 - Unauthenticated SQL Injection",
    "slug": "bello",
    "type": "theme",
    "affected_version": "[*, 1.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24321",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "List Mixcloud \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "list-mixcloud",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28930",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Responsive Slideshow – Image slider, Gallery slideshow \u003c= 1.3.8 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "slider-responsive-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1859",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Super Store Finder \u003c= 6.9.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "superstorefinder-wp",
    "type": "plugin",
    "affected_version": "* - 6.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43975",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2926",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy WP SMTP \u003c= 1.4.2 - Sensitive Information Disclosure",
    "slug": "easy-wp-smtp",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35234",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEO Flow by LupsOnline \u003c= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "lupsonline-link-netwerk",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48146",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quotes Collection \u003c 2.0.6 - Cross-Site Scripting",
    "slug": "quotes-collection",
    "type": "plugin",
    "affected_version": "[*, 2.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10952",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donation Button \u003c= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "donation-button",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4005",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Box Office \u003c= 1.1.51 - Missing Authorization",
    "slug": "woocommerce-box-office",
    "type": "plugin",
    "affected_version": "* - 1.1.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Community Events \u003c= 1.5.1 - Unauthenticated SQL Injection",
    "slug": "community-events",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-10587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10587",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CT Commerce \u003c= 2.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings",
    "slug": "ct-commerce",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40007",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajax Custom CSS/JS \u003c= 2.0.4 - Reflected Cross-Site Scripting",
    "slug": "ajax-awesome-css",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49230",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LatePoint \u003c= 4.9.91 - Cross-Site Request Forgery",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 4.9.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43945",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VK All in One Expansion Unit \u003c= 9.95.0.1 - Information Exposure",
    "slug": "vk-all-in-one-expansion-unit",
    "type": "plugin",
    "affected_version": "* - 9.95.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.95.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2093",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "404 to 301 \u003c= 3.0.7 - Missing Authorization to Redirect Creation",
    "slug": "404-to-301",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4338",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Usermaven \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "usermaven",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31079",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Titan Anti-spam \u0026 Security \u003c= 7.3.7 - Missing Authorization",
    "slug": "anti-spam",
    "type": "plugin",
    "affected_version": "* - 7.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38777",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "5 Stars Rating Funnel \u003c= 1.4.01 - Authenticated (Contributor+) SQL Injection",
    "slug": "5-stars-rating-funnel",
    "type": "plugin",
    "affected_version": "* - 1.4.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51579",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Prisna GWT – Google Website Translator \u003c= 1.4.13 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "google-website-translator",
    "type": "plugin",
    "affected_version": "* - 1.4.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12679",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscription Popup \u003c= 1.2.23 - Authenticated (Administrator+) SQL Injection",
    "slug": "email-subscribe",
    "type": "plugin",
    "affected_version": "* - 1.2.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24587",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Lead Form Data Collection to CRM \u003c= 3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "wp-leads-builder-any-crm",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47690",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OAuth Single Sign On – SSO (OAuth Client) \u003c= 6.24.1- Cross-Site Request Forgery via 'discard' in mooauth_client_applist_page",
    "slug": "miniorange-login-with-eve-online-google-facebook",
    "type": "plugin",
    "affected_version": "* - 6.24.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.24.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1093",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tickera \u003c= 3.5.1.0 - Cross-Site Request Forgery to Ticket Post Status Change",
    "slug": "tickera-event-ticketing-system",
    "type": "plugin",
    "affected_version": "* - 3.5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23726",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easyship WooCommerce Shipping Rates \u003c= 0.8.9 - Missing Authorization via multiple AJAX actions",
    "slug": "easyship-woocommerce-shipping-rates",
    "type": "plugin",
    "affected_version": "* - 0.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37989",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Post Rating \u003c= 2.4.6 - Missing Authorization to Vote Manipulation",
    "slug": "wp-post-comment-rating",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25785",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Landing Page Cat – Coming Soon Page, Maintenance Page \u0026 Squeeze Pages \u003c= 1.7.2 - Unauthenticated Information Exposure",
    "slug": "landing-page-cat",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0708",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Interactive Regional Map of Florida \u003c= 1.0 - Missing Authorization",
    "slug": "interactive-map-of-florida",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49441",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Affiliate Plus \u003c= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "affiliate-plus",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7690",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ebook Downloader \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ebook-downloader",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31904",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vice Versa \u003c= 2.2.3 - Reflected Cross-Site Scripting",
    "slug": "vice-versa",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27350",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All Social Share Options \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "all-social-share-options",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10131",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMTP Mail \u003c= 1.3.46 - Unauthenticated Stored Cross-Site Scripting via Email Subject",
    "slug": "smtp-mail",
    "type": "plugin",
    "affected_version": "* - 1.3.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.46",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3092",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bee Layer Slider \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bee-layer-slider",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28879",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Z-Downloads \u003c= 1.11.4 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "z-downloads",
    "type": "plugin",
    "affected_version": "* - 1.11.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8699",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YaySMTP \u003c= 2.6.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "yaysmtp",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47587",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Table of Contents Plus \u003c= 2302 - Cross-Site Request Forgery",
    "slug": "table-of-contents-plus",
    "type": "plugin",
    "affected_version": "* - 2302",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2302",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44473",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Post Grid Layouts with Pagination – Sogrid \u003c= 1.5.6 - Authenticated (Admin+) Local File Inclusion",
    "slug": "sogrid",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8392",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HappyFiles Pro \u003c= 1.8.1 - Missing Authorization to Arbitrary File Deletion",
    "slug": "happyfiles-pro",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25446",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Cross-Site Request Forgery via 'wpfc_pause_cdn_integration_ajax_request_callback'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1922",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EmbedPress \u003c= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4283",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hover Effects \u003c= 5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "image-hover-effects",
    "type": "plugin",
    "affected_version": "* - 5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4010",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Submitted Posts \u003c= 20230902 - Unauthenticated Arbitrary File Upload",
    "slug": "user-submitted-posts",
    "type": "plugin",
    "affected_version": "* - 20230902",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20230902",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-45603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45603",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "mTouch Quiz \u003c 3.0.7 - Cross-Site Scripting",
    "slug": "mtouch-quiz",
    "type": "plugin",
    "affected_version": "[*, 3.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-100023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-100023",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms, User Registration and User Login Plugin \u003c= 4.6.0.1 - Cross-Site Scripting",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 4.6.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-8436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8436",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My YouTube Channel \u003c= 3.0.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "youtube-channel",
    "type": "plugin",
    "affected_version": "* - 3.0.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0446",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export and Import Users and Customers \u003c= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change",
    "slug": "users-customers-import-export-for-wp-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3459",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hermit 音乐播放器 \u003c= 3.1.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "hermit",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29410",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ZX_CSV Upload \u003c= 1 - Authenticated (Admin+) SQL Injection",
    "slug": "zx-csv-upload",
    "type": "plugin",
    "affected_version": "* - 1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10943",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup contact form \u003c= 7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "popup-contact-form",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44230",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rich Text Editor \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "richtexteditor",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31623",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.2.3 - Reflected Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-20734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Simple RSS \u003c 2.0.7 - Cross-Site Request Forgery",
    "slug": "custom-simple-rss",
    "type": "plugin",
    "affected_version": "[*, 2.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-14327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14327",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "LambertGroup - AllInOne - Banner with Playlist \u003c= 3.8 - Authenticated (Contributor+) SQL Injection",
    "slug": "all-in-one-bannerWithPlaylist",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60107",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP SVG Images \u003c= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "wp-svg-images",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5945",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Source Control \u003c 3.1.1 - Directory Traversal",
    "slug": "wp-source-control",
    "type": "plugin",
    "affected_version": "[*, 3.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-5368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5368",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Webo-facto \u003c= 1.40 - Unauthenticated Privilege Escalation",
    "slug": "webo-facto-connector",
    "type": "plugin",
    "affected_version": "* - 1.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.40",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8853",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "iframe to embed \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "iframe-to-embed",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22545",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dyn Business Panel \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "dyn-business-panel",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13055",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncomplicated SEO \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "uncomplicated-seo",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25158",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \u003c= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1170",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Randomize \u003c= 1.4.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "randomize",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-52204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52204",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEOPress – On-site SEO \u003c= 7.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Social Image URL",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1168",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackupBuddy \u003c= 8.8.2 - Reflected Cross-Site Scripting",
    "slug": "backupbuddy",
    "type": "plugin",
    "affected_version": "* - 8.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4897",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit \u003c= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation",
    "slug": "wp-marketing-automations",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1562",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \u003c= 2.9.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5207",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery \u003c= 1.5.3 - Missing Authorization",
    "slug": "new-video-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34377",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.8 - Insufficient Authorization",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "* - 4.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0855",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CPT Shortcode Generator \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "cpt-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45643",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fancy Product Designer \u003c= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actions",
    "slug": "fancy-product-designer",
    "type": "plugin",
    "affected_version": "* - 4.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4335",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Order Limit for WooCommerce \u003c= 3.0.2 - Missing Authorization",
    "slug": "wc-order-limit-lite",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26928",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Sharing Plugin – Social Warfare \u003c= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "social-warfare",
    "type": "plugin",
    "affected_version": "* - 4.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26973",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Portfolio, Photo Gallery \u0026 Post Grid \u003c= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via title_tag Parameter",
    "slug": "visual-portfolio",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4363",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Posti Shipping \u003c= 3.10.2 - Full Path Disclosure",
    "slug": "posti-shipping",
    "type": "plugin",
    "affected_version": "* - 3.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50512",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Data Tables Generator by Supsystic \u003c= 1.10.31 - Missing Authorization",
    "slug": "data-tables-generator-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.10.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32829",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pro Rank Tracker \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "proranktracker",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30583",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Classified Listings \u003c= 1.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update",
    "slug": "ultimate-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0763",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Stats-Dashboard \u003c= 2.9.4 - Authenticated SQL Injection",
    "slug": "wp-stats-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9399",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "immonex Kickstart Team \u003c= 1.6.9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "immonex-kickstart-team",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-57925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57925",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BP Profile Shortcodes Extra \u003c= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter",
    "slug": "bp-profile-shortcodes-extra",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11732",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Coming Soon \u0026 Maintenance Mode by Colorlib \u003c= 1.0.98 - Administrator+ Cross-Site Scripting",
    "slug": "colorlib-coming-soon-maintenance",
    "type": "plugin",
    "affected_version": "* - 1.0.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.98",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1945",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Us By Lord Linus \u003c= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "contact-us-by-lord-linus",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1382",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c=  4.7.9.1 - Missing Authorization to Unauthenticated Content Spoofing",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.7.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32259",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pretty Url \u003c= 1.5.4 - Reflected Cross-Site Scripting",
    "slug": "pretty-url",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22564",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donate visa \u003c= 1.0.0 - Missing Authorization",
    "slug": "donate-visa",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23656",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.19 - Reflected Cross-Site Scripting",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27345",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS \u003c= 0.0.21 - Reflected Cross-Site Scripting via page Parameter",
    "slug": "sikshya",
    "type": "plugin",
    "affected_version": "* - 0.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12127",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Table Lite \u003c= 3.5.1 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "wc-product-table-lite",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43128",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 9.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "* - 9.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39666",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wp image slideshow \u003c= 12.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "wp-image-slideshow",
    "type": "plugin",
    "affected_version": "* - 12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5438",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Soledad \u003c= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8105",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.16.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30766",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Google Map \u003c= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embed-google-map",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26539",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aitasi Coming Soon \u003c= 2.0.2 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "aitasi-coming-soon",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58815",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Strong Testimonials \u003c= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "strong-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26013",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uji Countdown \u003c= 2.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "uji-countdown",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3837",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin and Site Enhancements (ASE) \u003c= 5.7.1 - Password Protection Mode Security Feature Bypass",
    "slug": "admin-site-enhancements",
    "type": "plugin",
    "affected_version": "* - 5.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46630",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Slider, Gallery, and Carousel by MetaSlider \u003c= 3.29.0 - Reflected Cross-Site Scripting",
    "slug": "ml-slider",
    "type": "plugin",
    "affected_version": "* - 3.29.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.29.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1473",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple HTML Sitemap \u003c= 3.3 - Missing Authorization",
    "slug": "wp-simple-html-sitemap",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31822",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Any News Ticker \u003c= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "any-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10168",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEOPress – On-site SEO \u003c= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 7.5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2165",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aiomatic - AI Content Writer, Editor, ChatBot \u0026 AI Toolkit \u003c= 2.3.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "aiomatic-automatic-ai-content-writer",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13882",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "One Backend Language \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "one-backend-language",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce \u003c= 5.2.3 - Cross-Site Request Forgery",
    "slug": "enhanced-e-commerce-for-woocommerce-store",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46797",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Plainview Protect Passwords \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "plainview-protect-passwords",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47664",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iNET Webkit \u003c= 1.2.2 - Missing Authorization",
    "slug": "inet-webkit",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22629",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.12.0 - Reflected Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35679",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hash Elements \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hash-elements",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22296",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support Genix \u003c= 1.4.23 - Missing Authorization",
    "slug": "support-genix-lite",
    "type": "plugin",
    "affected_version": "* - 1.4.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58635",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-BusinessDirectory \u003c= 3.1.3 - Unauthenticated SQL Injection",
    "slug": "wp-businessdirectory",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24759",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BWL Advanced FAQ Manager \u003c= 2.0.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "bwl-advanced-faq-manager",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32136",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via 'caption'",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.5.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2695",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Builder for Contact Form 7 by Webconstruct \u003c= 1.2.2 - Cross-Site Request Forgery",
    "slug": "cf7-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28864",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Cal \u003c= 0.3 - SQL Injection",
    "slug": "wp-cal",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-0490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0490",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Profile Builder – User Profile \u0026 User Registration Forms \u003c= 2.2.4 - Reflected Cross-Site Scripting",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "[*, 2.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9328",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Delete All Comments \u003c= 2.0 - Arbitrary File Upload",
    "slug": "delete-all-comments",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-15033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-15033",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Download Codes \u003c= 2.5.4 - Reflected Cross-Site Scripting",
    "slug": "wp-download-codes",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23882",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Post to PDF Enhanced \u003c= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-post-to-pdf-enhanced",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39427",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.3 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-5710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-5710",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AJAX Random Post \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "ajax-random-post",
    "type": "plugin",
    "affected_version": "* - 2.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000127",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nelio AB Testing \u003c 4.5.9 - Server Side Request Forgery",
    "slug": "nelio-ab-testing",
    "type": "plugin",
    "affected_version": "* - 4.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10926",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Tidy.ro \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "tidyro",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23650",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RDP Linkedin Login \u003c= 1.7.0 - Reflected Cross-Site Scripting",
    "slug": "rdp-linkedin-login",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23542",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Competition Form \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "competition-form",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12749",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jupiter X Core \u003c= 4.6.5 - Unauthenticated Arbitrary File Upload",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 4.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-7772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7772",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EleForms – All In One Form Integration including DB for Elementor \u003c= 2.9.9.9 - Missing Authorization",
    "slug": "all-contact-form-integration-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6626",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0513",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Plezi \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "plezi",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11763",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Viewer for Elementor \u003c= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-viewer-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30524",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "League of Legends Shortcodes \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "league-of-legends-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10342",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SalesKing \u003c= 1.6.15 - Unauthenticated Sensitive Information Exposure",
    "slug": "salesking",
    "type": "plugin",
    "affected_version": "* - 1.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22154",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ultimate Social Comments – Email Notification \u0026 Lazy Load \u003c= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-facebook-comments",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30555",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SpiderCalendar \u003c= 1.4.9 - Unauthenticated SQL Injection",
    "slug": "spider-event-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.4.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.10",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-2196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2196",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Up down image slideshow gallery \u003c= 12.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "up-down-image-slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5435",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shopping Cart \u0026 eCommerce Store \u003c= 5.7.8 - Missing Authorization to Order Updates",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12712",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cforms \u003c= 10.1 - Cross-Site Scripting",
    "slug": "cforms",
    "type": "plugin",
    "affected_version": "* - 10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-10392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10392",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kids Planet \u003c= 2.2.14 - Unauthenticated PHP Object Injection",
    "slug": "kidsplanet",
    "type": "theme",
    "affected_version": "* - 2.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.14",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48289",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wp Login with Ajax \u003c= 0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-login-with-ajax",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54416",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "reCAPTCHA \u003c= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "login-form-recaptcha",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3831",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SmartIT Premium Responsive (Unspecified Version) - Information Disclosure",
    "slug": "smartit",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9492",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Premium Addons for Elementor PRO \u003c= 2.9.12 -  Authenticated(Contributor+) Stored Cross-Site Scripting via widget link",
    "slug": "premium-addons-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1996",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.1 - Admin+ Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24691",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Google Code Inserter \u003c 3.5 - Stored Cross-Site Scripting",
    "slug": "smart-google-code-inserter",
    "type": "plugin",
    "affected_version": "[*, 3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-3810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-3810",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin \u003c= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.87",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3022",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appointment Booking Calendar \u003c= 1.3.34 - CSV Injection",
    "slug": "appointment-booking-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.3.35)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.35",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-9372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9372",
    "auth_type": "Unauth",
    "cvss_score": 7.8,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Thrive Theme Builder \u003c 3.24.2 - Cross-Site Request Forgery",
    "slug": "thrive-theme",
    "type": "theme",
    "affected_version": "[*, 3.24.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.24.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-47781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47781",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FormCraft Basic \u003c= 1.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "formcraft-form-builder",
    "type": "plugin",
    "affected_version": "[*, 1.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1647",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PixelYourSite – Your smart PIXEL (TAG) Manager \u003c= 9.6.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pixelyoursite",
    "type": "plugin",
    "affected_version": "* - 9.6.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37447",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP phpMyAdmin \u003c= 5.2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-phpmyadmin-extension",
    "type": "plugin",
    "affected_version": "* - 5.2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2407",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Binary MLM Woocommerce \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "woo-binary-mlm",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12383",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonials \u003c= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "testimonials",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-33191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33191",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery \u003c= 1.5.67 - Reflected Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.68)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.68",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25041",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Accessibility Helper (WAH) \u003c= 0.6.2.9 - Missing Authorization",
    "slug": "wp-accessibility-helper",
    "type": "plugin",
    "affected_version": "* - 0.6.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37926",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShortPixel Adaptive Images \u003c= 3.10.0 - Missing Authorization",
    "slug": "shortpixel-adaptive-images",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30853",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Branda – White Label \u0026 Branding, Custom Login Page Customizer \u003c= 3.4.19 - Reflected Cross-Site Scripting",
    "slug": "branda-white-labeling",
    "type": "plugin",
    "affected_version": "* - 3.4.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9371",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "azurecurve BBCode \u003c= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Shortcode",
    "slug": "azurecurve-bbcode",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8398",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theater for WordPress \u003c= 0.18.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "theatre",
    "type": "plugin",
    "affected_version": "* - 0.18.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.18.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hipaatizer",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11332",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP No External Links \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scritping",
    "slug": "no-external-links",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26537",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Draft List \u003c= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-draft-list",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10181",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eStore \u003c= 8.5.4 - Reflected Cross-Site Scripting via Category Editing",
    "slug": "wp-cart-for-digital-products",
    "type": "plugin",
    "affected_version": "* - 8.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6076",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Digihood HTML Sitemap \u003c= 3.1.1 - Reflected Cross-Site Scripting via 'channel'",
    "slug": "wedesin-html-sitemap",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12339",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fable Extra \u003c= 1.0.6 - Unauthenticated SQL Injection",
    "slug": "fable-extra",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-46539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46539",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 5.3.4 - Missing Authorization via openai_file_delete_callback",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 5.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0453",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WP Database Optimizer \u003c= 1.2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-database-optimizer",
    "type": "plugin",
    "affected_version": "* - 1.2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31473",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Taskbuilder \u003c= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "taskbuilder",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3137",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Apollo13 Framework Extensions \u003c= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "apollo13-framework-extensions",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47190",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Travel Map \u003c= 1.0.3 - Cross-Site Request Forgery",
    "slug": "travelmap-blog",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57960",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Enable Media Replace \u003c= 4.1.5 - Reflected Cross-Site Scripting",
    "slug": "enable-media-replace",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31081",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Save as PDF Plugin by Pdfcrowd \u003c= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "save-as-pdf-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35649",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "(Simply) Guest Author Name \u003c= 4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "guest-author-name",
    "type": "plugin",
    "affected_version": "* - 4.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24764",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web – Mobile-Friendly Drag \u0026 Drop Contact Form Builder \u003c= 1.15.22 - Sensitive Information Exposure",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2112",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "HT Event – WordPress Event Manager Plugin for Elementor \u003c= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor",
    "slug": "ht-event",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13216",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Pixobe Cartography \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pixobe-cartography",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53767",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Page Builder Lite \u003c= 5.6.2 - Missing Authorization",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43932",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Spexo Addons for Elementor \u003c= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "sastra-essential-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8208",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP To Do \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-todo",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22292",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Forms for Mailchimp \u003c= 6.8.8 - Reflected Cross-Site Scripting via 'sql_error'",
    "slug": "yikes-inc-easy-mailchimp-extender",
    "type": "plugin",
    "affected_version": "* - 6.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23900",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Addons for Elementor \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "responsive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8215",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.13",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.10",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.2",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.18",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.11",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.6",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.3",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.27",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.27",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.30",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.28",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.24",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.20",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.15",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.14",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.30",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.19",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership Custom Messages \u003c= 2.4 - Reflected Cross-Site Scripting",
    "slug": "simple-membership-custom-messages",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24660",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Cloak Affiliate Links \u003c= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modification",
    "slug": "woocommerce-cloak-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 1.0.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.33",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1308",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "EasyJobs \u003c= 2.4.14 - Reflected Cross-Site Scripting",
    "slug": "easyjobs",
    "type": "plugin",
    "affected_version": "* - 2.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43997",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Private Content  \u003c= 8.11.5 - Reflected Cross-Site Scripting",
    "slug": "private-content",
    "type": "plugin",
    "affected_version": "* - 8.11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.11.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26972",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wise Chat \u003c= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header",
    "slug": "wise-chat",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3774",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Quick View \u003c= 1.1.1 - Unauthenticated Information Disclosure",
    "slug": "woo-quick-view",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24705",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Email Encoder Bundle \u003c= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "email-encoder-bundle",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47821",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple File List \u003c= 6.1.13 - Missing Authorization to Unauthenticated Minor Settings Update",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "* - 6.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47450",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.0.1 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2010-4257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4257",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VG PostCarousel \u003c= 1.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "vg-postcarousel",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27272",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Selection Lite \u003c= 1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "selection-lite",
    "type": "plugin",
    "affected_version": "* - 1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVP ME \u003c= 1.9.9 - Unauthenticated SQL Injection",
    "slug": "rsvp-me",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50491",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Message ticker \u003c= 9.2 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "message-ticker",
    "type": "plugin",
    "affected_version": "* - 9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5433",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Custom Fields Search \u003c= 1.2.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcfs-preset Shortcode",
    "slug": "wp-custom-fields-search",
    "type": "plugin",
    "affected_version": "* - 1.2.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8364",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bravo Search \u0026 Replace \u003c= 1.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "bravo-search-and-replace",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27297",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordLift – AI powered SEO – Schema \u003c= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "wordlift",
    "type": "plugin",
    "affected_version": "* - 3.54.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.54.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12176",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Category and Taxonomy Image \u003c= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-custom-taxonomy-image",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9591",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AskApache Firefox Adsense \u003c= 3.0 - Cross-Site Request Forgery",
    "slug": "askapache-firefox-adsense",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-6992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6992",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Google Code Inserter \u003c 3.5 - Unauthenticated SQL Injection",
    "slug": "smart-google-code-inserter",
    "type": "plugin",
    "affected_version": "[*, 3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-3811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-3811",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARI Stream Quiz \u003c= 1.3.0 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "ari-stream-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-52182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52182",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Statistics \u003c= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via IP",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 13.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-25305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25305",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Showcase Ultimate – Logo Carousel, Logo Slider \u0026 Logo Grid \u003c= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "logo-showcase-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8046",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 5.4.8 - Reflected Cross-Site Scripting in General Module",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "[*, 5.4.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25000",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traveler \u003c= 3.1.6 - Unauthenticated SQL Injection via order_id",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11912",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Mobile Pages \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "mobile-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32625",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.34",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.23",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.22",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.19",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.15",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.28",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.18",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.14",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.10",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.6",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.7",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.2",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.34",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.32",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.31",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.31",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.24",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.4",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Misconfiguration That Allows Trigger of New Installation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.1",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28037",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "JoomSport \u003c= 5.3.0 - Missing Authorization",
    "slug": "joomsport-sports-league-results-management",
    "type": "plugin",
    "affected_version": "* - 5.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43355",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ARMember Premium \u003c= 6.7 - Cross-Site Request Forgery via multiple functions",
    "slug": "armember",
    "type": "plugin",
    "affected_version": "* - 6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5596",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Responsive Blocks \u003c= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-block-editor-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49881",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Basil \u003c= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "basil",
    "type": "theme",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39310",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thank You Page Customizer for WooCommerce – Increase Your Sales \u003c= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "woo-thank-you-page-customizer",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1687",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Custom WooCommerce Checkout Fields Editor \u003c= 1.3.0 - Cross-Site Request Forgery",
    "slug": "add-fields-to-checkout-page-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30518",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.8.33 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0613",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "fluXtore \u003c= 1.6.0 - Missing Authorization",
    "slug": "fluxtore",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30929",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Tables – Easy Data Table Builder \u003c= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution",
    "slug": "ninja-tables",
    "type": "plugin",
    "affected_version": "* - 5.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2939",
    "auth_type": "Unauth",
    "cvss_score": 5.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Custom Banners \u003c= 3.2.2 - Cross-Site Request Forgery Bypass",
    "slug": "custom-banners",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4407",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Star CloudPRNT for WooCommerce \u003c= 2.0.3 - Unauthenticated Cross-Site Scripting",
    "slug": "star-cloudprnt-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47514",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ThemeShark Templates \u0026 Widgets for Elementor \u003c= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themeshark-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51597",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.5.34 - SQL Injection",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.35)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.35",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-16119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16119",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Tooltips \u003c= 8.2.5 - Multiple Cross-Site Request Forgery",
    "slug": "wordpress-tooltips",
    "type": "plugin",
    "affected_version": "* - 8.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25985",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Admin Bar \u0026 Dashboard Control \u003c= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "admin-bar-dashboard-control",
    "type": "plugin",
    "affected_version": "[*, 1.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-47184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47184",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.56 - Missing Authorization",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.56",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56225",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wp Ultimate Review \u003c= 2.2.5 - Unauthenticated Review Restriction Bypass",
    "slug": "wp-ultimate-review",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32685",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wp-Adv-Quiz \u003c= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Quiz Question and Message",
    "slug": "advanced-quiz",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5943",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visitors Traffic Real Time Statistics \u003c= 7.2 - Missing Authorization via multiple AJAX actions",
    "slug": "visitors-traffic-real-time-statistics",
    "type": "plugin",
    "affected_version": "* - 7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47557",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Request a Quote \u003c= 2.3.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "request-a-quote",
    "type": "plugin",
    "affected_version": "[*, 2.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24420",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mailster \u003c= 1.8.16.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24567",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Broadly for WordPress \u003c= 3.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "broadly",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30938",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wptobe-signinup \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "wptobe-signinup",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30611",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Trackserver \u003c= 5.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "trackserver",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30961",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Analytify – Google Analytics Dashboard For WordPress \u003c= 4.2.2 - Cross-Site Request Forgery",
    "slug": "wp-analytify",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38137",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import and export users and customers \u003c= 1.14.2.1 - Directory Traversal",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.14.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15326",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "MediCenter - Health Medical Clinic WordPress Theme \u003c= 14.6 - Missing Authorization",
    "slug": "medicenter",
    "type": "theme",
    "affected_version": "* - 14.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27013",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Woody code snippets \u003c= 2.3.9 - Cross-Site Request Forgery Bypass",
    "slug": "insert-php",
    "type": "plugin",
    "affected_version": "[*, 2.3.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36759",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "URL Shortener by MyThemeShop \u003c= 1.0.17 - Reflected Cross-Site Scripting via 'page'",
    "slug": "mts-url-shortener",
    "type": "plugin",
    "affected_version": "* - 1.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30472",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "shMapper by Teplitsa \u003c= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shmapper-by-teplitsa",
    "type": "plugin",
    "affected_version": "* - 1.4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12518",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.0.4 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-5106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-5106",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feedpress Generator \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "feedpress-generator",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54364",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TBTestimonials \u003c= 1.7.3 - Reflected Cross-Site Scripting",
    "slug": "tb-testimonials",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26584",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy PopUp Show \u003c= 0.12 - Cross-Site Request Forgery",
    "slug": "easy-popup-show",
    "type": "plugin",
    "affected_version": "* - 0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29009",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Page Transition \u003c= 1.4.1 - Stored Cross Site Scripting",
    "slug": "simple-page-transition",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2341",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-in-One Addons for Elementor – WidgetKit \u003c= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "widgetkit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34548",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FormCraft Basic 1.0.5 - SQL Injection via id Parameter",
    "slug": "formcraft-form-builder",
    "type": "plugin",
    "affected_version": "1.0.5",
    "from_version": "1.0.5",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-13137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-13137",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Status Notifier Lite \u003c= 1.10.0 - Reflected Cross-Site Scripting",
    "slug": "post-status-notifier-lite",
    "type": "plugin",
    "affected_version": "* - 1.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4325",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Events Calendar Registration \u0026 Tickets \u003c= 2.6.0 - Reflected Cross-Site Scripting",
    "slug": "wpeventplus",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39372",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP GPX Maps \u003c= 1.7.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcode",
    "slug": "wp-gpx-maps",
    "type": "plugin",
    "affected_version": "* - 1.7.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9028",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Gallery – YouTube Gallery \u003c= 2.1.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "gallery-videos",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-45069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45069",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Data Dash \u003c= 1.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "data-dash",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22340",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Duplicator \u003c 0.5.10 - Arbitrary Backup Creation and Download",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "[*, 0.5.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9262",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "Pdf Embedder Fay \u003c= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-embedder-fay",
    "type": "plugin",
    "affected_version": "* - 1.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51795",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-jScrollPane \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "wp-jscrollpane",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49062",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Members Membership Plugin \u003c= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.4.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2920",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Open Close WooCommerce Store \u003c= 4.9.1 - Missing Authorization",
    "slug": "woc-open-close",
    "type": "plugin",
    "affected_version": "* - 4.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32522",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TerraClassifieds \u003c= 2.0.3 Unauthenticated Arbitrary File Upload",
    "slug": "terraclassifieds",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51473",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.4.6 - Reflected Cross-Site Scripting",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47638",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Folders Pro \u003c= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name",
    "slug": "folders",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3868",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Backup Migration 1.0.8 - 1.3.9 - Remote File Inclusion via content-dir",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "1.0.8 - 1.3.9",
    "from_version": "1.0.8",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6971",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Enable Shortcodes inside Widgets,Comments and Experts \u003c= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "enable-shortcodes-inside-widgetscomments-and-experts",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9846",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Community by PeepSo \u003c= 6.0.2.0 - Cross Site Request Forgery",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.0.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41633",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "LambertGroup - AllInOne - Banner with Thumbnails \u003c= 3.8 - Authenticated (Contributor+) SQL Injection",
    "slug": "all-in-one-thumbnailsBanner",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60108",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5 - Cross-Site Request Forgery  via wp_ajax_wp_compression_test",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-6635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-6635",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "External Links in New Window / New Tab \u003c= 1.42 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "open-external-links-in-a-new-window",
    "type": "plugin",
    "affected_version": "* - 1.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1582",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP GoToWebinar \u003c= 15.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-gotowebinar",
    "type": "plugin",
    "affected_version": "* - 15.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38776",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Easy Checkout Field Editor, Fees \u0026 Discounts \u003c= 3.5.12 - Unauthenticated Arbitrary File Upload",
    "slug": "phppoet-checkout-fields",
    "type": "plugin",
    "affected_version": "* - 3.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-25925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25925",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Extra Privacy for Elementor \u003c= 0.1.3 - Reflected Cross-Site Scripting",
    "slug": "extra-privacy-for-elementor",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flo Forms \u003c= 1.0.41 - Missing Authorization via flo_send_test_email",
    "slug": "flo-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47692",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) \u003c= 2.3 - Cross-Site Request Forgery to Settings Update",
    "slug": "ai-scribe-the-chatgpt-powered-seo-content-creation-wizard",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12605",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ni WooCommerce Cost Of Goods \u003c= 3.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "ni-woocommerce-cost-of-goods",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32207",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.5.1.8 - Reflected Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-1002004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1002004",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Passwords Manager \u003c= 1.4.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "passwords-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12615",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1461",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Posti Shipping \u003c= 3.10.3 - Reflected Cross-Site Scripting",
    "slug": "posti-shipping",
    "type": "plugin",
    "affected_version": "* - 3.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10832",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBookit \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload",
    "slug": "wpbookit",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6058",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Cart Count Shortcode \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woo-cart-count-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10563",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Primary Addon for Elementor \u003c= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "primary-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49259",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9878",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Favicon \u003c= 0.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "site-favicon",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35642",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfect Brands for WooCommerce \u003c= 3.6.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "perfect-woocommerce-brands",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58686",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Big File Uploads \u003c= 2.1.2 - Authenticated (Author+) Full Path Disclosure",
    "slug": "tuxedo-big-file-uploads",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8538",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 21.1.2 - Reflected Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 21.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28784",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shared Files \u003c= 1.7.16 - Missing Authorization to Notice Dismissal",
    "slug": "shared-files",
    "type": "plugin",
    "affected_version": "* - 1.7.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32679",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Magical Addons For Elementor \u003c= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes",
    "slug": "magical-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8196",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Market Exporter \u003c= 2.0.21 - Missing Authorization",
    "slug": "market-exporter",
    "type": "plugin",
    "affected_version": "* - 2.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26995",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Arconix Shortcodes \u003c= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "arconix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56242",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nooz \u003c= 1.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "nooz",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25794",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GS Products Slider for WooCommerce \u003c= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gs-woocommerce-products-slider",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0492",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Post Creative \u003c= 1.2.7 - Cross-Site Request Forgery via wpfp_update_featured_post",
    "slug": "featured-post-creative",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30488",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Email Reminders \u003c= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "email-reminders",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11945",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Homey \u003c= 2.4.3 - Cross-Site Request Forgery to User Verification",
    "slug": "homey",
    "type": "theme",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0748",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Polylang \u003c= 1.5.1 - Cross-Site Scripting",
    "slug": "polylang",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-4855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4855",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "divi-builder",
    "type": "plugin",
    "affected_version": "* - 4.27.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.27.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "Divi",
    "type": "theme",
    "affected_version": "* - 4.27.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.27.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "oceanwp",
    "type": "theme",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.12.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "extra",
    "type": "theme",
    "affected_version": "* - 4.27.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.27.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "supreme-modules-for-divi",
    "type": "plugin",
    "affected_version": "* - 2.5.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "blossomthemes-instagram-feed",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "carousel-slider",
    "type": "plugin",
    "affected_version": "* - 2.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "addons-for-divi",
    "type": "plugin",
    "affected_version": "* - 4.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "gutentor",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Netgsm \u003c= 2.9.32 - Missing Authorization",
    "slug": "netgsm",
    "type": "plugin",
    "affected_version": "* - 2.9.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35672",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IdeaPush \u003c= 8.69 - Cross-Site Request Forgery",
    "slug": "ideapush",
    "type": "plugin",
    "affected_version": "* - 8.69",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.69",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49275",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Seraphinite Accelerator (Base, cache only) \u003c= 2.20.31 - Cross-Site Request Forgery",
    "slug": "seraphinite-accelerator",
    "type": "plugin",
    "affected_version": "* - 2.20.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5611",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "S3Player – WooCommerce \u0026 Elementor Integration \u003c= 4.2.1 - Reflected Cross-Site Scripting",
    "slug": "drm-protected-video-streaming",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13865",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wholesale Suite \u003c= 2.1.5 - Missing Authorization to Plugin Settings Change",
    "slug": "woocommerce-wholesale-prices",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-34344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34344",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "File Manager Pro – Filester \u003c= 1.8.8 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "filester",
    "type": "plugin",
    "affected_version": "* - 1.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3234",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WishList Member X \u003c= 3.25.1 - Unauthenticated Denial of Service",
    "slug": "wishlist-member-x",
    "type": "plugin",
    "affected_version": "* - 3.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37111",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "LH OGP Meta \u003c= 1.73 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "lh-ogp-meta-tags",
    "type": "plugin",
    "affected_version": "* - 1.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30587",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FontMeister \u003c= 1.08 - Reflected Cross-Site Scripting",
    "slug": "fontmeister",
    "type": "plugin",
    "affected_version": "* - 1.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-33978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33978",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Tabs \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-expand-tabs-free",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52124",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3715",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Google Maps \u003c= 1.11.7 - Cross-Site Request Forgery",
    "slug": "google-maps-easy",
    "type": "plugin",
    "affected_version": "* - 1.11.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33926",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Backup \u0026 Migration \u003c= 1.4.1 - Missing Authorization to Settings and Schedule Modification",
    "slug": "wp-migration-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45636",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Timeline Event History \u003c= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "timeline-event-history",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31595",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez Property Feed \u003c= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion",
    "slug": "houzez-property-feed",
    "type": "plugin",
    "affected_version": "* - 2.4.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0808",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Kit \u003c= 1.0.116 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "royal-elementor-kit",
    "type": "theme",
    "affected_version": "* - 1.0.116",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.116",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32773",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PPO Call To Actions \u003c= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ppo-call-to-actions",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24001",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FW Food Menu  \u003c= 6.0.0 - Unauthenticated Arbitrary File Upload",
    "slug": "fw-food-menu",
    "type": "plugin",
    "affected_version": "* - 6.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49447",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Catalog Simple \u003c= 1.6.17 - Reflected Cross-Site Scripting",
    "slug": "post-type-x",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-29388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29388",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Contest \u003c= 1.0.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-contest",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51837",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Print-O-Matic \u003c= 2.0.2 - Admin+ Stored Cross-Site Scripting",
    "slug": "print-o-matic",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24710",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Payments – Get Paid with PayPal, Square \u0026 Stripe \u003c= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "paypal-payment-button-by-vcita",
    "type": "plugin",
    "affected_version": "* - 3.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22661",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "xPinner Lite \u003c= 2.2 - Cross-Site Request Forgery",
    "slug": "xpinner-lite",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9408",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Seers | GDPR \u0026 CCPA Cookie Consent \u0026 Compliance \u003c= 8.1.0 - Cross-Site Request Forgery",
    "slug": "seers-cookie-consent-banner-privacy-policy",
    "type": "plugin",
    "affected_version": "* - 8.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32789",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMM API \u003c= 6.0.30 - Missing Authorization",
    "slug": "smm-api",
    "type": "plugin",
    "affected_version": "* - 6.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52785",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Logo Slider \u003c= 4.1.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "logo-slider-wp",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10473",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DirectoryPress \u003c= 3.6.22 - Cross-Site Request Forgery",
    "slug": "directorypress",
    "type": "plugin",
    "affected_version": "* - 3.6.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32249",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPForms Pro 1.8.4 - 1.8.5.3 - Unauthenticated Stored Cross-Site Scripting via Form Submission",
    "slug": "wpforms",
    "type": "plugin",
    "affected_version": "1.8.4 - 1.8.5.3",
    "from_version": "1.8.4",
    "from_inclusive": true,
    "to_version": "1.8.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7063",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PGS Core \u003c= 5.8.0 - Unauthenticated SQL Injection",
    "slug": "pgs-core",
    "type": "plugin",
    "affected_version": "* - 5.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0853",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Qwizcards \u003c= 3.94 - Reflected Cross-Site Scripting",
    "slug": "qwiz-online-quizzes-and-flashcards",
    "type": "plugin",
    "affected_version": "* - 3.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.94",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6174",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Duplicate Post, Page and Any Custom Post \u003c= 3.5.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication",
    "slug": "duplicate-pp",
    "type": "plugin",
    "affected_version": "* - 3.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12538",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "EmbedSocial – Social Media Feeds, Reviews and Galleries \u003c= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embedalbum-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3984",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mingle Forum \u003c= 1.0.34 - Cross-Site Request Forgery",
    "slug": "mingle-forum",
    "type": "plugin",
    "affected_version": "* - 1.0.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-0736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-0736",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pixel Cat – Conversion Pixel Manager \u003c= 2.6.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "facebook-conversion-pixel",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24922",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mark New Posts \u003c= 7.5.1 - Missing Authorization via save_options",
    "slug": "mark-new-posts",
    "type": "plugin",
    "affected_version": "* - 7.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54311",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.25.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.25.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54444",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fileviewer \u003c= 2.2 - Cross-Site Request Forgery",
    "slug": "fileviewer",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24491",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CBX Petition for WordPress \u003c= 1.0.3 - Unauthenticated SQL Injection",
    "slug": "cbxpetition",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4383",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2296",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Currency Converter Calculator \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "currency-converter-calculator",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SULly \u003c= 4.3.0 - Cross-Site Request Forgery to Plugin Reset",
    "slug": "sully",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5034",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Members \u003c= 3.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50051",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Button Plugin MaxButtons \u003c= 9.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "* - 9.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6594",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks \u003c= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2509",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CalculatorPro Calculators \u003c= 1.1.7 - Reflected Cross-Site Scripting via CP_preview_calc",
    "slug": "calculatorpro-calculators",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24847",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Front User Submit / Front Editor \u003c= 4.9.3 - Reflected Cross-Site Scripting",
    "slug": "front-editor",
    "type": "plugin",
    "affected_version": "* - 4.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28988",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kanban Boards for WordPress \u003c= 2.5.21 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "kanban",
    "type": "plugin",
    "affected_version": "* - 2.5.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23884",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 3.63 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 3.63",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.63",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-10196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10196",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Translate WordPress - Google Language Translator \u003c= 6.0.11 - Admin+ Stored Cross-Site Scripting",
    "slug": "google-language-translator",
    "type": "plugin",
    "affected_version": "[*, 6.0.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24594",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP AdCenter \u003c= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpadcenter",
    "type": "plugin",
    "affected_version": "* - 2.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31860",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blockbooster \u003c= 1.0.10 - Missing Authorization",
    "slug": "blockbooster",
    "type": "theme",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43979",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Integration for Contact Form 7 and Constant Contact \u003c= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cf7-constant-contact",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54684",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Calais Auto Tagger \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "calais-auto-tagger",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32563",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "idbbee \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "idbbee",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5114",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPCHURCH \u003c= 2.7.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "church-management",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31643",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IDonate – blood request management system \u003c= 1.9.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "idonate",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3594",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Partnerský systém Martinus \u003c= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "martinus-partnersky-system",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7661",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial \u003c= 2.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "indianic-testimonial",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7826",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Hello Agency \u003c= 1.0.5 - Missing Authorization to Notice Dismissal",
    "slug": "hello-agency",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43341",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Event Manager \u003c= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name'",
    "slug": "wp-event-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.50",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2800",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.3.02 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10706",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Card \u003c= 1.0.0 - Cross-Site Request Forgery to Category Edit",
    "slug": "business-card-by-esterox-100",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4530",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Kubio AI Page Builder \u003c= 2.3.5 - Reflected Cross-Site Scripting",
    "slug": "kubio",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13516",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Poll \u003c= 34.05 - SQL Injection",
    "slug": "cardoza-wordpress-poll",
    "type": "plugin",
    "affected_version": "* - 34.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "34.05",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-1401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1401",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smoothness Slider Shortcode \u003c= v1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "smoothness-slider-shortcode",
    "type": "plugin",
    "affected_version": "* - v1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "v1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22555",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCode \u003c= 2.0.6 - Missing Authorization to Sensitive Key Disclosure/Update",
    "slug": "insert-headers-and-footers",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0328",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "RD Contacto \u003c= 1.4 - Cross-Site Request Forgery to Settings Update",
    "slug": "rd-wapp",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5933",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Projectopia \u003c= 5.1.17 - Missing Authorization",
    "slug": "projectopia-core",
    "type": "plugin",
    "affected_version": "* - 5.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48257",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Skrill Official \u003c= 1.0.66 - Cross-Site Request Forgery",
    "slug": "official-skrill-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.66",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.66",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28876",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JetSearch \u003c= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-search",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7136",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Missing Authorization on ajax_move_object",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0712",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.1.0 - Directory Traversal",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0380",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Coupon Affiliates \u003c= 6.8.0 - Missing Authorization",
    "slug": "woo-coupon-usage",
    "type": "plugin",
    "affected_version": "* - 6.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59567",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPCargo Track \u0026 Trace \u003c= 6.9.4 - Reflected Cross-Site Scripting",
    "slug": "wpcargo",
    "type": "plugin",
    "affected_version": "* - 6.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1436",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobmonster \u003c= 4.8.0 - Unauthenticated Sensitive Information Disclosure",
    "slug": "noo-jobmonster",
    "type": "theme",
    "affected_version": "* - 4.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57888",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SKT Blocks \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-blocks",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46235",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "uCAT – Next Story \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "ucat-next-story",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49663",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Current Book \u003c= 1.0.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "current-book",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24538",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stripe Payment Plugin for WooCommerce \u003c= 3.7.9 - Unauthenticated SQL Injection",
    "slug": "payment-gateway-stripe-and-woocommerce-integration",
    "type": "plugin",
    "affected_version": "* - 3.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-0705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0705",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IndieBlocks \u003c= 0.13.1 - Unauthenticated Server-Side Request Forgery",
    "slug": "indieblocks",
    "type": "plugin",
    "affected_version": "* - 0.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.13.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31009",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Consensu.io \u003c= 1.0.3 - Missing Authorization via update_config_db()",
    "slug": "consensu-io",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48280",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "File Manager Pro – Filester \u003c= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "filester",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8066",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Iframe \u003c= 1.1.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via block attributes",
    "slug": "simple-iframe",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2964",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Merger \u003c= 1.5.2 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-user-merger",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3849",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ChatBot 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4254",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetSmartFilters \u003c= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-smart-filters",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30963",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ContentLock \u003c= 1.0.3 - Cross-Site Request Forgery to Email Adding",
    "slug": "contentlock",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6023",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Poll Maker – Best WordPress Poll Plugin \u003c= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3600",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GutenKit \u003c= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutenkit-blocks-addon",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46253",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Usage \u003c= 0.0.4 - Reflected Cross-Site Scripting",
    "slug": "media-usage",
    "type": "plugin",
    "affected_version": "* - 0.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34652",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schema \u0026 Structured Data for WP \u0026 AMP \u003c= 1.26 - Missing Authorization to reCaptcha Key Modification",
    "slug": "schema-and-structured-data-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1288",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "123.chat \u003c= 1.3.0 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "123-chat-videochat",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4298",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Asgaros Forum \u003c= 1.15.14 - Admin+ SQL Injection via forum_id",
    "slug": "asgaros-forum",
    "type": "plugin",
    "affected_version": "* - 1.15.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25045",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Modal Popup with Cookie Integration \u003c= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-modal-popup-with-cookie-integration",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54683",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Helpful \u003c= 4.4.58 - Admin+ Stored Cross-Site Scripting",
    "slug": "helpful",
    "type": "plugin",
    "affected_version": "[*, 4.4.59)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.59",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24841",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Slider by NextCode \u003c= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "baslider",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29438",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Photo Gallery \u003c= 1.0 - Remote Code Execution",
    "slug": "social-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-14467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14467",
    "auth_type": "Auth",
    "cvss_score": 7.8,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Content Copy Protection \u0026 No Right Click \u003c= 3.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-content-copy-protector",
    "type": "plugin",
    "affected_version": "* - 3.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36678",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rootspersona \u003c= 3.7.5 - Missing Authorization",
    "slug": "rootspersona",
    "type": "plugin",
    "affected_version": "* - 3.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39368",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stop Comment Spam \u003c= 0.5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "stop-comment-spam",
    "type": "plugin",
    "affected_version": "* - 0.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23826",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UberSlider \u003c= 2.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "uber-classic",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31641",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CoDesigner \u003c= 4.26 - Missing Authorization",
    "slug": "woolementor",
    "type": "plugin",
    "affected_version": "* - 4.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57961",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.20.2 - Authenticated Arbitrary File Creation",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.20.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-28700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-28700",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N"
  },
  {
    "title": "Uncanny Automator Pro \u003c 5.3.0.1 - Missing Authorization to Unauthenticated License Setting Reset",
    "slug": "uncanny-automator-pro",
    "type": "plugin",
    "affected_version": "[*, 5.3.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-37119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37119",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page Builder by AZEXO \u003c= 1.27.133 - Cross-Site Request Forgery to Post Creation/Modification/Deletion",
    "slug": "page-builder-by-azexo",
    "type": "plugin",
    "affected_version": "* - 1.27.133",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.133",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3052",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Add \u0026amp; Replace Affiliate Links for Amazon \u003c= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "add-replace-affiliate-links-for-amazon",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53285",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HDW WordPress Video Gallery \u003c= 1.2 - Reflected Cross-Site Scripting via playlist parameter",
    "slug": "hdw-tube",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000134",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Package \u003c= 1.5.28 - Unauthenticated Sensitive Data Disclosure",
    "slug": "booking-package",
    "type": "plugin",
    "affected_version": "[*, 1.5.29)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.29",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0709",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP MultiTasking \u003c= 0.1.12 - Cross-Site Request Forgery to  Exit Popup Update",
    "slug": "wp-multitasking",
    "type": "plugin",
    "affected_version": "* - 0.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6855",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.5.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.8.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6028",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Directory Kit \u003c= 1.3.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3217",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HORIZONTAL SLIDER \u003c= 2.4 - Cross-Site Request Forgery",
    "slug": "horizontal-slider",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58676",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Staff List \u003c= 2.2.4 - Missing Authorization via ajax_flush_rewrite_rules and staff_member_export",
    "slug": "simple-staff-list",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51526",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Yada Wiki \u003c= 3.4 - Stored Cross-Site Scripting",
    "slug": "yada-wiki",
    "type": "plugin",
    "affected_version": "[*, 3.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24470",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JB Horizontal Scroller News Ticker \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jb-horizontal-scroller-news-ticker",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23830",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.0.2 - Missing Authorization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2010-5296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-5296",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Timetable and Event Schedule by MotoPress \u003c= 2.4.1 - Unauthorised Event TimeSlot Update",
    "slug": "mp-timetable",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24584",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.8.21 - Authenticated(level_5+) SQL Injection via get_logs",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 2.8.22)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.22",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-43493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-43493",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Less Compiler \u003c= 1.3.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-less-compiler",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-25142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25142",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Age Gate \u003c= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'",
    "slug": "age-gate",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2505",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bulk Edit and Create User Profiles – WP Sheet Editor \u003c= 1.5.13 - Cross-Site Scripting",
    "slug": "bulk-edit-user-profiles-in-spreadsheet",
    "type": "plugin",
    "affected_version": "[*, 1.5.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1089",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "B2i Investor Tools \u003c= 1.0.7.9 - Reflected Cross-Site Scripting",
    "slug": "b2i-investor-tools",
    "type": "plugin",
    "affected_version": "* - 1.0.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47458",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Popup Builder \u003c= 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "wp-popup-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2404",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Table \u003c= 1.5.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "pricing-table",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36896",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xpro Elementor Addons - Pro \u003c= 1.4.9 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "xpro-elementor-addons-pro",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13808",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CSV Importer \u003c= 0.3.8 - Cross-Site Request Forgery",
    "slug": "csv-importer",
    "type": "plugin",
    "affected_version": "* - 0.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49775",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooODT Lite – Delivery \u0026 pickup date time location for WooCommerce \u003c= 2.5.1 - Unauthenticated Full Path Dsiclosure",
    "slug": "byconsole-woo-order-delivery-time",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13540",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "F4 Improvements \u003c= 1.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "f4-improvements",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9442",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Form Builder \u003c= 3.8.15 - Unauthenticated SQL Injection",
    "slug": "easy-form-builder",
    "type": "plugin",
    "affected_version": "* - 3.8.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54678",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "aThemes Addons for Elementor \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "athemes-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51675",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Maintenance Mode \u0026 Site Under Construction \u003c 1.8.2 - Missing Authorization to Arbitrary Plugin Installation/Activation",
    "slug": "wp-maintenance-mode-site-under-construction",
    "type": "plugin",
    "affected_version": "[*, 1.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24191",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Classic \u003c= 1.5 - Cross-Site Scripting",
    "slug": "classic",
    "type": "theme",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4483",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Custom Admin \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "simple-custom-admin",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49647",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Lister for eBay \u003c= 2.0.9 - Unauthenticated Local File Inclusion",
    "slug": "product-lister-ebay",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39384",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YITH WooCommerce Gift Cards \u003c= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update",
    "slug": "yith-woocommerce-gift-cards",
    "type": "plugin",
    "affected_version": "* - 4.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0870",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPML Multilingual CMS \u003c= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "* - 4.6.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6386",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Social Login \u003c= 2.1.5 - Cross-Site Scripting",
    "slug": "wordpress-social-login",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4576",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Charitable \u003c= 1.7.0.10 - Reflected Cross-Site Scripting",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "* - 1.7.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47441",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Community by PeepSo \u003c= 6.0.9.0 - Missing Authorization to Sensitive Information Exposure",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.0.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27630",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JS Help Desk \u003c= 2.7.1 - Unauthenticated Arbitrary File Upload",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-46839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46839",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Forminator \u003c= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.29.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1794",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TinySalt \u003c 3.10.0 - Unauthenticated PHP Object Injection",
    "slug": "tinysalt",
    "type": "theme",
    "affected_version": "[*, 3.10.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-49455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49455",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Proof (Testimonials) Slider \u003c= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block Shortcode",
    "slug": "social-proof-testimonials-slider",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8985",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – GlobalTranz Edition \u003c= 2.3.11 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-globaltranz-edition",
    "type": "plugin",
    "affected_version": "* - 2.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13476",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Ultimate Gift Card - Create, Sell and Manage Gift Cards with Customized Email Templates \u003c 2.9.1 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-ultimate-gift-card",
    "type": "plugin",
    "affected_version": "[*, 2.9.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-53740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53740",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eMagicOne Store Manager for WooCommerce \u003c= 1.2.5 - Unauthenticated Arbitrary File Read",
    "slug": "store-manager-connector",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4602",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JetSearch \u003c= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-search",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31043",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smartcat Translator for WPML \u003c= 3.1.72 - Authenticated (Author+) SQL Injection via orderby Parameter",
    "slug": "smartcat-wpml",
    "type": "plugin",
    "affected_version": "* - 3.1.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9451",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.26.5 - Missing Authorization",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.26.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1050",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Product Add-Ons \u003c= 4.13.0 - Reflected Cross-Site Scripting",
    "slug": "yith-woocommerce-product-add-ons",
    "type": "plugin",
    "affected_version": "* - 4.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47367",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iframe \u003c= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode",
    "slug": "iframe",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4919",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iFrame Images Gallery \u003c= 9.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-iframe-images-gallery",
    "type": "plugin",
    "affected_version": "* - 9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30969",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Conditional Checkout Fields \u0026 Edit Checkout Fields for WooCommerce \u003c= 1.2.1 - Missing Authorization",
    "slug": "conditional-checkout-fields-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45070",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iframe \u003c= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "iframe",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6844",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Responsive flipbook \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wppdf",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30552",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress + Microsoft Office 365 / Azure AD | LOGIN \u003c= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode",
    "slug": "wpo365-login",
    "type": "plugin",
    "affected_version": "* - 27.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "27.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4706",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TM WooCommerce Compare \u0026 Wishlist \u003c= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "tm-woocommerce-compare-wishlist",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5230",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download IP2Location Country Blocker \u003c= 2.29.1 - Bypass via IP Spoofing",
    "slug": "ip2location-country-blocker",
    "type": "plugin",
    "affected_version": "* - 2.29.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.29.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37865",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Falang multilanguage for WordPress \u003c= 1.3.49 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "falang",
    "type": "plugin",
    "affected_version": "* - 1.3.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.49",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4417",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FuseDesk \u003c= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter",
    "slug": "fusedesk",
    "type": "plugin",
    "affected_version": "* - 6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3832",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Linked Images To Gallery \u003c= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "add-linked-images-to-gallery-v01",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27277",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maintenance Mode by helderk \u003c= 3.0.1 - Unauthenticated IP Spoofing",
    "slug": "hkdev-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32708",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Point \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "point",
    "type": "theme",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37931",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPvivid Backup \u0026 Migration Plugin \u003c= 0.9.99 - Authenticated (Admin+) PHAR Deserialization",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.99",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.99",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3054",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Call\u0026Book Mobile Bar \u003c= 1.2.2 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "callbook-mobile-bar",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1644",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Feed on WooCommerce for Google \u003c= 3.5.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "purple-xmls-google-product-feed-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32087",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP Social Bookmarking Light \u003c 1.7.10 - Cross-Site Scripting",
    "slug": "wp-social-bookmarking-light",
    "type": "plugin",
    "affected_version": "[*, 1.7.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9433",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Simple add pages or posts \u003c 1.7 - Cross-Site Request Forgery",
    "slug": "simple-add-pages-or-posts",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10883",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.112",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.112",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6166",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "J\u0026T Express Malaysia \u003c= 2.0.13 - Reflected Cross-Site Scripting via [placeholder]",
    "slug": "jt-express",
    "type": "plugin",
    "affected_version": "* - 2.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54305",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Map Locations \u003c= 2.0.8 - Reflected Cross-Site Scripting",
    "slug": "cm-map-locations",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24758",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kama SpamBlock \u003c= 1.8.2 - Reflected Cross-Site Scripting",
    "slug": "kama-spamblock",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9647",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Tickets \u003c= 5.11.0.4 - Cross-Site Request Forgery",
    "slug": "event-tickets",
    "type": "plugin",
    "affected_version": "* - 5.11.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stock Sync for WooCommerce \u003c= 2.4.0 - Reflected Cross-Site Scripting via page parameter",
    "slug": "stock-sync-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Global Tooltip",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4379",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "LiquidThemes Themes \u003c= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated",
    "slug": "aihub",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0951",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LiquidThemes Themes \u003c= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated",
    "slug": "hub",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0951",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LiquidThemes Themes \u003c= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated",
    "slug": "archub",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0951",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zotpress \u003c= 7.3.12 - Missing Authorization",
    "slug": "zotpress",
    "type": "plugin",
    "affected_version": "* - 7.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7429",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SMS for WooCommerce \u003c= 2.8.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "wc-sms",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12220",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Digital Events Calendar \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via column Parameter",
    "slug": "digital-events-calendar",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5801",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Minterpress \u003c= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "minterpress",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23529",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Index WP MySQL For Speed \u003c= 1.4.17 - Reflected Cross-Site Scripting",
    "slug": "index-wp-mysql-for-speed",
    "type": "plugin",
    "affected_version": "* - 1.4.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4977",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.5.3 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54677",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Steam Group Viewer \u003c= 2.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "steam-group-viewer",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24476",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TelSender \u003c= 1.14.11 - Missing Authorization",
    "slug": "telsender",
    "type": "plugin",
    "affected_version": "* - 1.14.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41683",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPoperation Elementor Addons \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpop-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31823",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.1.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-1244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1244",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rich Table of Contents \u003c= 1.4.0 - Missing Authorization",
    "slug": "rich-table-of-content",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31004",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JobHunt Job Alerts \u003c= 3.6 - Missing Authorization to Unauthenticated Arbitrary Content Deletion",
    "slug": "jobhunt-notifications",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39536",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flaming Forms \u003c= 1.0.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "flaming-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7691",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Preloader Quotes \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "preloader-quotes",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23682",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Typekit plugin for WordPress \u003c= 1.2.3 - Cross-Site Request Forgery",
    "slug": "typekit",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30526",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Oracle Cards Lite \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "oracle-cards",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30852",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin side data storage for Contact Form 7 \u003c= 1.1.1 - Cross-Site Request Forgery",
    "slug": "admin-side-data-storage-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1777",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Beacon For Help Scout \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beacon-for-helpscout",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51828",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button - Chaty \u003c= 2.8.2 Reflected Cross-Site Scripting",
    "slug": "chaty",
    "type": "plugin",
    "affected_version": "[*, 2.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25016",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixel WordPress Form BuilderPlugin \u0026 Autoresponder \u003c= 1.0.2 - Unauthenticated SQL Injection",
    "slug": "pixel-formbuilder",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31914",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Multilevel Referral Affiliate Plugin for WooCommerce \u003c= 2.27 - Reflected Cross-Site Scripting",
    "slug": "multilevel-referral-plugin-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53742",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Profile Picture \u003c= 2.4.0 - Sensitive Information Disclosure",
    "slug": "users-profile-picture",
    "type": "plugin",
    "affected_version": "[*, 2.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24170",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Custom Banners \u003c 2.1 - Cross-Site Scripting",
    "slug": "custom-banners",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-4724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4724",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Advanced Contact form 7 DB \u003c= 2.0.2 - Sensitive Information Exposure",
    "slug": "advanced-cf7-db",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3723",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Monetize \u003c= 1.03 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "monetize",
    "type": "plugin",
    "affected_version": "* - 1.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9440",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GamiPress \u003c= 7.4.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 7.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49326",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Envato Elements \u003c= 2.0.14 - Authenticated (Author+) Server-Side Request Forgery",
    "slug": "envato-elements",
    "type": "plugin",
    "affected_version": "* - 2.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56275",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Code Snippets Extended \u003c= 1.4.7 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "code-snippets-extended",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29429",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 2.2 - Arbitrary File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-3543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-3543",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Envo's Elementor Templates \u0026 Widgets for WooCommerce \u003c= 1.4.4 - Cross-Site Request Forgery via ajax_plugin_activation",
    "slug": "envo-elementor-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0767",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sina Extension for Elementor \u003c= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parameter",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5260",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator Plugin \u003c= 1.5.3.1 - SQL Injection",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-9568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9568",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "flickrRSS \u003c= 5.3.1 - Cross-Site Scripting via flickrRSS_id",
    "slug": "flickr-rss",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-6468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6468",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sticky Chat Widget \u003c= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sticky-chat-widget",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51361",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "10Web Social Post Feed \u003c= 1.2.9 - Reflected Cross-Site Scripting",
    "slug": "wd-facebook-feed",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9607",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Grid \u003c= 1.21 - Reflected Cross-Site Scripting",
    "slug": "video-grid",
    "type": "plugin",
    "affected_version": "* - 1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30785",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Timeline Module for Beaver Builder \u003c= 1.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "timeline-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37919",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PostX - Gutenberg Blocks for Post Grid \u003c= 2.4.9 - Stored Cross-Site Scripting",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "[*, 2.4.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24660",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IURNY by INDIGITALL – WhatsApp Chat, Web Push Notifications (FREE) \u003c= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "indigitall-web-push-notifications",
    "type": "plugin",
    "affected_version": "[*, 3.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-3647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3647",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Steel \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn Shortcode",
    "slug": "steel",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10147",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category Meta \u003c= 1.2.8 - Cross-Site Request Forgery",
    "slug": "wp-category-meta",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44998",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ReachShip WooCommerce Multi-Carrier \u0026 Conditional Shipping \u003c= 4.3.1 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "elex-reachship-multi-carrier-conditional-shipping",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53213",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JKDEVKIT \u003c= 1.9.4 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "jkdevkit",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2932",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bit Form \u003c= 1.8.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4774",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfileGrid – User Profiles, Groups and Communities \u003c= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8861",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "phZoom \u003c= 1.2.92 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "phzoom",
    "type": "plugin",
    "affected_version": "* - 1.2.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.92",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54434",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myStickymenu \u003c= 2.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Lead Deletion",
    "slug": "mystickymenu",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5509",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.31",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.31",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.11",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.7",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.28",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.25",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.20",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.12",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.29",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.21",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.19",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.3",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.28",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.16",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.15",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.4",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.6.1 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-4339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4339",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Restrict User Access – Ultimate Membership \u0026 Content Protection \u003c= 2.5 - Information Exposure",
    "slug": "restrict-user-access",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0687",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Countdown Timer block – Display the event's date into a timer. \u003c= 1.2.4 - Authenticated (Contributor+) Post Disclosure",
    "slug": "countdown-time",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10669",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Shopo \u003c= 1.1.4 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "shopo",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31048",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Payrexx Payment Gateway for WooCommerce \u003c= 3.1.5 - Missing Authorization",
    "slug": "woo-payrexx-gateway",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59559",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8015",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EasyRecipe \u003c= 3.5.3251 - Cross-Site Request Forgery",
    "slug": "easyrecipe",
    "type": "plugin",
    "affected_version": "* - 3.5.3251",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3251",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46779",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Filter \u0026 Combine RSS Feeds \u003c= 0.4 - Missing Authorization to Authenticated (Contributor+) Feed Deletion",
    "slug": "wp-filter-combine-rss-feeds",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7828",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spnbabble \u003c= 1.4.1 - Multiple Cross-Site Request Forgery",
    "slug": "spnbabble",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9339",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "StreamWeasels Twitch Integration \u003c= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "streamweasels-twitch-integration",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29766",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "12 Step Meeting List \u003c= 3.16.5 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "12-step-meeting-list",
    "type": "plugin",
    "affected_version": "* - 3.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24583",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CF7 Spreadsheets \u003c= 2.3.2 - Missing Authorization to Settings Update",
    "slug": "cf7-spreadsheets",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31603",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.6.25 - Authenticated (Administrator+) Stored HTML Injection",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4109",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPKoi Templates for Elementor \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpkoi-templates-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56241",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Guzzle \u003c= 6.5.7 and 7.0-7.4.4 - Information Exposure",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-31090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-31090",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Essential Blocks \u003c= 4.2.0 - Unauthenticated PHP Object Injection via queries",
    "slug": "essential-blocks-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4386",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Blocks \u003c= 4.2.0 - Unauthenticated PHP Object Injection via queries",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4386",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bulk Featured Image \u003c= 1.2.2 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "bulk-featured-image",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58819",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Job Openings \u003c= 3.4.1 - Missing Authorization",
    "slug": "wp-job-openings",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45061",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by KlbTheme \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "cosmetsy-core",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49839",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by KlbTheme \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "partdo-core",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49839",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by KlbTheme \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "medibazar-core",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49839",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by KlbTheme \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "bacola-core",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49839",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by KlbTheme \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "clotya-core",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49839",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by KlbTheme \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "furnob-core",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49839",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fable Extra \u003c= 1.0.6 - Unauthenticated Local File Inclusion",
    "slug": "fable-extra",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-46468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46468",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import CDN-Remote Images \u003c= 2.1.2 - Cross-Site Request Forgery",
    "slug": "import-cdn-remote-images",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48153",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FluentForms \u003c= 4.3.24 - Authenticated(Contributor+) Stored Cross-Site Scripting",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 4.3.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0546",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Peadig's Twitter Feed: Embedded Timeline WordPress Plugin \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "wp-twitter-feed",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2010-4825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4825",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Code Snippets Extended \u003c= 1.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "code-snippets-extended",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29436",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Post Type Relations \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "custom-post-type-relations",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnDash LMS \u003c= 4.10.2 - Sensitive Information Exposure via API",
    "slug": "sfwd-lms",
    "type": "plugin",
    "affected_version": "* - 4.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1208",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AdRotate \u003c 5.8.4 - Authenticated SQL Injection",
    "slug": "adrotate",
    "type": "plugin",
    "affected_version": "[*, 5.8.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24138",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfileGrid – User Profiles, Memberships, Groups and Communities \u003c= 5.0.3 - Missing Authorization to Information Exposure",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36352",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "vBSSO-lite \u003c= 1.4.3 - Missing Authorization to Privilege Escalation",
    "slug": "vbsso-lite",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54297",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Sessions Time Monitoring Full Automatic \u003c= 1.0.9 - Unauthenticated SQL Injection",
    "slug": "activitytime",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49681",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Kraken.io Image Optimizer \u003c= 2.6.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update",
    "slug": "kraken-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22708",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \u003c= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3295",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "HT Contact Form Widget For Elementor Page Builder \u0026 Gutenberg Blocks \u0026 Form Builder. \u003c= 2.2.1 - Unauthenticated Arbitrary File Upload",
    "slug": "ht-contactform",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7340",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Consulting Elementor Widgets \u003c= 1.3.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "consulting-elementor-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37092",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Content Mask \u003c= 1.8.4 - Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "content-mask",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1203",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ClipLink \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "cliplink",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49964",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MDTF – Meta Data and Taxonomies Filter \u003c= 1.3.0.1 - Relected Cross-Site Scripting via 'tax_name'",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28664",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WhatsApp Share Button \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "whatsapp",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5668",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ERP \u003c= 1.12.8 - Authenticated (Accounting manager+) SQL Injection",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.12.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-21747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-21747",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Categorify \u003c= 1.0.7.4 - Missing Authorization in categorifyAjaxAddCategory",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "* - 1.0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0385",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro – Mailchimp Add On \u003c= 2.3.4 - Unauthenticated Information Disclosure",
    "slug": "pmpro-mailchimp",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30523",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Quotes llama \u003c= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quotes-llama",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10874",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Custom post type custom field \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "simple-content-construction-kit",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23500",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackUpWordPress \u003c= 3.13 - Authenticated (Admin+) Directory Traversal",
    "slug": "backupwordpress",
    "type": "plugin",
    "affected_version": "* - 3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-3034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3034",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Advance Search for WooCommerce \u003c 1.1 - Cross-Site Scripting",
    "slug": "woo-advance-search",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-11485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11485",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Memberships, Groups and Communities \u003c= 5.1.0 - Reflected Cross-Site Scripting",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3578",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widgetize Pages Light \u003c= 3.0 - Reflected Cross-Site Scripting",
    "slug": "widgetize-pages-light",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22313",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.1.5 - Cross-Site Request Forgery via migrateCommonToProductOnly function",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40203",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spam protection, Anti-Spam, FireWall by CleanTalk \u003c= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin Installation",
    "slug": "cleantalk-spam-protect",
    "type": "plugin",
    "affected_version": "* - 6.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.44",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10781",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Google Map Plugin \u003c= 1.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-google-map",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11365",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Fundraising Donation and Crowdfunding Platform \u003c= 1.6.4 - Missing Authorization",
    "slug": "wp-fundraising-donation",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34758",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Shipment Tracking for WooCommerce \u003c= 3.2.6 - Authenticated WordPress Options Change",
    "slug": "woo-advanced-shipment-tracking",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-4347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4347",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H"
  },
  {
    "title": "LMS by LifterLMS – Online Course, Membership \u0026 Learning Management System Plugin for WordPress \u003c 4.21.2 - Insecure Direct Object Reference",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "[*, 4.21.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24562",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Easy Video Player Wordpress \u0026 WooCommerce \u003c= 10.0 - Unauthenticated Arbitrary File Download",
    "slug": "fwdevp",
    "type": "theme",
    "affected_version": "* - 10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28955",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WooLentor – WooCommerce Elementor Addons + Builder \u003c= 1.8.5 - Authenticated Stored Cross-Site Scripting",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "[*, 1.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24262",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp photo text slider 50 \u003c= 8.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "wp-photo-text-slider-50",
    "type": "plugin",
    "affected_version": "* - 8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5439",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.15.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12852",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calendar \u003c= 1.3.10 - Authenticated Stored Cross-Site Scripting",
    "slug": "calendar",
    "type": "plugin",
    "affected_version": "[*, 1.3.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-18872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-18872",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PlugNedit Adaptive Editor \u003c 6.2.0 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting",
    "slug": "plugnedit",
    "type": "plugin",
    "affected_version": "[*, 6.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9422",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 3.1.5 - PHP Object Injection",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24579",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Webba Booking \u003c= 4.5.33 - Cross-Site Request Forgery",
    "slug": "webba-booking-lite",
    "type": "plugin",
    "affected_version": "* - 4.5.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51354",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MainWP Maintenance Extension \u003c= 4.1.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "mainwp-maintenance-extension",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23660",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stacks Mobile App Builder \u003c= 5.2.3 - Unauthenticated Arbitrary File Upload",
    "slug": "stacks-mobile-app-builder",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50527",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Insert Estimated Reading Time \u003c= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "insert-estimated-reading-time",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41734",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy \u003c 1.0.126 - Authorization Bypass to Settings Updates",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "[*, 1.0.126)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.126",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36714",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core - Informational \u003c 6.8 - Weak Hashing Algorithm",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8",
    "to_inclusive": false,
    "severity": "low",
    "cve": "CVE-2012-6707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6707",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Gallery Plugin \u003c= 1.4 - Unauthenticated Remote File Inclusion",
    "slug": "wordpress-gallery-plugin",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-4919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4919",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Insert Pages \u003c= 3.6.1 - Contributor+ Arbitrary Posts/Pages Access",
    "slug": "insert-pages",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24851",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Glossary \u003c= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-glossary",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41831",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker \u003c= 5.1.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 5.1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22664",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Box – Best WordPress Popup Plugin \u003c= 4.3.6 - Missing Authorization to Information Exposure",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "* - 4.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3897",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Songkick Concerts and Festivals \u003c= 0.9.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "songkick-concerts-and-festivals",
    "type": "plugin",
    "affected_version": "* - 0.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25146",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hardening – Fix Your WordPress Security \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "wp-security-hardening",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24372",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup and Staging by WP Time Capsule \u003c= 1.22.20 - Authentication Bypass to Account Takeover",
    "slug": "wp-time-capsule",
    "type": "plugin",
    "affected_version": "* - 1.22.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.20",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-38770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38770",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PayPal Express Checkout \u003c= 2.1.2 - Cross-Site Request Forgery",
    "slug": "paypal-express-checkout",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46499",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcode Addons \u003c= 3.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "shortcode-addons",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37121",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Five Star Restaurant Reservations \u003c= 2.6.16 - Missing Authorization",
    "slug": "restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 2.6.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33596",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Media Shortcodes \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "social-media-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10166",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JM Twitter Cards \u003c= 14 - Information Exposure via Meta Description",
    "slug": "jm-twitter-cards",
    "type": "plugin",
    "affected_version": "* - 14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1769",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Job Manager \u003c= 0.7.25 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "job-manager",
    "type": "plugin",
    "affected_version": "* - 0.7.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39336",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy restaurant menu manager \u003c= 2.0.1 - Authenticated (Contributot+) Stored Cross-Site Scripting via `nsc_eprm_menu_link` Shortcode",
    "slug": "easy-pdf-restaurant-menu-upload",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6673",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Smart Quick View for WooCommerce \u003c= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "woo-smart-quick-view",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6494",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Designer \u003c= 1.0.32 - Unauthenticated PHP Object Injection",
    "slug": "product-designer",
    "type": "plugin",
    "affected_version": "* - 1.0.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.32",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31277",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Login Widget With Shortcode \u003c 3.2.1 - Cross-Site Scripting",
    "slug": "login-sidebar-widget",
    "type": "plugin",
    "affected_version": "[*, 3.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-6312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6312",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Paid Memberships Pro - Member Directory Add On \u003c 1.2.6 - Authenticated (Contributor+) Information Exposure",
    "slug": "pmpro-member-directory",
    "type": "plugin",
    "affected_version": "[*, 1.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-1287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1287",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Gutenberg Block Editor Toolkit – EditorsKit \u003c= 1.40.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "block-options",
    "type": "plugin",
    "affected_version": "* - 1.40.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.40.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2794",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Etsy Shop \u003c= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "etsy-shop",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5470",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.102 - Authenticated (Admin+) Command Injection",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.102",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.102",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2662",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Live Streaming Video Player – by SRS Player \u003c= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "srs-player",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27327",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Disable Comments – Remove Comments \u0026 Stop Spam [Multi-Site Support] \u003c 1.0.4 - Cross-Site Request Forgery",
    "slug": "disable-comments",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-2550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2550",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Automate Hub Free by Sperse.IO \u003c= 1.7.0 - Cross-Site Request Forgery to Activation Status Update",
    "slug": "automate-hub-free-by-sperse-io",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13683",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.0 - 5.0.2",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.6 - 5.6.4",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.0 - 8.0.2",
    "from_version": "8.0",
    "from_inclusive": true,
    "to_version": "8.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.5 - 9.5.4",
    "from_version": "9.5",
    "from_inclusive": true,
    "to_version": "9.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.0 - 11.0.1",
    "from_version": "11.0",
    "from_inclusive": true,
    "to_version": "11.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.7 - 11.7.2",
    "from_version": "11.7",
    "from_inclusive": true,
    "to_version": "11.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.1 - 12.1.1",
    "from_version": "12.1",
    "from_inclusive": true,
    "to_version": "12.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.9 - 5.9.3",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.9 - 6.9.3",
    "from_version": "6.9",
    "from_inclusive": true,
    "to_version": "6.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.7 - 7.7.5",
    "from_version": "7.7",
    "from_inclusive": true,
    "to_version": "7.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.1 - 8.1.3",
    "from_version": "8.1",
    "from_inclusive": true,
    "to_version": "8.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.7 - 8.7.3",
    "from_version": "8.7",
    "from_inclusive": true,
    "to_version": "8.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "13.5",
    "from_version": "13.5",
    "from_inclusive": true,
    "to_version": "13.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.1 - 4.1.3",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.2 - 5.2.4",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.2 - 11.2.1",
    "from_version": "11.2",
    "from_inclusive": true,
    "to_version": "11.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.6 - 11.6.1",
    "from_version": "11.6",
    "from_inclusive": true,
    "to_version": "11.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.9 - 4.9.2",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.3 - 6.3.6",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.0 - 7.0.4",
    "from_version": "7.0",
    "from_inclusive": true,
    "to_version": "7.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.5 - 7.5.6",
    "from_version": "7.5",
    "from_inclusive": true,
    "to_version": "7.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.6 - 10.6.1",
    "from_version": "10.6",
    "from_inclusive": true,
    "to_version": "10.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.6 - 12.6.2",
    "from_version": "12.6",
    "from_inclusive": true,
    "to_version": "12.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.9 - 12.9.3",
    "from_version": "12.9",
    "from_inclusive": true,
    "to_version": "12.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.5 - 5.5.4",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.0 - 6.0.3",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.5 - 8.5.2",
    "from_version": "8.5",
    "from_inclusive": true,
    "to_version": "8.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.8 - 8.8.4",
    "from_version": "8.8",
    "from_inclusive": true,
    "to_version": "8.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.0 - 9.0.4",
    "from_version": "9.0",
    "from_inclusive": true,
    "to_version": "9.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.1 - 5.1.3",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.0 - 4.0.6",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.2 - 4.2.4",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.4 - 4.4.4",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.5 - 4.5.2",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.4 - 10.4.1",
    "from_version": "10.4",
    "from_inclusive": true,
    "to_version": "10.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.4 - 11.4.1",
    "from_version": "11.4",
    "from_inclusive": true,
    "to_version": "11.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.8 - 11.8.5",
    "from_version": "11.8",
    "from_inclusive": true,
    "to_version": "11.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.5",
    "from_version": "12.5",
    "from_inclusive": true,
    "to_version": "12.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.3 - 11.3.3",
    "from_version": "11.3",
    "from_inclusive": true,
    "to_version": "11.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.4",
    "from_version": "12.4",
    "from_inclusive": true,
    "to_version": "12.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "13.7",
    "from_version": "13.7",
    "from_inclusive": true,
    "to_version": "13.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.7 - 6.7.3",
    "from_version": "6.7",
    "from_inclusive": true,
    "to_version": "6.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.8 - 6.8.4",
    "from_version": "6.8",
    "from_inclusive": true,
    "to_version": "6.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.3 - 8.3.2",
    "from_version": "8.3",
    "from_inclusive": true,
    "to_version": "8.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.9 - 9.9.2",
    "from_version": "9.9",
    "from_inclusive": true,
    "to_version": "9.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.1 - 6.1.4",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.5 - 6.5.3",
    "from_version": "6.5",
    "from_inclusive": true,
    "to_version": "6.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.6 - 8.6.3",
    "from_version": "8.6",
    "from_inclusive": true,
    "to_version": "8.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.4 - 9.4.3",
    "from_version": "9.4",
    "from_inclusive": true,
    "to_version": "9.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "13.6",
    "from_version": "13.6",
    "from_inclusive": true,
    "to_version": "13.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "3.9 - 3.9.9",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.4 - 5.4.3",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.1 - 7.1.4",
    "from_version": "7.1",
    "from_inclusive": true,
    "to_version": "7.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.4 - 7.4.4",
    "from_version": "7.4",
    "from_inclusive": true,
    "to_version": "7.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.7 - 9.7.2",
    "from_version": "9.7",
    "from_inclusive": true,
    "to_version": "9.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.7 - 5.7.4",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.9 - 7.9.3",
    "from_version": "7.9",
    "from_inclusive": true,
    "to_version": "7.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.8 - 9.8.2",
    "from_version": "9.8",
    "from_inclusive": true,
    "to_version": "9.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.9 - 10.9.2",
    "from_version": "10.9",
    "from_inclusive": true,
    "to_version": "10.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.0 - 12.0.1",
    "from_version": "12.0",
    "from_inclusive": true,
    "to_version": "12.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.3",
    "from_version": "12.3",
    "from_inclusive": true,
    "to_version": "12.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.3 - 4.3.4",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.6 - 4.6.2",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.6 - 6.6.4",
    "from_version": "6.6",
    "from_inclusive": true,
    "to_version": "6.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.2 - 9.2.3",
    "from_version": "9.2",
    "from_inclusive": true,
    "to_version": "9.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.7 - 10.7.1",
    "from_version": "10.7",
    "from_inclusive": true,
    "to_version": "10.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.9 - 11.9.2",
    "from_version": "11.9",
    "from_inclusive": true,
    "to_version": "11.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "13.2 - 13.2.2",
    "from_version": "13.2",
    "from_inclusive": true,
    "to_version": "13.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.2 - 8.2.5",
    "from_version": "8.2",
    "from_inclusive": true,
    "to_version": "8.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.6 - 9.6.3",
    "from_version": "9.6",
    "from_inclusive": true,
    "to_version": "9.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "13.3 - 13.3.1",
    "from_version": "13.3",
    "from_inclusive": true,
    "to_version": "13.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "13.9",
    "from_version": "13.9",
    "from_inclusive": true,
    "to_version": "13.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.8 - 4.8.4",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.4 - 6.4.5",
    "from_version": "6.4",
    "from_inclusive": true,
    "to_version": "6.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.6 - 7.6.3",
    "from_version": "7.6",
    "from_inclusive": true,
    "to_version": "7.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.8 - 7.8.3",
    "from_version": "7.8",
    "from_inclusive": true,
    "to_version": "7.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.4 - 8.4.4",
    "from_version": "8.4",
    "from_inclusive": true,
    "to_version": "8.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.9 - 8.9.3",
    "from_version": "8.9",
    "from_inclusive": true,
    "to_version": "8.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.7 - 4.7.3",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.7 - 12.7.1",
    "from_version": "12.7",
    "from_inclusive": true,
    "to_version": "12.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.2 - 10.2.2",
    "from_version": "10.2",
    "from_inclusive": true,
    "to_version": "10.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.5 - 10.5.2",
    "from_version": "10.5",
    "from_inclusive": true,
    "to_version": "10.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.1 - 11.1.3",
    "from_version": "11.1",
    "from_inclusive": true,
    "to_version": "11.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.8 - 12.8.1",
    "from_version": "12.8",
    "from_inclusive": true,
    "to_version": "12.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "13.0",
    "from_version": "13.0",
    "from_inclusive": true,
    "to_version": "13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.2 - 6.2.4",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.2 - 12.2.1",
    "from_version": "12.2",
    "from_inclusive": true,
    "to_version": "12.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "13.1 - 13.1.3",
    "from_version": "13.1",
    "from_inclusive": true,
    "to_version": "13.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "13.8 - 13.8.1",
    "from_version": "13.8",
    "from_inclusive": true,
    "to_version": "13.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.8 - 5.8.3",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.2 - 7.2.4",
    "from_version": "7.2",
    "from_inclusive": true,
    "to_version": "7.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.3 - 7.3.4",
    "from_version": "7.3",
    "from_inclusive": true,
    "to_version": "7.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.1 - 9.1.2",
    "from_version": "9.1",
    "from_inclusive": true,
    "to_version": "9.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.3 - 9.3.4",
    "from_version": "9.3",
    "from_inclusive": true,
    "to_version": "9.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.0 - 10.0.1",
    "from_version": "10.0",
    "from_inclusive": true,
    "to_version": "10.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "13.4 - 13.4.3",
    "from_version": "13.4",
    "from_inclusive": true,
    "to_version": "13.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.3 - 5.3.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.1 - 10.1.1",
    "from_version": "10.1",
    "from_inclusive": true,
    "to_version": "10.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.3 - 10.3.1",
    "from_version": "10.3",
    "from_inclusive": true,
    "to_version": "10.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.8 - 10.8.1",
    "from_version": "10.8",
    "from_inclusive": true,
    "to_version": "10.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.5 - 11.5.2",
    "from_version": "11.5",
    "from_inclusive": true,
    "to_version": "11.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9926",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[*, 12.8-a.1]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.8-a.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45050",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram \u003c= 3.1.24 - Missing Authorization",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 3.1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43272",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Accessibility  \u003c= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "accessibility",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41643",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Custom Cursors \u003c= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-custom-cursors",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3149",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Cross-Site Request Forgery via 'clear_uucss_logs'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1340",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MG Parallax Slider \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "mg-parallax-slider",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22330",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WS Form LITE – Drag \u0026 Drop Contact Form Builder for WordPress \u003c= 1.9.244 - Reflected Cross-Site Scripting via URL",
    "slug": "ws-form",
    "type": "plugin",
    "affected_version": "* - 1.9.244",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.244",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10647",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post to CSV by BestWebSoft \u003c= 1.4.0 - Authenticated (Author+) CSV Injection",
    "slug": "post-to-csv",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-36527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36527",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Beebee Mini \u003c= 1.2.0 - Unauthorized File Upload via ACF",
    "slug": "beebee-mini",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2594",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blog Designer PRO for WordPress \u003c= 3.4.7 - Unauthenticated Local File Inclusion",
    "slug": "blog-designer-pro",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47696",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LifterLMS PayPal \u003c 1.4.0 - Reflected Cross-Site Scripting",
    "slug": "lifterlms-gateway-paypal",
    "type": "plugin",
    "affected_version": "[*, 1.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1250",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Table Builder – WordPress Table Plugin \u003c= 1.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-table-builder",
    "type": "plugin",
    "affected_version": "* - 1.4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43125",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.7 - Admin+ Stored Cross-Site Scripting",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "[*, 1.5.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1408",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MaxGalleria \u003c= 6.4.2 - Missing Authorization",
    "slug": "maxgalleria",
    "type": "plugin",
    "affected_version": "* - 6.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3581",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Goodlayers Hostel \u003c= 3.1.2 - Reflected Cross-Site Scripting",
    "slug": "gdlr-hostel",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39502",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Viewer \u003c= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "pdf-viewer",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0033",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobScout \u003c= 1.1.4 - Cross-Site Request Forgery to Notice Dimissal",
    "slug": "jobscout",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37421",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Registration \u003c= 4.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30899",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mortgage Lead Capture System \u003c= 8.2.11 - Cross-Site Request Forgery to Settings Reset",
    "slug": "wprequal",
    "type": "plugin",
    "affected_version": "* - 8.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0796",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quick Event Calendar \u003c= 1.4.9 - Cross-Site Request Forgery",
    "slug": "quick-event-calendar",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27360",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Membership, User Registration, User Profile \u0026 Restrict Content Plugin – ProfilePress \u003c= 3.1.10 - Unauthenticated Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 3.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24522",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Slider \u003c= 3.9.5 - Unauthenticated PHP Object Injection",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32600",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup – MailChimp, GetResponse and ActiveCampaign Intergrations \u003c= 3.2.6 - Unauthenticated SQL Injection",
    "slug": "ultimate-popup-creator",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12157",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Secure Copy Content Protection and Content Locking \u003c= 3.7.1 - Missing Authorization",
    "slug": "secure-copy-content-protection",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32787",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Qubely \u003c= 1.7.7 - Missing Authorization to Arbitrary Post Deletion",
    "slug": "qubely",
    "type": "plugin",
    "affected_version": "[*, 1.7.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25013",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.5.1.8 - Reflected Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-1002007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1002007",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Store Finder \u003c= 6.9.7 - Unauthenticated Local File Inclusion",
    "slug": "superstorefinder-wp",
    "type": "plugin",
    "affected_version": "* - 6.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47571",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Banner System \u003c= 1.0.0 - Missing Authorization",
    "slug": "banner-system",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54359",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ClickBank Storefront WordPress Plugin \u003c= 1.7 - Reflected Cross-Site Scripting",
    "slug": "mycbgenie-clickbank-storefront",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23524",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Virusdie \u003c= 1.1.3 - Cross-Site Request Forgery",
    "slug": "virusdie",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53265",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Query Wrangler \u003c= 1.5.51 - Reflected Cross-Site Scripting via page parameter",
    "slug": "query-wrangler",
    "type": "plugin",
    "affected_version": "* - 1.5.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30779",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mailster \u003c= 1.8.20.0 - Reflected Cross-Site Scripting",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24688",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zotpress \u003c= 7.3.9 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "zotpress",
    "type": "plugin",
    "affected_version": "* - 7.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34569",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.24.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6624",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Text to Speech \u003c= 3.0.3 - Missing Authorization",
    "slug": "ai-text-to-speech",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39554",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Access Manager \u003c= 6.6.1 - Authenticated Authorization Bypass and Privilege Escalation",
    "slug": "advanced-access-manager",
    "type": "plugin",
    "affected_version": "* - 6.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35935",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JSM Screenshot Machine Shortcode \u003c= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "screenshot-machine-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13385",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Rocket \u003c= 3.3 - Missing Authorization",
    "slug": "event-rocket",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53452",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Futurio Extra \u003c= 1.6.2 - Sensitive Information Disclosure",
    "slug": "futurio-extra",
    "type": "plugin",
    "affected_version": "[*, 1.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MW WP Form \u003c= 4.4.5 - Missing Authorization",
    "slug": "mw-wp-form",
    "type": "plugin",
    "affected_version": "* - 4.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46206",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Social Like Box – Popup – Sidebar Widget \u003c= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "cardoza-facebook-like-box",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5224",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restrict File Access \u003c= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion",
    "slug": "restrict-file-access",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7667",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Min and Max Purchase for WooCommerce \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "min-and-max-purchase-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33949",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.976",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.976",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4489",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ApplyOnline – Application Form Builder and Manager \u003c= 2.6.7.1 - Missing Authorization",
    "slug": "apply-online",
    "type": "plugin",
    "affected_version": "* - 2.6.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22721",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Widget",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Maintenance \u003c= 6.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-maintenance",
    "type": "plugin",
    "affected_version": "* - 6.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36828",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AmaDiscount \u003c= 1.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "amadiscount",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51608",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Contact Form Entries \u003c= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "contact-form-entries",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1069",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Order Proposal \u003c= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal",
    "slug": "wooCommerce-order-proposal",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9927",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Custom Fields Pro \u003c= 6.3.1 - Missing Authorization",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "* - 6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37250",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "filedownload \u003c 1.4 - Blind SQL Injection",
    "slug": "filedownload",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-1000003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000003",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "E-Search \u003c= 1.0 - Reflected Cross-Site Scripting via title_az parameter",
    "slug": "e-search",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000130",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sparkle Elementor Kit \u003c= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sparkle-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53774",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Banner Garden Plugin for WordPress \u003c= 0.1.3 - Reflected Cross-Site Scripting",
    "slug": "banner-garden",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0368",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Postcasa Shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "postcasa",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52352",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Featured Image (Auto Post Thumbnail) \u003c= 4.1.3 - Authenticated (Author+) Server-Side Request Forgery",
    "slug": "auto-post-thumbnail",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33629",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Watu Quiz \u003c= 3.3.9 - Reflected Cross-Site Scripting",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 3.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0968",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Divi \u003c= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "Divi",
    "type": "theme",
    "affected_version": "* - 4.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5533",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RH - Real Estate WordPress Theme \u003c= 4.4.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "realhomes",
    "type": "theme",
    "affected_version": "* - 4.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4601",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Limit Bio \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "limit-bio",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1436",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.1.5 - Missing Authorization in migrateCommonToProductOnly function",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40203",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FeedFocal \u003c= 1.2.2 - Missing Authorization via feedfocal_api_setup REST function",
    "slug": "feedfocal",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46609",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Affiliate Platform \u003c 6.5.1 - Cross-Site Request Forgery to Profile Update",
    "slug": "wp-affiliate-platform",
    "type": "plugin",
    "affected_version": "[*, 6.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-5287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5287",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeBetter Social Icons \u003c= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bebetter-social-icons",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51880",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Product Labels for WooCommerce \u003c= 1.2.3.6 - Reflected Cross-Site Scripting",
    "slug": "advanced-product-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.2.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0399",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Client Dash \u003c= 4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ulimate-client-dash",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58811",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Malware Scanner \u003c= 4.7.1 - IP Spoofing",
    "slug": "miniorange-malware-protection",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52176",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Community by PeepSo \u003c= 6.2.6.0 - Reflected Cross-Site Scripting",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48746",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.1.3 - Username Enumeration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3126",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "A Page Flip Book \u003c 3.0 - Directory Traversal",
    "slug": "wppageflip",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-6652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6652",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SoundRise Music \u003c= 1.7 - Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "soundrise-music",
    "type": "plugin",
    "affected_version": "* - 1.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2103",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CBX Poll \u003c= 1.2.7 - Unauthenticated PHP Object Injection",
    "slug": "cbxpoll",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31612",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wp EMember \u003c= 10.6.5 - Cross-Site Request Forgery to Bulk Delete",
    "slug": "wp-eMember",
    "type": "plugin",
    "affected_version": "* - 10.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5076",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hacklog Down As PDF \u003c= 2.3.6 - Reflected Cross-Site Scripting",
    "slug": "down-as-pdf",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31090",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Picture Gallery – Frontend Image Uploads, AJAX Photo List \u003c= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode",
    "slug": "picture-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12696",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forms for Mailchimp by Optin Cat \u003c= 2.5.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "mailchimp-wp",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47545",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Pro \u003c= 3.13.0 - Missing Authorization",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35050",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Passster \u003c= 4.2.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "content-protector",
    "type": "plugin",
    "affected_version": "* - 4.2.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57926",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator \u003c= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "1.39.2",
    "from_version": "1.39.2",
    "from_inclusive": true,
    "to_version": "1.39.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0469",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Maintenance Mode \u003c= 1.4.2 - Information Exposure",
    "slug": "easy-maintenance-mode-coming-soon",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1477",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Save as Image  \u003c= 3.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "save-as-image-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31931",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Listamester \u003c= 2.3.6 - Cross-Site Request Forgery",
    "slug": "listamester",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47446",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PowerPack Addons for Elementor \u003c= 2.3.1 - Contributor+ Stored Cross-Site Scripting",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24263",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tagembed \u003c= 5.8 - Missing Authorization",
    "slug": "tagembed-widget",
    "type": "plugin",
    "affected_version": "* - 5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34804",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flexible Captcha \u003c= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "flexible-captcha",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0147",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Activity Log \u003c= 2.3.2 - Reflected Cross-Site Scripting",
    "slug": "aryo-activity-log",
    "type": "plugin",
    "affected_version": "[*, 2.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10890",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Section Widget \u003c= 3.3.1 - Unauthenticated Path Traversal",
    "slug": "section-widget",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46441",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Currency Converter Widget \u003c= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "currency-converter-widget",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50822",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FlexIDX Home Search \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "flexidx-home-search",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25082",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Slider \u003c= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "logo-slider-wp",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Counter Box – WordPress plugin for countdown, timer, counter \u003c= 1.2.3 - Cross-Site Request Forgery",
    "slug": "counter-box",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3481",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Login With OTP Over SMS, Email, WhatsApp and Google Authenticator \u003c= 1.0.7 - Cross-Site Scripting",
    "slug": "miniorange-google-authenticator",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1994",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Super Cache \u003c= 1.7.2 - Authenticated Remote Code Execution",
    "slug": "wp-super-cache",
    "type": "plugin",
    "affected_version": "[*, 1.7.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24312",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blrt WP Embed \u003c= 1.6.9 - Reflected Cross-Site Scripting",
    "slug": "blrt-wp-embed",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23507",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Easy Hide Login \u003c= 1.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-hide-login",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32505",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajax Load More \u003c= 7.3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 7.3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47630",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS Digest \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "rss-digest",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53331",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Grid \u003c= 2.1.12 - Contributor+ SQL Injection",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "[*, 2.1.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4450",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy SVG Upload \u003c= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "easy-svg-upload",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9708",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 4.1.6 - Missing Authorization",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31281",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wufoo Shortcode \u003c= 1.51 - Authenticated (Contributor+) Cross-Site Scripting via Shortcodes",
    "slug": "wufoo-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4679",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SB Chart block \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter",
    "slug": "sb-chart-block",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3661",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.43 - Missing Authorization",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3711",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Auto Amazon Links \u003c= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "amazon-auto-links",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52175",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2623",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – Worldwide Express Edition \u003c= 5.0.20 - Missing Authorization to Unauthenticated Arbitrary Content Deletion",
    "slug": "ltl-freight-quotes-worldwide-express-edition",
    "type": "plugin",
    "affected_version": "* - 5.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22291",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Meta SEO \u003c= 4.4.6 - Admin+ Stored Cross-Site Scripting via breadcrumbs",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1093",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gwolle Guestbook \u003c= 4.7.1 - Reflected Cross-Site Scripting",
    "slug": "gwolle-gb",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24710",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slugs Manager \u003c= 2.6.7 - Cross-Site Request Forgery",
    "slug": "remove-old-slugspermalinks",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30536",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.4.4 - Authenticated (Contributor+) Post Disclosure",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10787",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Video Gallery \u003c 2.1 - SQL Injection",
    "slug": "contus-video-gallery",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-3478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3478",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JTRT Responsive Tables \u003c= 4.1.9 - Cross-Site Request Forgery",
    "slug": "jtrt-responsive-tables",
    "type": "plugin",
    "affected_version": "* - 4.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24802",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wovax IDX \u003c= 1.2.2 - Missing Authorization to Privilege Escalation",
    "slug": "wovax-idx",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56013",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image optimization \u0026 Lazy Load \u003c= 3.3.1 - Admin+ Stored Cross-Site Scripting",
    "slug": "optimole-wp",
    "type": "plugin",
    "affected_version": "[*, 3.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0969",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-2409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2409",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP To Do \u003c= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings",
    "slug": "wp-todo",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3946",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hola Free Video Player \u003c= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hola-free-video-player",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51854",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adifier (Premium Theme) \u003c 3.1.4 - Reflected Cross-Site Scripting",
    "slug": "adifier",
    "type": "theme",
    "affected_version": "[*, 3.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-49187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49187",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Optin Wheel \u003c= 1.4.2 - Sensitive Information Exposure via Log File",
    "slug": "wp-optin-wheel",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51408",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Safe Ai Malware Protection for WP \u003c= 1.0.20 - Missing Authorization",
    "slug": "safe-ai-malware-protection-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31545",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tapfiliate \u003c= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tapfiliate",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58689",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 3.1.9 - Authentication Bypass",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24148",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UserPro \u003c= 5.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "5.1.5",
    "from_version": "5.1.5",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2439",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Delete Old Order \u003c= 0.2 - Cross-Site Scripting",
    "slug": "delete-old-orders",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0620",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WP Mail \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-mail",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-5942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5942",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Controlled Admin Access \u003c= 1.5.1 - Improper Access Control \u0026 Privilege Escalation",
    "slug": "controlled-admin-access",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24215",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Frontend File Manager Plugin \u003c= 22.5 - Authenticated (Editor+) Directory Traversal",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "* - 22.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "22.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5105",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Ashe \u003c= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter",
    "slug": "ashe",
    "type": "theme",
    "affected_version": "* - 2.243",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.243",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9777",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyCryptoCheckout \u003c= 2.125 - Cross-Site Request Forgery",
    "slug": "mycryptocheckout",
    "type": "plugin",
    "affected_version": "* - 2.125",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.125",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41693",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Modal Survey \u003c= 2.0.2.0.1 - Unauthenticated Local File Inclusion",
    "slug": "modal-survey",
    "type": "plugin",
    "affected_version": "* - 2.0.2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39468",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Recipe Maker For Your Food Blog from Zip Recipes \u003c= 8.1.0 - Authenticated(Contributor+) SQL Injection",
    "slug": "zip-recipes",
    "type": "plugin",
    "affected_version": "[*, 8.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-52180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52180",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BuddyForms \u003c= 2.8.17 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32151",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Limit Attempts by BestWebSoft \u003c= 1.2.9 - Reflected Cross-Site Scripting",
    "slug": "limit-attempts",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30439",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Messages \u003c= 1.2.4 - Reflected Cross-Site Scripting",
    "slug": "user-messages",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13222",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP e-Customers Beta \u003c= 0.0.1 - Reflected Cross-Site Scripting",
    "slug": "wp-e-customers",
    "type": "plugin",
    "affected_version": "* - 0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13885",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Five Star Restaurant Menu \u003c= 2.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "food-and-drink-menu",
    "type": "plugin",
    "affected_version": "* - 2.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29089",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visualizer \u003c= 3.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46848",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Form Builder \u003c= 1.07.11 - SQL Injection",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "* - 1.07.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.07.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9309",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1323",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Payments \u003c= 6.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woocommerce-payments",
    "type": "plugin",
    "affected_version": "* - 6.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49828",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp EMember \u003c 10.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-eMember",
    "type": "plugin",
    "affected_version": "[*, 10.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-5081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5081",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Price History for Omnibus \u003c= 2.1.4 - Authenticated (Shop manager+) PHP Object Injection",
    "slug": "wc-price-history",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22510",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 – Paystack Add-on \u003c= 1.2.3 - Reflected Cross-Site Scripting",
    "slug": "cf7-paystack-add-on",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23655",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailPoet \u003c= 5.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mailpoet",
    "type": "plugin",
    "affected_version": "* - 5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12743",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kalium \u003c= 3.18.3 - Cross-Site Request Forgery",
    "slug": "kalium",
    "type": "theme",
    "affected_version": "* - 3.18.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53347",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Theater for WordPress \u003c= 0.18.7 - Missing Authorization",
    "slug": "theatre",
    "type": "plugin",
    "affected_version": "* - 0.18.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.18.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31846",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content – ProfilePress \u003c= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1409",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Polls \u003c= 2.77.2 - Unauthenticated SQL Injection to Stored Cross-Site Scripting",
    "slug": "wp-polls",
    "type": "plugin",
    "affected_version": "* - 2.77.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.77.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13426",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Slug Translate \u003c= 2.7.2 - Authenticated (Administrator+) Stored Cross-Site Scritping",
    "slug": "simple-slug-translate",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26515",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Syndication Links \u003c 1.0.3 - DOM-based Cross-Site Scripting",
    "slug": "syndication-links",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9495",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dashicons + Custom Post Types \u003c= 1.0.2 - Missing Authorization",
    "slug": "dashicons-cpt",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-22674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22674",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FooGallery \u003c= 2.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Custom URL",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 2.4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2122",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RobotCPA \u003c= 5 - Unauthenticated Local File Inclusion",
    "slug": "robotcpa",
    "type": "plugin",
    "affected_version": "* - 5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9480",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Automation By Autonami \u003c= 3.5.1 - Open Redirect",
    "slug": "wp-marketing-automations",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30795",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "百度分享按钮 \u003c= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "baidushare-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZoxPress - The All-In-One WordPress News Theme \u003c= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion",
    "slug": "zoxpress",
    "type": "theme",
    "affected_version": "* - 2.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13654",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Helpie FAQ \u003c= 1.39 - Unauthenticated Sensitive Information Exposure",
    "slug": "helpie-faq",
    "type": "plugin",
    "affected_version": "* - 1.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58659",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP AdCenter \u003c= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpadcenter",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53278",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Age Gate \u003c= 3.5.4 - Missing Authorization",
    "slug": "age-gate",
    "type": "plugin",
    "affected_version": "* - 3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31012",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multi Step Form \u003c= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "multi-step-form",
    "type": "plugin",
    "affected_version": "* - 1.7.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50832",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rate my Post – WP Rating System \u003c= 3.4.2 - IP Address Spoofing",
    "slug": "rate-my-post",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51667",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Email Subscriber \u003c= 1.1 - Stored Cross-Site Scripting",
    "slug": "email-subscriber",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24556",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c= 8.5.02.005 - Insecure Direct Object Reference",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 8.5.02.005",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.02.005",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49812",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "sliding-door",
    "type": "theme",
    "affected_version": "[*, 3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "decode",
    "type": "theme",
    "affected_version": "* - 3.15.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.15.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "citylogic",
    "type": "theme",
    "affected_version": "[*, 1.1.30)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.30",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "lightning",
    "type": "theme",
    "affected_version": "* - 15.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.18.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "i-max",
    "type": "theme",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "default-mag",
    "type": "theme",
    "affected_version": "[*, 1.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "shopstar",
    "type": "theme",
    "affected_version": "[*, 1.1.34)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.34",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "happenstance",
    "type": "theme",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "emmet-lite",
    "type": "theme",
    "affected_version": "[*, 1.7.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "x-t9",
    "type": "theme",
    "affected_version": "[*, 1.19.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "i-excel",
    "type": "theme",
    "affected_version": "* - 1.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "gridsby",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "sensible-wp",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "namaha",
    "type": "theme",
    "affected_version": "[*, 1.0.41)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.41",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "panoramic",
    "type": "theme",
    "affected_version": "[*, 1.1.57)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.57",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Compress \u003c= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.30.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.30.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2110",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EKC Tournament Manager \u003c= 2.2.1 - Cross-Site Request Forgery to Tournament and Team Creation",
    "slug": "ekc-tournament-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9709",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SupportFlow \u003c= 0.6 - Cross-Site Scripting via a ticket excerpt.",
    "slug": "supportflow",
    "type": "plugin",
    "affected_version": "[*, 0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10970",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultraembed-advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11335",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kush Micro News \u003c= 1.6.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "kush-micro-news",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27314",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.3.5 - Cross-Site Request Forgery",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38470",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.3.2 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6634",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "User Activity Log \u003c= 1.6.2 - Authenticated(Administrator+) SQL Injection via txtsearch",
    "slug": "user-activity-log",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2761",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Arabic Webfonts \u003c= 1.4.6 - Missing Authorization",
    "slug": "arabic-webfonts",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54402",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1500",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BlossomThemes Email Newsletter \u003c= 2.2.4 - Missing Authorization",
    "slug": "blossomthemes-email-newsletter",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47849",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Newspack Ads \u003c= 1.47.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "newspack-ads",
    "type": "plugin",
    "affected_version": "* - 1.47.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.47.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37474",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.3 - Reflected Cross-Site Scripting via ip",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4214",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Counterpoint \u003c= 1.8.1 - Reflected Cross-Site Scripting",
    "slug": "counterpoint",
    "type": "theme",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search in Place \u003c= 1.0.104 - Missing Authorization to Feedback Submission",
    "slug": "search-in-place",
    "type": "plugin",
    "affected_version": "* - 1.0.104",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.104",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26521",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lets-Box \u003c 1.15.3 - Reflected Cross-Site Scripting",
    "slug": "lets-box",
    "type": "plugin",
    "affected_version": "[*, 1.15.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-42549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42549",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More \u003c 3.3.1.0 - Authenticated SQL Injection via product_id Parameter",
    "slug": "purple-xmls-google-product-feed-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 3.3.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24511",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Cart Count Shortcode \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woo-cart-count-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12517",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Article Directory \u003c= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'publish_terms_text'",
    "slug": "article-directory",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0422",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Astra \u003c= 4.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Theme Header/Footer",
    "slug": "astra",
    "type": "theme",
    "affected_version": "* - 4.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29768",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 5.10 - Missing Authorization to Information Disclosure",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "[*, 5.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-20865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20865",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 5.10 - Missing Authorization to Information Disclosure",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "[*, 5.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-20865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20865",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP DeskLite – Helpdesk and Support Plugin \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-desklite",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12724",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GD Rating System \u003c 2.1 - Reflected Cross-Site Scripting",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18591",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoices \u0026 Packing Slips \u003c= 3.2.5 - Cross Site Request Forgery",
    "slug": "woocommerce-pdf-invoices-packing-slips",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47148",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SetSail Membership \u003c= 1.0.3 - Authentication Bypass via Account Takeover",
    "slug": "setsail-membership",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1564",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Smart TV \u003c= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-smart-tv",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yet Another Stars Rating \u003c= 3.3.8 - Missing Authorization to Vote Tampering",
    "slug": "yet-another-stars-rating",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37867",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.3.03 - Missing Authorization",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56217",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Radio Player \u003c= 2.0.73 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "* - 2.0.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29811",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SwipeHQ Payment Gateway WooCommerce \u003c= 2.7.1 - Reflected Cross-Site Scripting",
    "slug": "swipehq-payment-gateway-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4558",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopBuilder – Elementor WooCommerce Builder Addons \u003c= 2.1.8 - Unauthenticated Sensitive Information Exposure",
    "slug": "shopbuilder",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34812",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.1.17 - Reflected Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24368",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Carousel Slider for Elementor \u003c= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Function",
    "slug": "post-carousel-slider-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3863",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Map Block Leaflet \u003c= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter",
    "slug": "map-block-leaflet",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5122",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uptime Robot \u003c= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "uptime-robot",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22582",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales \u0026 More \u003c= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "storeengine",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9216",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-PostRatings Cheater \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "wp-postratings-cheater",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27328",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Luzuk Team \u003c= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "luzuk-team",
    "type": "plugin",
    "affected_version": "* - 0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51871",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML Forms \u003c= 1.3.24 - Authenticated (Administrator+) SQL Injection",
    "slug": "html-forms",
    "type": "plugin",
    "affected_version": "* - 1.3.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3689",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "myCred – Points, Rewards, Gamification, Ranks, Badges \u0026 Loyalty Plugin \u003c= 2.4.3 -  Missing Authorization",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "[*, 2.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0363",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.16.1 - Unauthenticated PHP Object Injection",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.16.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8353",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LoginPress \u003c= 1.5.11 - Reflected Cross-Site Scripting via redirect-page Parameter",
    "slug": "loginpress",
    "type": "plugin",
    "affected_version": "[*, 1.5.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0347",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All In One Redirection \u003c= 2.2.0 - Reflected Cross-Site Scripting",
    "slug": "all-in-one-redirection",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37245",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register \u003c= 3.8.2.2 - Open Redirect",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "* - 3.8.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0552",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinboard \u003c= 1.1.10 - Cross-Site Scripting",
    "slug": "pinboard",
    "type": "theme",
    "affected_version": "* - 1.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-0286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-0286",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.44 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22659",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AN_GradeBook \u003c= 5.0.1 - Authenticated (Subscriber+) SQL Injection via 'id'",
    "slug": "an-gradebook",
    "type": "plugin",
    "affected_version": "* - 5.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2636",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Templately \u003c= 3.2.7 - Authenticated (Author+) Information Disclosure",
    "slug": "templately",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49408",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Send PDF for Contact Form 7 \u003c= 0.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "send-pdf-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 0.9.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0143",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction \u0026 Membership Plugin 2.1.3 - 2.8.2 - Unauthenticated SQL Injection",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "2.1.3 - 2.8.2",
    "from_version": "2.1.3",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-1071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1071",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Photo Reviews - Review Reminders - Review for Discounts \u003c= 1.3.13 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-photo-reviews",
    "type": "plugin",
    "affected_version": "* - 1.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47570",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Iconize \u003c= 1.2.4 - Authenticated (Admin+) Remote Code Execution",
    "slug": "iconize",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-47649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47649",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "tagDiv Composer \u003c= 5.3 - Reflected Cross-Site Scripting via 'data'",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2806",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ask Me \u003c= 6.8.1 - Cross-Site Request Forgery",
    "slug": "ask-me",
    "type": "theme",
    "affected_version": "[*, 6.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1424",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery – Photo Contest Plugin for WordPress \u003c= 10.4.4 - Cross-Site Request Forgery",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 10.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-5974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5974",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Store Kit Elementor Addons \u003c= 2.0.3 - Unauthenticated PHP Object Injection",
    "slug": "ultimate-store-kit",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4606",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Active Products Tables for WooCommerce \u003c= 1.0.6.7 -  Unauthenticated Arbitrary Filter Call",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1514",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "My Content Management \u003c= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "my-content-management",
    "type": "plugin",
    "affected_version": "[*, 1.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-34377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34377",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hardening – Fix Your WordPress Security \u003c= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration",
    "slug": "wp-security-hardening",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6641",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WC Vendors Marketplace \u003c= 2.5.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "wc-vendors",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49263",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Charts \u003c= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-charts",
    "type": "plugin",
    "affected_version": "* - 0.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5062",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "month name translation benaceur \u003c= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "month-name-translation-benaceur",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3634",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tainacan \u003c= 0.20.4 - Reflected Cross-Site Scripting",
    "slug": "tainacan",
    "type": "plugin",
    "affected_version": "* - 0.20.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.20.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47848",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Picture Gallery \u003c= 1.6.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "picture-gallery",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26581",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maspik – Spam blacklist \u003c= 2.2.7 - Cross-Site Request Forgery to Plugin Settings Change",
    "slug": "contact-forms-anti-spam",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53806",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rank Math SEO – AI SEO Tools to Dominate SEO Rankings \u003c= 1.0.228 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.228",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.228",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9314",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sermon'e – Sermons Online \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "sermone-online-sermons-management",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41653",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Oshine Core \u003c= 1.5.5 - Missing Authorization",
    "slug": "oshine-core",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58660",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Themify Icons \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themify-icons",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51693",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Video Robot - The Ultimate Video Importer \u003c= 1.20.0 - Reflected Cross-Site Scripting",
    "slug": "wp-video-robot",
    "type": "plugin",
    "affected_version": "* - 1.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39409",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Edit Delete Listing Module \u003c= 1.0 - SQL Injection",
    "slug": "add-edit-delete-listing-for-member-module",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1002025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002025",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ID-SK Toolkit \u003c= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "idsk-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50517",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TuriTop Booking System \u003c= 1.0.10 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "turitop-booking-system",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32571",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Registration Magic \u003c= 5.0.1.8 - Reflected Cross-Site Scripting",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.0.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24648",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BasePress Migration Tools \u003c= 1.0.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "basepress-migration-tools",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52407",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wp Ultimate Review \u003c= 2.2.5 - Unauthenticated Insecure Direct Object Reference",
    "slug": "wp-ultimate-review",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32683",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Map No Api \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter",
    "slug": "simple-map-no-api",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13565",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Social Media Links \u003c= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "floating-social-media-links",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37545",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Build \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "build",
    "type": "theme",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26869",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icons Factory \u003c= 1.6.12 - Missing Authorization to Unauthenticated Arbitrary File Deletion via delete_files() Function",
    "slug": "icons-factory",
    "type": "plugin",
    "affected_version": "* - 1.6.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7778",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spa and Salon \u003c= 1.2.7 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "spa-and-salon",
    "type": "theme",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31384",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dhivehi Text \u003c= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dhivehi-text",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10132",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CopySafe Web Protection \u003c= 3.13 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-copysafe-web",
    "type": "plugin",
    "affected_version": "* - 3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-29098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29098",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fusion \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fusion",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37962",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Webapp builder 2.0 - Arbitrary File Upload",
    "slug": "webapp-builder",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002002",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mollie Forms \u003c= 2.6.13 - Cross-Site Request Forgery to Arbitrary Post Duplication",
    "slug": "mollie-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2368",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Button Generator – easily Button Builder \u003c= 2.3.5 - Cross-Site Request Forgery in tools-data-base.php",
    "slug": "button-generation",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25443",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "2.9.36 - 2.9.42",
    "from_version": "2.9.36",
    "from_inclusive": true,
    "to_version": "2.9.42",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-1209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1209",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Activity Log \u003c= 1.2.4 - Cross-Site Request Forgery",
    "slug": "wp-security-audit-log",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-5072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5072",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Trackserver \u003c= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "trackserver",
    "type": "plugin",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12505",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Novelist \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Book Information Fields",
    "slug": "novelist",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32958",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shopify \u003c= 1.5.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-shopify",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30999",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Squeeze \u003c= 1.6 - Authenticated (Admin+) Full Path Disclosure",
    "slug": "squeeze",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-31003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31003",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Pinpoint Booking System \u003c= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "* - 2.9.9.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7112",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sticky Ad Bar \u003c= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "sticky-ad-bar",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25784",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elegant Addons for elementor \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Switcher, Slider, and Iconbox Widgets",
    "slug": "elegant-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hover Video Preview \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hover-video-preview",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50552",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode \u003c= 1.7 -  Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "paypal-pay-buy-donation-and-cart-buttons-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5448",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Gravity Forms Zendesk \u003c= 1.1.2 - Open Redirect",
    "slug": "gf-zendesk",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47456",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Autoship Cloud for WooCommerce Subscription Products \u003c= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "autoship-cloud",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13461",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stackable \u003c= 3.18.1 - Missing Authorization",
    "slug": "stackable-ultimate-gutenberg-blocks",
    "type": "plugin",
    "affected_version": "* - 3.18.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60094",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Courses \u003c= 2.0.28 - Improper Access Controls",
    "slug": "wp-courses",
    "type": "plugin",
    "affected_version": "* - 2.0.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-26876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-26876",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Category Posts Widget \u003c= 4.9.19 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "category-posts",
    "type": "plugin",
    "affected_version": "* - 4.9.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1453",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI for SEO \u003c= 1.2.9 - Missing Authorization",
    "slug": "ai-for-seo",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22299",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Payment Form for PayPal Pro \u003c= 1.1.72 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "payment-form-for-paypal-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39562",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XV Random Quotes \u003c= 1.37 - Reflected Cross-Site Scripting",
    "slug": "xv-random-quotes",
    "type": "plugin",
    "affected_version": "* - 1.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31903",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ND Shortcodes \u003c= 7.5 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "nd-shortcodes",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5220",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Login New User After Registration \u003c= 1.9.6 - Cross-Site Request Forgery to Settings Modification",
    "slug": "auto-login-new-user-after-registration",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46202",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1572",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cliengo - Chatbot \u003c= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update",
    "slug": "cliengo",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5992",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "iFrame \u003c= 4.0 - Stored Cross-Site Scripting",
    "slug": "iframe",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-6738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6738",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBookit \u003c= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wpbookit",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6057",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "gAppointments \u003c= 1.9.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gAppointments",
    "type": "plugin",
    "affected_version": "* - 1.9.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2707",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "yet-another-stars-rating",
    "type": "plugin",
    "affected_version": "1.4.4 - 3.4.1",
    "from_version": "1.4.4",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "events-addon-for-elementor",
    "type": "plugin",
    "affected_version": "1.8.4 - 2.0.2",
    "from_version": "1.8.4",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers",
    "type": "plugin",
    "affected_version": "1.8 - 2.1.4",
    "from_version": "1.8",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "reader-mode",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "awesome-social-icons",
    "type": "plugin",
    "affected_version": "2.0",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "acf-blocks",
    "type": "plugin",
    "affected_version": "1.0.0 - 2.6.9",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ultimeter",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "past-events-extension",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "easy-order-view",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "pootle-page-builder",
    "type": "plugin",
    "affected_version": "2.0.0 - 5.7.1",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "easy-call-now-button",
    "type": "plugin",
    "affected_version": "1.0.5",
    "from_version": "1.0.5",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bootstrap-fitness",
    "type": "theme",
    "affected_version": "1.0.5",
    "from_version": "1.0.5",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "guest-author-affiliate",
    "type": "plugin",
    "affected_version": "1.1.4",
    "from_version": "1.1.4",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "local-delivery-drivers-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.8.9",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ultimate-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sv-media-library",
    "type": "plugin",
    "affected_version": "* - 1.9.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "required-taxonomies",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "featured-products-first-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0 - 1.9.5",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ssl-zen",
    "type": "plugin",
    "affected_version": "* - 4.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "check-zipcode",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "nova-poshta-ttn",
    "type": "plugin",
    "affected_version": "* - 1.7.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "streak-crm-for-gmail-integration-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "5-stars-rating-funnel",
    "type": "plugin",
    "affected_version": "* - 1.2.62",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.62",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "simple-author-box",
    "type": "plugin",
    "affected_version": "* - 2.3.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "kenta-blocks",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.3.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "dancepress-trwa",
    "type": "plugin",
    "affected_version": "1.181106 - 2.4.5",
    "from_version": "1.181106",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "embed-docs",
    "type": "plugin",
    "affected_version": "2.0.1 - 3.0.0",
    "from_version": "2.0.1",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-advanced-product-size-chart",
    "type": "plugin",
    "affected_version": "2.0.1 - 2.4.3",
    "from_version": "2.0.1",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "section-slider",
    "type": "plugin",
    "affected_version": "0.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-my-admin-bar",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.1.0",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "patch-lite",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "setka-editor",
    "type": "plugin",
    "affected_version": "1.9.1 - 2.1.19",
    "from_version": "1.9.1",
    "from_inclusive": true,
    "to_version": "2.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "olivewp-companion",
    "type": "plugin",
    "affected_version": "1.0 - 1.1.2",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "easy-prayer",
    "type": "plugin",
    "affected_version": "1.0 - 1.2",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "contact-form-7-skins",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "exportfeed-for-woocommerce-product-to-etsy",
    "type": "plugin",
    "affected_version": "* - 5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "auto-terms-of-service-and-privacy-policy",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "raise-prices-with-sales-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "server-info",
    "type": "plugin",
    "affected_version": "2.5.1 - 2.5.3",
    "from_version": "2.5.1",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ai-image-generator",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-google-places-review-slider",
    "type": "plugin",
    "affected_version": "11.2 - 12.5",
    "from_version": "11.2",
    "from_inclusive": true,
    "to_version": "12.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "pagemanager",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "simple-cart-solution",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "page-visit-counter",
    "type": "plugin",
    "affected_version": "6.0 - 6.0.8",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "add-fields-to-checkout-page-woocommerce",
    "type": "plugin",
    "affected_version": "1.2.7 - 1.2.9",
    "from_version": "1.2.7",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "dracula-dark-mode",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "tori-ajax",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.0.2",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "search-console",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "scrollbar-customizer",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "julia-lite",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-rest-filter",
    "type": "plugin",
    "affected_version": "1.4.0 - 1.4.3",
    "from_version": "1.4.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "panorama",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bulk-attachment-download",
    "type": "plugin",
    "affected_version": "1.2.1 - 1.3.6",
    "from_version": "1.2.1",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "autosave-net",
    "type": "plugin",
    "affected_version": "1.3.0 - 1.3.4",
    "from_version": "1.3.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "resermy",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "premmerce-woocommerce-wholesale-pricing",
    "type": "plugin",
    "affected_version": "1.0 - 1.1.9",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wep-demo-import",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "content-hubs",
    "type": "plugin",
    "affected_version": "1.0.6 - 1.0.8",
    "from_version": "1.0.6",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "better-captcha-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 0.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woocommerce-product-payments",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.2.6",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "hqtheme-extra",
    "type": "plugin",
    "affected_version": "1.0.6 - 1.0.19",
    "from_version": "1.0.6",
    "from_inclusive": true,
    "to_version": "1.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "mobile-pages",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.2",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woocommerce-eu-vat-assistant",
    "type": "plugin",
    "affected_version": "2.0.19.210629 - 2.0.42.230503",
    "from_version": "2.0.19.210629",
    "from_inclusive": true,
    "to_version": "2.0.42.230503",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gutenslider",
    "type": "plugin",
    "affected_version": "2.6.3 - 5.10.1",
    "from_version": "2.6.3",
    "from_inclusive": true,
    "to_version": "5.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "moose-elementor-kit",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "child-support-calculator",
    "type": "plugin",
    "affected_version": "1.0.1 - 2.0.1.2",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "2.0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gs-behance-portfolio",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.0.1",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "multilevel-referral-plugin-for-woocommerce",
    "type": "plugin",
    "affected_version": "2.22",
    "from_version": "2.22",
    "from_inclusive": true,
    "to_version": "2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "mega-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "surbma-magyar-woocommerce",
    "type": "plugin",
    "affected_version": "* - 30.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "30.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "checkbox",
    "type": "plugin",
    "affected_version": "* - 0.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "kvoucher",
    "type": "plugin",
    "affected_version": "1.0 - 1.1.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "pramadillo-activecampaign-email-preference-center",
    "type": "plugin",
    "affected_version": "1.0.0 - 2.0.11",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "custom-welcome-guide",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "yt-player",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "product-layouts",
    "type": "plugin",
    "affected_version": "1.0.2 - 1.1.3",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "staggs",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.4.1",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wpmm-memory-meter",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.3.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-signals",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "enhanced-catalog-images-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.1",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "flexible-faqs",
    "type": "plugin",
    "affected_version": "0.5.5 - 0.5.11",
    "from_version": "0.5.5",
    "from_inclusive": true,
    "to_version": "0.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "videoblog",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "error-log-monitor",
    "type": "plugin",
    "affected_version": "1.6 - 1.7.6",
    "from_version": "1.6",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "premmerce-woocommerce-multi-currency",
    "type": "plugin",
    "affected_version": "2.0 - 2.3.4",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "where-did-they-go-from-here",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "booking-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 4.3.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-event-partners",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.5",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woosquare",
    "type": "plugin",
    "affected_version": "1.5 - 4.2.8",
    "from_version": "1.5",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "unlimited-theme-addons",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "buddyforms-remote",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "startend-subscription-add-on-for-gravityforms",
    "type": "plugin",
    "affected_version": "[*, 4.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "corporate-event",
    "type": "theme",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "add-expires-headers",
    "type": "plugin",
    "affected_version": "2.0 - 2.7.3",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "forcefield",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.0.6",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "featured-image-toolkit",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-conditional-discount-rules-for-checkout",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.3.3",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "1.9.10.72 - 2.1.17",
    "from_version": "1.9.10.72",
    "from_inclusive": true,
    "to_version": "2.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ajax-add-to-cart-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.2",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cf7-grid-and-styler-for-divi",
    "type": "plugin",
    "affected_version": "1.0.2 - 1.4.2",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "prime-affiliate-links",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "audio-text",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "yummy-recipes",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.2.0",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "protect-uploads-with-login-page",
    "type": "plugin",
    "affected_version": "1.4 - 1.8",
    "from_version": "1.4",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "atlas-knowledge-base",
    "type": "plugin",
    "affected_version": "1.0.0 - 6.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-advance-comment",
    "type": "plugin",
    "affected_version": "0.3",
    "from_version": "0.3",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "remove-duplicate-posts",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "simple-sitemap",
    "type": "plugin",
    "affected_version": "3.2 - 3.5.9",
    "from_version": "3.2",
    "from_inclusive": true,
    "to_version": "3.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "menukaart",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-private-media",
    "type": "plugin",
    "affected_version": "1.0 - 1.0.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "jobwp",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "super-video-player",
    "type": "plugin",
    "affected_version": "* - 2.6.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-books-gallery",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "1-click-close-store",
    "type": "plugin",
    "affected_version": "1.1.0",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "free-shipping-label",
    "type": "plugin",
    "affected_version": "2.5.0 - 2.6.9",
    "from_version": "2.5.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ajax-search-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.1.7 - 1.24.0",
    "from_version": "1.1.7",
    "from_inclusive": true,
    "to_version": "1.24.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "tag-groups",
    "type": "plugin",
    "affected_version": "1.18.3 - 1.44.3.1",
    "from_version": "1.18.3",
    "from_inclusive": true,
    "to_version": "1.44.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "devices",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "buddyforms-ultimate-member",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "delivery-drivers-manager",
    "type": "plugin",
    "affected_version": "1.0.3 - 1.1.8",
    "from_version": "1.0.3",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "consultpress-lite",
    "type": "theme",
    "affected_version": "1.2.0 - 1.2.3",
    "from_version": "1.2.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cf7-styler-for-divi",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "moceansms-order-sms-notification-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.3.12 - 1.4.8",
    "from_version": "1.3.12",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "zip-codes-redirect",
    "type": "plugin",
    "affected_version": "1.0.1 - 5.1.1",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "guestofy-restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "flight-search-widget-blocks",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cf7-constant-contact-fields-mapping",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "free-product-sample",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bookit",
    "type": "plugin",
    "affected_version": "* - 2.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "redirect-404-error-page-to-homepage-or-custom-page",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ethereumico",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.4.3",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "tec-subscriber-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "rt-easy-builder-advanced-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-contact-slider",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "purple-xmls-google-product-feed-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woocommerce-country-based-payments",
    "type": "plugin",
    "affected_version": "1.2.0 - 1.4.3",
    "from_version": "1.2.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fast-index",
    "type": "plugin",
    "affected_version": "1.0 - 1.6",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "filr-protection",
    "type": "plugin",
    "affected_version": "* - 1.2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "elasta",
    "type": "theme",
    "affected_version": "1.0.4 - 1.0.8",
    "from_version": "1.0.4",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "interactive-geo-maps",
    "type": "plugin",
    "affected_version": "1.0.5 - 1.5.11",
    "from_version": "1.0.5",
    "from_inclusive": true,
    "to_version": "1.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "animate-everything",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "2mb-autocode",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "publishpress",
    "type": "plugin",
    "affected_version": "1.3.0 - 1.9.4",
    "from_version": "1.3.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "activity-log-mainwp",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "connected-sermons",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bulk-edit-user-profiles-in-spreadsheet",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.5.23",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.5.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "responsive-accordion-tabs",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "yandex-money-button",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fb-account-kit-login",
    "type": "plugin",
    "affected_version": "1.1.4 - 1.2.3",
    "from_version": "1.1.4",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "affiliate-advantage",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "moceanapi-abandoned-carts",
    "type": "plugin",
    "affected_version": "1.2.0",
    "from_version": "1.2.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bulk-woocommerce-category-creator",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-cloud-server",
    "type": "plugin",
    "affected_version": "1.3.0",
    "from_version": "1.3.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "pickup-and-delivery-from-customer-locations-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.4",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "spice-post-slider",
    "type": "plugin",
    "affected_version": "1.1 - 1.9",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-awesome-faq",
    "type": "plugin",
    "affected_version": "4.1.5 - 4.1.8",
    "from_version": "4.1.5",
    "from_inclusive": true,
    "to_version": "4.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "rss-chimp",
    "type": "plugin",
    "affected_version": "1.0 - 1.2.3",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "2.0.1 - 7.7.1",
    "from_version": "2.0.1",
    "from_inclusive": true,
    "to_version": "7.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "premmerce-woocommerce-pinterest",
    "type": "plugin",
    "affected_version": "1.1 - 1.2.3",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wc-place-order-without-payment",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "super-transactional-emails-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.2.3 - 1.2.4",
    "from_version": "1.2.3",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "buddyforms-attach-posts-to-groups-extension",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "my-instagram-feed",
    "type": "plugin",
    "affected_version": "1.0.0 - 3.1.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "disable-dashboard-for-woocommerce",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.2.8",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-radio",
    "type": "plugin",
    "affected_version": "2.0.7 - 3.1.9",
    "from_version": "2.0.7",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bng-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "business-profile-reviews",
    "type": "plugin",
    "affected_version": "1.0 - 1.0.2",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "book-press",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "qyrr-code",
    "type": "plugin",
    "affected_version": "1.2 - 1.3",
    "from_version": "1.2",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "website-testimonials",
    "type": "plugin",
    "affected_version": "6.1.0",
    "from_version": "6.1.0",
    "from_inclusive": true,
    "to_version": "6.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "salt-shaker",
    "type": "plugin",
    "affected_version": "1.4.1",
    "from_version": "1.4.1",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "phraseanet-client",
    "type": "plugin",
    "affected_version": "1.2.0 - 1.3.11",
    "from_version": "1.2.0",
    "from_inclusive": true,
    "to_version": "1.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "3.2.9 - 3.3.8.4",
    "from_version": "3.2.9",
    "from_inclusive": true,
    "to_version": "3.3.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "web-disrupt-funnelmentals",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "blockspare",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "forms-to-zapier",
    "type": "plugin",
    "affected_version": "* - 1.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "buddyforms-hierarchical-posts",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 2.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ti-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bingopress",
    "type": "theme",
    "affected_version": "* - 1.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gfirem-fields",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "yuki",
    "type": "theme",
    "affected_version": "1.0.0 - 1.3.7",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-coupon-usage",
    "type": "plugin",
    "affected_version": "* - 5.5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-conditional-post-restrictions",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-attest",
    "type": "plugin",
    "affected_version": "1.0 - 1.7.4",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "acf-frontend-form-element",
    "type": "plugin",
    "affected_version": "* - 3.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "different-home-for-logged-in-logged-out",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.3.3",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "giveasap",
    "type": "plugin",
    "affected_version": "* - 2.46.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.46.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "enjoy-instagram-instagram-responsive-images-gallery-and-carousel",
    "type": "plugin",
    "affected_version": "* - 6.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wptools-masonry-gallery-posts-for-divi",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.5.0",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "tk-event-weather",
    "type": "plugin",
    "affected_version": "1.0 - 1.6.6",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "one-page-conference",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "edd-tab-manager",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "animated-svg",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-ukrposhta",
    "type": "plugin",
    "affected_version": "* - 1.6.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "download-magnet",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.2.0",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "annasta-woocommerce-product-filters",
    "type": "plugin",
    "affected_version": "1.0.5 - 1.6.3",
    "from_version": "1.0.5",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-lead-stream",
    "type": "plugin",
    "affected_version": "1.1 - 1.2",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "custom-product-type-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.2",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "lifestyle-magazine",
    "type": "theme",
    "affected_version": "10.2.0",
    "from_version": "10.2.0",
    "from_inclusive": true,
    "to_version": "10.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "4.9.0 - 5.16.4",
    "from_version": "4.9.0",
    "from_inclusive": true,
    "to_version": "5.16.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "email-tracker",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "block-styler-for-gravity-forms",
    "type": "plugin",
    "affected_version": "5.0.0 - 6.2.1",
    "from_version": "5.0.0",
    "from_inclusive": true,
    "to_version": "6.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "custom-page-templates-by-vegacorp",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.13",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wc-product-customer-list",
    "type": "plugin",
    "affected_version": "2.6.7 - 3.1.4",
    "from_version": "2.6.7",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-moose",
    "type": "theme",
    "affected_version": "0.0.1 - 1.0.6",
    "from_version": "0.0.1",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gs-team-members",
    "type": "plugin",
    "affected_version": "1.8 - 2.2.1",
    "from_version": "1.8",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "demomentsomtres-mailchimp-immediate-send",
    "type": "plugin",
    "affected_version": "2.9 - 3.201704251244",
    "from_version": "2.9",
    "from_inclusive": true,
    "to_version": "3.201704251244",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "floating-links",
    "type": "plugin",
    "affected_version": "3.4.0 - 3.6.0",
    "from_version": "3.4.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "travel-tour",
    "type": "theme",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "south-pole-the-offset-movement",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.3.2",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "demomentsomtres-mailchimp-subscribe",
    "type": "plugin",
    "affected_version": "2.0 - 3.201706150908",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "3.201706150908",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "hire-me-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "a-staff",
    "type": "plugin",
    "affected_version": "1.2 - 1.2.2",
    "from_version": "1.2",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "littlebot-invoices",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "genealogical-tree",
    "type": "plugin",
    "affected_version": "* - 2.2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "new-order-popup",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cozy-addons",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "automatic-youtube-gallery",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wc-thanks-redirect",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "tablepress",
    "type": "plugin",
    "affected_version": "2.0 - 2.1.4",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "easy-marijuana-age-verify",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woocommerce-upcoming-product",
    "type": "plugin",
    "affected_version": "* - 1.5.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "simple-blueprint-installer",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "frontend-admin",
    "type": "plugin",
    "affected_version": "* - 3.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fullworks-directory",
    "type": "plugin",
    "affected_version": "1.0 - 1.0.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sv-tracking-manager",
    "type": "plugin",
    "affected_version": "* - 1.9.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-easy-pay",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "chained",
    "type": "theme",
    "affected_version": "1.1 - 2.0.0",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "seo-checklist",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.0.2",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 2.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-tools-divi-product-carousel",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.5.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "front-editor",
    "type": "plugin",
    "affected_version": "3.0.0 - 4.0.0",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "stackable-ultimate-gutenberg-blocks",
    "type": "plugin",
    "affected_version": "0.1 - 3.9.0",
    "from_version": "0.1",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "travel-agency-booking",
    "type": "theme",
    "affected_version": "1.0.6",
    "from_version": "1.0.6",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "spice-blocks",
    "type": "plugin",
    "affected_version": "0.3 - 1.2.1",
    "from_version": "0.3",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "slp-gravity-forms-locations",
    "type": "plugin",
    "affected_version": "5.5.1 - 6.1.1",
    "from_version": "5.5.1",
    "from_inclusive": true,
    "to_version": "6.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "five-star-ratings-shortcode",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.47",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.47",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "advanced-nocaptcha-recaptcha",
    "type": "plugin",
    "affected_version": "* - 7.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "demomentsomtres-wp-export",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "premmerce-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "1.0 - 1.1.9",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 8.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "delivery-and-pickup-scheduling-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "surbma-gdpr-proof-google-analytics",
    "type": "plugin",
    "affected_version": "3.0 - 17.7.0",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "17.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "advance-menu-manager",
    "type": "plugin",
    "affected_version": "3.0.1 - 3.0.5",
    "from_version": "3.0.1",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "anycomment",
    "type": "plugin",
    "affected_version": "* - 0.0.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.98",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-live-tv",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "market-exporter",
    "type": "plugin",
    "affected_version": "1.0.5 - 2.0.18",
    "from_version": "1.0.5",
    "from_inclusive": true,
    "to_version": "2.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "adminify",
    "type": "plugin",
    "affected_version": "1.0.0 - 3.1.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sv-columns-manager",
    "type": "plugin",
    "affected_version": "* - 1.9.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "nofollow-jquery-links",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-hr-gdpr",
    "type": "plugin",
    "affected_version": "0.1 - 0.9",
    "from_version": "0.1",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "acf-vc-integrator",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "studiocart",
    "type": "plugin",
    "affected_version": "1.0.2 - 2.5.11",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "2.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "tk-google-fonts",
    "type": "plugin",
    "affected_version": "* - 2.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "starfish-reviews",
    "type": "plugin",
    "affected_version": "2.1.0 - 3.0.36",
    "from_version": "2.1.0",
    "from_inclusive": true,
    "to_version": "3.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "education-addon",
    "type": "plugin",
    "affected_version": "1.0 - 1.3.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "pixigo",
    "type": "theme",
    "affected_version": "1.0.7 - 1.0.16",
    "from_version": "1.0.7",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sv-provenexpert",
    "type": "plugin",
    "affected_version": "* - 1.9.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "conditional-payments",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.1.2",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "geounit-maps",
    "type": "plugin",
    "affected_version": "0.0.6",
    "from_version": "0.0.6",
    "from_inclusive": true,
    "to_version": "0.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "spicebox",
    "type": "plugin",
    "affected_version": "2.1.2 - 2.1.5",
    "from_version": "2.1.2",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "advanced-classifieds-and-directory-pro",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bulk-edit-events",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.20",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "music-player-for-elementor",
    "type": "plugin",
    "affected_version": "1.5 - 1.5.9.8",
    "from_version": "1.5",
    "from_inclusive": true,
    "to_version": "1.5.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cryptocurrency-product-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.16.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "open-user-map",
    "type": "plugin",
    "affected_version": "* - 1.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "next-order-coupon-woocommerce",
    "type": "plugin",
    "affected_version": "* - 0.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "eroom-zoom-meetings-webinar",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "overlay-image-divi-module",
    "type": "plugin",
    "affected_version": "1.2 - 1.3.2",
    "from_version": "1.2",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "email-header-footer",
    "type": "plugin",
    "affected_version": "1.1 - 1.2.1",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-custom-field-for-gutenberg-editor",
    "type": "plugin",
    "affected_version": "1.3 - 1.7.1",
    "from_version": "1.3",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-phone-message",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.1.1",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "embed-office-viewer",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "price-bands-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.2 - 1.0.4",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "block-options",
    "type": "plugin",
    "affected_version": "* - 1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.11.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "perelandra-sermons",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "smart-variations-images",
    "type": "plugin",
    "affected_version": "4.0.1 - 5.2.7",
    "from_version": "4.0.1",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "brasserie",
    "type": "theme",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "featured-images-for-rss-feeds",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "simple-sponsorships",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "mobile-app-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.74",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.74",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "joli-table-of-contents",
    "type": "plugin",
    "affected_version": "1.0.0 - 2.0.9",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "youram-youtube-embed",
    "type": "plugin",
    "affected_version": "8.0 - 10.3",
    "from_version": "8.0",
    "from_inclusive": true,
    "to_version": "10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "backup-bolt",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.1.3",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-store-locator-extenders",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.3.2",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sparrow",
    "type": "plugin",
    "affected_version": "2.0.2",
    "from_version": "2.0.2",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "auto-advance-for-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "magic-post-thumbnail",
    "type": "plugin",
    "affected_version": "2.4.3 - 4.1.12",
    "from_version": "2.4.3",
    "from_inclusive": true,
    "to_version": "4.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "live-scores-for-sportspress",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "internallink-audit",
    "type": "plugin",
    "affected_version": "0.1.0",
    "from_version": "0.1.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "hide-shipping-method-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.3.2",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ultimate-carousel-for-divi",
    "type": "plugin",
    "affected_version": "4.0.0 - 4.5.0",
    "from_version": "4.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "blocks-bakery",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.12",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "seo-optimized-images",
    "type": "plugin",
    "affected_version": "2.0",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "image-carousel-for-divi",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.6.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "comments-not-replied-to",
    "type": "plugin",
    "affected_version": "1.5.0 - 1.5.7",
    "from_version": "1.5.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "integration-of-capsule-crm-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "eazydocs",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "opensea",
    "type": "plugin",
    "affected_version": "1.0 - 1.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "tranzly",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woocommerce-google-adwords-conversion-tracking-tag",
    "type": "plugin",
    "affected_version": "1.6.17 - 1.32.2",
    "from_version": "1.6.17",
    "from_inclusive": true,
    "to_version": "1.32.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "modern-addons-elementor",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.2.0",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "slp-extended-data-manager",
    "type": "plugin",
    "affected_version": "5.5.1 - 6.1.1",
    "from_version": "5.5.1",
    "from_inclusive": true,
    "to_version": "6.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "viralike",
    "type": "theme",
    "affected_version": "1.0.4 - 1.0.6",
    "from_version": "1.0.4",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "medicpress-lite",
    "type": "theme",
    "affected_version": "* - 0.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-munich-blocks",
    "type": "plugin",
    "affected_version": "* - 0.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "date-time-picker-field",
    "type": "plugin",
    "affected_version": "1.9 - 2.2",
    "from_version": "1.9",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "faq-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "eighteen-tags",
    "type": "theme",
    "affected_version": "2.5.0 - 3.1.0",
    "from_version": "2.5.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "kenta-companion",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.8",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cyclone-blog",
    "type": "theme",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "issues-tracker",
    "type": "plugin",
    "affected_version": "1.0.3 - 1.2.2",
    "from_version": "1.0.3",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "mrkwp-footer-for-divi",
    "type": "plugin",
    "affected_version": "3.3.2 - 3.3.5",
    "from_version": "3.3.2",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-stripe-donation",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-native-articles",
    "type": "plugin",
    "affected_version": "1.1.6",
    "from_version": "1.1.6",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "new-user-approve",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gfirem-advance-search",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "shared-files",
    "type": "plugin",
    "affected_version": "1.6.23 - 1.6.99",
    "from_version": "1.6.23",
    "from_inclusive": true,
    "to_version": "1.6.99",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "smart-phone-field-for-gravity-forms",
    "type": "plugin",
    "affected_version": "2.0",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "speculor",
    "type": "theme",
    "affected_version": "1.2.0",
    "from_version": "1.2.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "remove-wp-update-nags",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "send-users-email",
    "type": "plugin",
    "affected_version": "1.2.0 - 1.4.0",
    "from_version": "1.2.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "auto-keyword-backlink",
    "type": "plugin",
    "affected_version": "1.0 - 1.3",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "everse-starter-sites",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "delivery-drivers-for-vendors",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.1.0",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "1.0.6 - 2.0.2",
    "from_version": "1.0.6",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "choice-payment-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.3 - 2.2.2",
    "from_version": "1.0.3",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "domain-mapping-system",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "order-and-inventory-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-cron-status-checker",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "customizely",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.1.1",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "1.3.29 - 2.2.41",
    "from_version": "1.3.29",
    "from_inclusive": true,
    "to_version": "2.2.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "shortcodehub",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "payment-gateway-groups-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "forms-for-divi",
    "type": "plugin",
    "affected_version": "8.1.2",
    "from_version": "8.1.2",
    "from_inclusive": true,
    "to_version": "8.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "expandable-paywall",
    "type": "plugin",
    "affected_version": "1.1.1 - 2.0.16",
    "from_version": "1.1.1",
    "from_inclusive": true,
    "to_version": "2.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "tiny-bar",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "change-wc-price-title",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "edge-gallery",
    "type": "plugin",
    "affected_version": "1.1 - 2.0.4",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "automail",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "glorious-services-support",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "product-delivery-date",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.1.4",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sv100-companion",
    "type": "plugin",
    "affected_version": "* - 1.9.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bulletin-announcements",
    "type": "plugin",
    "affected_version": "1.0.1 - 3.7.1",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "advanced-database-replacer",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "stop-user-enumeration",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "multisite-robotstxt-manager",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "temp-mail",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "simple-facebook-twitter-widget",
    "type": "plugin",
    "affected_version": "1.5.0 - 1.7.0",
    "from_version": "1.5.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cooked",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fortune",
    "type": "theme",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-country-restrictions-advanced",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.14.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "front-end-pm",
    "type": "plugin",
    "affected_version": "11.2.3 - 11.3.7",
    "from_version": "11.2.3",
    "from_inclusive": true,
    "to_version": "11.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wc-cashapp",
    "type": "plugin",
    "affected_version": "* - 5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sumo-divi-modules",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.0.6",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ultimate-social-media-plus",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "xt-woo-points-rewards",
    "type": "plugin",
    "affected_version": "1.3.5 - 1.6.4",
    "from_version": "1.3.5",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "rovenstart",
    "type": "theme",
    "affected_version": "1.0.0 - 1.2.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-products-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "1.0.8 - 1.0.9",
    "from_version": "1.0.8",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "device-wrapper",
    "type": "plugin",
    "affected_version": "1.1",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "delivery-woo",
    "type": "plugin",
    "affected_version": "1.0 - 1.0.4",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-twilio-core",
    "type": "plugin",
    "affected_version": "1.2.1 - 1.5.0",
    "from_version": "1.2.1",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "start",
    "type": "theme",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "security-ninja",
    "type": "plugin",
    "affected_version": "5.50 - 5.158",
    "from_version": "5.50",
    "from_inclusive": true,
    "to_version": "5.158",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "goal-tracker-ga",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.0.10",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "internal-link-flow-topical-authority-topical-map",
    "type": "plugin",
    "affected_version": "1.0.1",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gym-express",
    "type": "theme",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "justified-gallery",
    "type": "plugin",
    "affected_version": "1.2.1 - 1.7.3",
    "from_version": "1.2.1",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "book-buyback-prices",
    "type": "plugin",
    "affected_version": "1.0.2 - 1.0.9",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fuse-social-floating-sidebar",
    "type": "plugin",
    "affected_version": "3.1 - 5.4.8",
    "from_version": "3.1",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-hr-manager",
    "type": "plugin",
    "affected_version": "0.1.1 - 3.0.8",
    "from_version": "0.1.1",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cf7-customizer",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.6.1",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "static-html-output-plugin",
    "type": "plugin",
    "affected_version": "* - 5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "emails-blacklist-everest-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "easy-schema-structured-data-rich-snippets",
    "type": "plugin",
    "affected_version": "2.0 - 2.2.2",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "all-in-one-video-gallery",
    "type": "plugin",
    "affected_version": "1.5.7 - 3.3.0",
    "from_version": "1.5.7",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-admin-product-notes",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "variable-inspector",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "search-field-for-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wc-zelle",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "buddyforms-anonymous-author",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sv-forms",
    "type": "plugin",
    "affected_version": "* - 1.9.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-tools-gravity-forms-divi-module",
    "type": "plugin",
    "affected_version": "5.0.0 - 7.0.2",
    "from_version": "5.0.0",
    "from_inclusive": true,
    "to_version": "7.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "powerpack-addon-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gallery-bank",
    "type": "plugin",
    "affected_version": "* - 4.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "contact-form-7-designer",
    "type": "plugin",
    "affected_version": "2.0 - 2.2",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "everse",
    "type": "theme",
    "affected_version": "0.1 - 1.8.9",
    "from_version": "0.1",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wpdtol-database-table-overview-logs",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "rest-routes",
    "type": "plugin",
    "affected_version": "2.0.2 - 5.5.2",
    "from_version": "2.0.2",
    "from_inclusive": true,
    "to_version": "5.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "simplifii",
    "type": "theme",
    "affected_version": "1.5.2",
    "from_version": "1.5.2",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "super-social-content-locker-lite",
    "type": "plugin",
    "affected_version": "1.2.1",
    "from_version": "1.2.1",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wpgsi",
    "type": "plugin",
    "affected_version": "* - 3.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-bugbot",
    "type": "plugin",
    "affected_version": "1.7.3 - 1.8.1",
    "from_version": "1.7.3",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "integrate-google-drive",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "missing-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "nokke",
    "type": "theme",
    "affected_version": "1.0.1 - 1.2.2",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-customers-spreadsheet-bulk-edit",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "linked-orders-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.2",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ultraaddons-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "one-page-blocks",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sync-ecommerce-neo",
    "type": "plugin",
    "affected_version": "1.1 - 1.4",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "totalpress",
    "type": "theme",
    "affected_version": "* - 6.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "seo-for-local",
    "type": "plugin",
    "affected_version": "9.0.0 - 9.2.0",
    "from_version": "9.0.0",
    "from_inclusive": true,
    "to_version": "9.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fullworks-firewall",
    "type": "plugin",
    "affected_version": "1.0 - 1.1.2",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "pay-addons-for-elementor",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wpide",
    "type": "plugin",
    "affected_version": "3.0 - 3.4.6",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "spice-starter-sites",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "preloader-for-divi",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "role-based-bulk-quantity-pricing",
    "type": "plugin",
    "affected_version": "1.1.4 - 1.1.6",
    "from_version": "1.1.4",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "more-better-reviews-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "krste",
    "type": "theme",
    "affected_version": "1.0.0 - 1.0.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sales-page-addon",
    "type": "plugin",
    "affected_version": "1.0 - 1.4",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "quote-press",
    "type": "plugin",
    "affected_version": "1.1.3",
    "from_version": "1.1.3",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "startup-blog",
    "type": "theme",
    "affected_version": "* - 1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fullworks-slack",
    "type": "plugin",
    "affected_version": "1.0.1",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-remove-cart-and-query-button",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.2.1",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "webba-booking-lite",
    "type": "plugin",
    "affected_version": "* - 4.5.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "shuban",
    "type": "theme",
    "affected_version": "1.1.2",
    "from_version": "1.1.2",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "joli-clear-lightbox",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "otp-easy-login-with-mocean",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.1.1",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gpt3-ai-content-generator",
    "type": "plugin",
    "affected_version": "1.4.10 - 1.7.37",
    "from_version": "1.4.10",
    "from_inclusive": true,
    "to_version": "1.7.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ecommerce-addon",
    "type": "plugin",
    "affected_version": "1.0 - 1.3",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "acf-for-woocommerce-product",
    "type": "plugin",
    "affected_version": "0.1 - 1.8.1",
    "from_version": "0.1",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "moceanapi-sendsms",
    "type": "plugin",
    "affected_version": "1.3.4 - 1.4.7",
    "from_version": "1.3.4",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "shipping-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.3.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "3d-viewer",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "photoblocks-grid-gallery",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.8",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gyta-buyback",
    "type": "plugin",
    "affected_version": "1.0.11 - 1.2.8",
    "from_version": "1.0.11",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "2.3.7 - 2.8.0",
    "from_version": "2.3.7",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "[2.1.2-beta.1, 2.5.7]",
    "from_version": "2.1.2-beta.1",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "custom-product-builder-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.0.4",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "compare-affiliated-products",
    "type": "plugin",
    "affected_version": "2.0.1 - 2.2.0",
    "from_version": "2.0.1",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "livemesh-table-rate-shipping",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "random-sorting-order-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-scrive",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "edupress",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "universal-email-preference-center",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.3.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "inbound-brew",
    "type": "plugin",
    "affected_version": "1.6.0 - 1.9.4",
    "from_version": "1.6.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-photo-effects",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wpoptin",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.6",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-conditional-product-fees-for-checkout",
    "type": "plugin",
    "affected_version": "3.1 - 3.9.3.1",
    "from_version": "3.1",
    "from_inclusive": true,
    "to_version": "3.9.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "livemesh-weight-based-shipping",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "reset-course-progress-for-learndash",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gsheetconnector-ninja-forms",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cart-weight-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.7",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "podcast-box",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.2",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "protected-page",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.16",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "buddyforms-members",
    "type": "plugin",
    "affected_version": "* - 1.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "turbo-widgets",
    "type": "plugin",
    "affected_version": "2.0.0",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-quick-cart-for-multiple-variations",
    "type": "plugin",
    "affected_version": "1.1.6 - 1.2.0",
    "from_version": "1.1.6",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "content-protector",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "product-table",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gift-message-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.7.4",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "blocks-product-editor-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "layouts-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "press-elements",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.7.2",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "food-recipes",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.6.0",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "azw-woocommerce-file-uploads",
    "type": "plugin",
    "affected_version": "1.0 - 1.0.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "blog-designer-pack",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "broadcast-lite",
    "type": "theme",
    "affected_version": "2.0.1 - 2.0.6",
    "from_version": "2.0.1",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "writersblok-ai",
    "type": "plugin",
    "affected_version": "* - 1.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "foobar-notifications-lite",
    "type": "plugin",
    "affected_version": "2.0.3 - 2.1.27",
    "from_version": "2.0.3",
    "from_inclusive": true,
    "to_version": "2.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bootstrap-photography",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "buddyforms-easypin",
    "type": "plugin",
    "affected_version": "1.0.1",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "web3-coin-gate",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wpcasa-mail-alert",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bnfw",
    "type": "plugin",
    "affected_version": "* - 1.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "rw-divi-unite-gallery",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fullworks-pricing-tables",
    "type": "plugin",
    "affected_version": "1.0 - 1.1.3",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "mobile-booster",
    "type": "plugin",
    "affected_version": "1.0 - 1.2.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "tablesome",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "advanced-form-integration",
    "type": "plugin",
    "affected_version": "* - 1.69.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.69.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "product-filter-widget-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "terms-and-conditions-per-product",
    "type": "plugin",
    "affected_version": "1.2.0 - 1.2.5",
    "from_version": "1.2.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fullworks-ice-ide-integration",
    "type": "plugin",
    "affected_version": "1.4 - 2.0.2",
    "from_version": "1.4",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "event-feed-for-eventbrite",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "coneblog-widgets",
    "type": "plugin",
    "affected_version": "1.4.3 - 1.4.6",
    "from_version": "1.4.3",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "easy-under-construction",
    "type": "plugin",
    "affected_version": "3.0 - 6.0",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wadi-addons-for-elementor",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.10",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-mail-log",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-sheet-editor-edd-downloads",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.0.60",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wow-carousel-for-divi-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wellness",
    "type": "theme",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "automizy-gravity-forms",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.3.0",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "widgets-on-pages",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wc-sms",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "feedback-suite",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.0.5",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "buffer-my-post",
    "type": "plugin",
    "affected_version": "* - 2020.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2020.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "content-aware-sidebars",
    "type": "plugin",
    "affected_version": "* - 3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bani",
    "type": "theme",
    "affected_version": "1.0.7",
    "from_version": "1.0.7",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fast-wp",
    "type": "plugin",
    "affected_version": "1.0.2 - 1.0.3",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "import-social-statistics",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "codepile",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.6",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "add-search-to-menu",
    "type": "plugin",
    "affected_version": "4.0 - 5.5.1",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "themereps-helper",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "nowpayments-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "xt-woo-variation-swatches",
    "type": "plugin",
    "affected_version": "1.7.2 - 1.8.7",
    "from_version": "1.7.2",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "url-shortify",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.7.2",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "adblock-notify-by-bweb",
    "type": "plugin",
    "affected_version": "2.0.8 - 2.4.0",
    "from_version": "2.0.8",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-authorize-net-gateway-aim",
    "type": "plugin",
    "affected_version": "5.0.0 - 6.0.3",
    "from_version": "5.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "video-analytics-for-cloudflare-stream",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "auto-featured-image-auto-generated",
    "type": "plugin",
    "affected_version": "1.3.7 - 1.5.4",
    "from_version": "1.3.7",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wc4bp",
    "type": "plugin",
    "affected_version": "3.0 - 3.4.15",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "3.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "1.0.1",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "review-engine",
    "type": "plugin",
    "affected_version": "1.0.3 - 1.0.41",
    "from_version": "1.0.3",
    "from_inclusive": true,
    "to_version": "1.0.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "independent-analytics",
    "type": "plugin",
    "affected_version": "* - 1.25.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "glossary-by-codeat",
    "type": "plugin",
    "affected_version": "1.2.0 - 2.2.2",
    "from_version": "1.2.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "chatpressai",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "premmerce-woocommerce-toolkit",
    "type": "plugin",
    "affected_version": "1.1 - 1.1.6",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-seo-keyword-optimizer",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.1.9.12",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "affieasy",
    "type": "plugin",
    "affected_version": "0.9.22 - 1.0.6",
    "from_version": "0.9.22",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ona",
    "type": "theme",
    "affected_version": "1.1 - 1.18.1",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.18.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "convert-classic-editor-to-blocks",
    "type": "plugin",
    "affected_version": "1.0.2 - 1.0.6",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wpcake",
    "type": "theme",
    "affected_version": "1.1.1 - 1.2.4",
    "from_version": "1.1.1",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "carousels-slider-for-divi",
    "type": "plugin",
    "affected_version": "1.5.0 - 1.6.1",
    "from_version": "1.5.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "display-admin-page-on-frontend",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.20.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bp-toolkit",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "menu-image",
    "type": "plugin",
    "affected_version": "2.9.2 - 3.0.9",
    "from_version": "2.9.2",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "temp-mail-x",
    "type": "theme",
    "affected_version": "1.0.0 - 1.0.4",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-advanced-extra-fees-lite",
    "type": "plugin",
    "affected_version": "1.2.0 - 1.2.9",
    "from_version": "1.2.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-openagenda",
    "type": "plugin",
    "affected_version": "* - 1.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "momo-venmo",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "xt-woo-ajax-add-to-cart",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.6",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "meta-tag-manager",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-quick-reports",
    "type": "plugin",
    "affected_version": "2.6 - 2.7.1",
    "from_version": "2.6",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "integrate-automate",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "avectra-netforum-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "hive-lite",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "external-media-upload",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ether-and-erc20-tokens-woocommerce-payment-gateway",
    "type": "plugin",
    "affected_version": "3.0.0 - 4.12.12",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "4.12.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "pretty-simple-popup-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "order-on-chat-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.3.0 - 1.6.1",
    "from_version": "1.3.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "attribute-stock-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woocommerce-shipping-gateway-per-product",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.3.2",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "purosa",
    "type": "theme",
    "affected_version": "1.0.2 - 1.1.2",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "projectopia-core",
    "type": "plugin",
    "affected_version": "* - 5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "nichetable",
    "type": "plugin",
    "affected_version": "[1.5.0, 2.8.0)",
    "from_version": "1.5.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "advanced-page-visit-counter",
    "type": "plugin",
    "affected_version": "3.0 - 7.1.0",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-sierra",
    "type": "theme",
    "affected_version": "1.0.3 - 1.0.49",
    "from_version": "1.0.3",
    "from_inclusive": true,
    "to_version": "1.0.49",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "saleszone",
    "type": "theme",
    "affected_version": "2.0.5 - 2.2.4",
    "from_version": "2.0.5",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-tripadvisor-review-slider",
    "type": "plugin",
    "affected_version": "10.4 - 11.2",
    "from_version": "10.4",
    "from_inclusive": true,
    "to_version": "11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-checkout-for-digital-goods",
    "type": "plugin",
    "affected_version": "2.8 - 3.7.0",
    "from_version": "2.8",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "seo-booster",
    "type": "plugin",
    "affected_version": "3.3.30 - 3.8.8",
    "from_version": "3.3.30",
    "from_inclusive": true,
    "to_version": "3.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fullworks-anti-spam",
    "type": "plugin",
    "affected_version": "0.0.1 - 1.3.9",
    "from_version": "0.0.1",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gema-lite",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "order-picking-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ultimate-widgets-light",
    "type": "plugin",
    "affected_version": "1.5.9.4",
    "from_version": "1.5.9.4",
    "from_inclusive": true,
    "to_version": "1.5.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ua-marketplace",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "printus-cloud-printing-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.2",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "insert-or-embed-articulate-content-into-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.3000000020",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3000000020",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "remove-add-to-cart-button-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "appexperts",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ultimate-post-kit",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "caxton",
    "type": "plugin",
    "affected_version": "* - 1.30.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "nitek-carousel-cool-transitions",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "upcasted-s3-offload",
    "type": "plugin",
    "affected_version": "2.0.0 - 3.0.2",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "netforum-directory-with-importer",
    "type": "plugin",
    "affected_version": "1.11",
    "from_version": "1.11",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "smart-protect",
    "type": "plugin",
    "affected_version": "1.1",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "blockons",
    "type": "plugin",
    "affected_version": "1.0.2 - 1.0.7",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "lpagery",
    "type": "plugin",
    "affected_version": "1.0 - 1.2.5",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "blockmeister",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.1.9",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "yatri-tools",
    "type": "plugin",
    "affected_version": "1.0.5 - 1.1.3",
    "from_version": "1.0.5",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "change-prices-with-time-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-extra-flat-rate",
    "type": "plugin",
    "affected_version": "3.6.1 - 4.1.2",
    "from_version": "3.6.1",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wpgenealogy",
    "type": "plugin",
    "affected_version": "* - 0.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "auto-date-year-month",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.1.2",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "agendapress",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "gutenbook",
    "type": "theme",
    "affected_version": "1.0.8 - 1.0.14",
    "from_version": "1.0.8",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sp-news-and-widget",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "blog-sidebar-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "doko-box-builder",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "contact-form-db-divi",
    "type": "plugin",
    "affected_version": "1.0 - 1.0.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "multipurpose-block",
    "type": "plugin",
    "affected_version": "1.3 - 1.7.5",
    "from_version": "1.3",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "advanced-usps-shipping-method",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "forms-gutenberg",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "artificial-intelligence-auto-content-generator",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-security-audit-log",
    "type": "plugin",
    "affected_version": "3.0.0 - 4.4.2.1",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "simple-feature-requests",
    "type": "plugin",
    "affected_version": "1.0.0 - 2.2.4",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bulk-edit-categories-tags",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.7.4",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "license-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "2.2.5 - 2.2.9",
    "from_version": "2.2.5",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "embed-video-thumbnail",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "preloader-plus",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sky-login-redirect",
    "type": "plugin",
    "affected_version": "* - 3.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "convoworks-wp",
    "type": "plugin",
    "affected_version": "* - 0.22.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.22.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "graphcomment-comment-system",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ga-for-wp",
    "type": "plugin",
    "affected_version": "1.1 - 2.1.2",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "reach-us-contact-form",
    "type": "plugin",
    "affected_version": "3.0 - 5.0",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "collage-for-divi",
    "type": "plugin",
    "affected_version": "1.0.1",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-persistent-login",
    "type": "plugin",
    "affected_version": "* - 2.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sonawp-simple-payment-block",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "table-genie",
    "type": "plugin",
    "affected_version": "1.0.4 - 1.0.5",
    "from_version": "1.0.4",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ultimate-custom-scrollbar",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "booking-weir",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.11",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "widgets-for-siteorigin",
    "type": "plugin",
    "affected_version": "1.2.3 - 1.4.8",
    "from_version": "1.2.3",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sv-posts",
    "type": "plugin",
    "affected_version": "* - 1.9.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "tecslider",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "conditional-logic-for-woo-product-add-ons",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "easy-settings-for-learndash",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.3.0",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "share-this-image",
    "type": "plugin",
    "affected_version": "1.47 - 1.80",
    "from_version": "1.47",
    "from_inclusive": true,
    "to_version": "1.80",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "4.3.1 - 6.4.9",
    "from_version": "4.3.1",
    "from_inclusive": true,
    "to_version": "6.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "nexus",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "meridia",
    "type": "theme",
    "affected_version": "1.0.0 - 2.2.7",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "webinar-ignition",
    "type": "plugin",
    "affected_version": "3.01.2",
    "from_version": "3.01.2",
    "from_inclusive": true,
    "to_version": "3.01.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "delete-old-posts-programmatically",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "set-admin-colour-on-staging-and-dev",
    "type": "plugin",
    "affected_version": "2.2 - 4.0.0",
    "from_version": "2.2",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "simple-tour-guide",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "brand",
    "type": "theme",
    "affected_version": "1.8.9 - 1.9",
    "from_version": "1.8.9",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "addons-for-visual-composer",
    "type": "plugin",
    "affected_version": "2.2.1 - 3.2",
    "from_version": "2.2.1",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-table-builder",
    "type": "plugin",
    "affected_version": "1.2.4 - 1.4.9",
    "from_version": "1.2.4",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "1.0.2 - 2.0.4",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "content-restrictor-for-divi",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.4.2",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "logo-showcase-with-slick-slider",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "premmerce-woocommerce-variation-swatches",
    "type": "plugin",
    "affected_version": "1.0 - 1.2.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "hm-testimonial",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "buddydrive",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sprout-clients",
    "type": "plugin",
    "affected_version": "3.1",
    "from_version": "3.1",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "simply-gallery-block",
    "type": "plugin",
    "affected_version": "1.8.4 - 3.1.4",
    "from_version": "1.8.4",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-asset-clean-up",
    "type": "plugin",
    "affected_version": "* - 1.3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "kanzu-support-desk",
    "type": "plugin",
    "affected_version": "2.3.3 - 2.4.7",
    "from_version": "2.3.3",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "easy-tiktok-feed",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "pop-over-xyz",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "coinbase-commerce-for-contact-form-7",
    "type": "plugin",
    "affected_version": "1.1.1",
    "from_version": "1.1.1",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "current-template-name",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "number-chat",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "rating-widget",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "recurring-bookings-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0 - 2.0.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "spotlight-social-photo-feeds",
    "type": "plugin",
    "affected_version": "0.2 - 1.6",
    "from_version": "0.2",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "go-viral",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.8.2",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "the-authority",
    "type": "theme",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cheetaho-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "custom-user-guide",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cf7-styler",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "dashylite",
    "type": "plugin",
    "affected_version": "2.0.1 - 2.1.8",
    "from_version": "2.0.1",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "premmerce-user-roles",
    "type": "plugin",
    "affected_version": "1.0 - 1.0.11",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "hm-cool-author-box-widget",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "radio-station",
    "type": "plugin",
    "affected_version": "2.3.0 - 2.4.0.9",
    "from_version": "2.3.0",
    "from_inclusive": true,
    "to_version": "2.4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "buddyforms-acf",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "pets",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "seo-site-auditor-agency",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.2.8",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "login-designer",
    "type": "plugin",
    "affected_version": "1.6 - 1.6.1",
    "from_version": "1.6",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-transactions",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "reviewpress",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.0.5",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 5.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "mobile-menu",
    "type": "plugin",
    "affected_version": "2.4 - 2.8.3",
    "from_version": "2.4",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "web3-token-gate",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.4",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cf7-message-filter",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "slp-extenders",
    "type": "plugin",
    "affected_version": "5.6.0 - 6.1.1",
    "from_version": "5.6.0",
    "from_inclusive": true,
    "to_version": "6.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "5.12.5 - 5.13.0",
    "from_version": "5.12.5",
    "from_inclusive": true,
    "to_version": "5.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "hotelica",
    "type": "theme",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-smart-export",
    "type": "plugin",
    "affected_version": "1.4.2 - 1.4.2.3",
    "from_version": "1.4.2",
    "from_inclusive": true,
    "to_version": "1.4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "easync-booking",
    "type": "plugin",
    "affected_version": "1.1.5 - 1.3.6",
    "from_version": "1.1.5",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-fiscalita-italiana",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.3.34",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.3.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "premmerce-woocommerce-brands",
    "type": "plugin",
    "affected_version": "1.1 - 1.2.12",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ethereum-wallet",
    "type": "plugin",
    "affected_version": "* - 4.10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "limb-gallery",
    "type": "plugin",
    "affected_version": "1.4.9 - 1.5.5",
    "from_version": "1.4.9",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "code-manager",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.25",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "payment-gateway-payfabric",
    "type": "plugin",
    "affected_version": "1.0.4 - 1.0.12.2",
    "from_version": "1.0.4",
    "from_inclusive": true,
    "to_version": "1.0.12.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "tedwp",
    "type": "plugin",
    "affected_version": "0.0.1 - 0.0.6",
    "from_version": "0.0.1",
    "from_inclusive": true,
    "to_version": "0.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wc-gsheetconnector",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "update-urls",
    "type": "plugin",
    "affected_version": "1.2.1",
    "from_version": "1.2.1",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-product-finder",
    "type": "plugin",
    "affected_version": "1.4.0 - 1.4.1",
    "from_version": "1.4.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "aquarella-lite",
    "type": "theme",
    "affected_version": "* - 1.0.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "commerce-coinbase-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "bootstrap-coach",
    "type": "theme",
    "affected_version": "1.1.0 - 1.1.1",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "villar",
    "type": "theme",
    "affected_version": "1.0.0 - 1.0.10",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "map-location-picker-at-checkout-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.2.2 - 1.8.4",
    "from_version": "1.2.2",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "demomentsomtres-categories",
    "type": "plugin",
    "affected_version": "2.5.5",
    "from_version": "2.5.5",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "freshing",
    "type": "plugin",
    "affected_version": "1.1.1 - 1.1.3",
    "from_version": "1.1.1",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "age-verification-screen-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.0.2",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-ecommerce-tracking-for-google-and-facebook",
    "type": "plugin",
    "affected_version": "3.0 - 3.7.0",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "joli-faq-seo",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.3.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "mass-pagesposts-creator",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.1.6",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-relevant-ads",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "glorious-sites-installer",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-facebook-group",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.8",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "airpress",
    "type": "plugin",
    "affected_version": "1.1.51 - 1.1.62",
    "from_version": "1.1.51",
    "from_inclusive": true,
    "to_version": "1.1.62",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-structured-data-schema",
    "type": "plugin",
    "affected_version": "3.5.0 - 4.0.2",
    "from_version": "3.5.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "photography-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "login-customizer",
    "type": "plugin",
    "affected_version": "2.1.5 - 2.2.2",
    "from_version": "2.1.5",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "mmt-eventon-exim-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "learnmore",
    "type": "theme",
    "affected_version": "1.0.4",
    "from_version": "1.0.4",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "1.5.12 - 2.1.6",
    "from_version": "1.5.12",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "min-and-max-quantity-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.1.0",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "puredevs-customer-history-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "kk-star-ratings",
    "type": "plugin",
    "affected_version": "3.0.0 - 5.4.4",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "5.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "drop-shadow-boxes",
    "type": "plugin",
    "affected_version": "1.5.8 - 1.7.10",
    "from_version": "1.5.8",
    "from_inclusive": true,
    "to_version": "1.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "topcat-lite",
    "type": "theme",
    "affected_version": "2.0.2 - 2.0.3",
    "from_version": "2.0.2",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "fire-blog",
    "type": "theme",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wordapp-mobile-app",
    "type": "plugin",
    "affected_version": "1.17.1 - 2.0.3",
    "from_version": "1.17.1",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "faq-manager-with-structured-data",
    "type": "plugin",
    "affected_version": "4.0.0 - 5.4.3",
    "from_version": "4.0.0",
    "from_inclusive": true,
    "to_version": "5.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wps-team",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.7.0",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "404-to-301",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "quote-requests-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.4",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "quick-contact-form",
    "type": "plugin",
    "affected_version": "7.0.0 - 8.0.6.6",
    "from_version": "7.0.0",
    "from_inclusive": true,
    "to_version": "8.0.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-front-end-profile",
    "type": "plugin",
    "affected_version": "1.2.1 - 1.3.0",
    "from_version": "1.2.1",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wc-rest-payment",
    "type": "plugin",
    "affected_version": "1.2.0 - 1.4.1",
    "from_version": "1.2.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "advanced-visual-elements",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "svg-flags-lite",
    "type": "plugin",
    "affected_version": "0.5 - 0.9.6",
    "from_version": "0.5",
    "from_inclusive": true,
    "to_version": "0.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "post-list-designer",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "files-download-delay",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "smart-tools-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.8 - 1.1.0",
    "from_version": "1.0.8",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "premmerce-woocommerce-product-bundles",
    "type": "plugin",
    "affected_version": "1.0 - 1.0.9",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "before-and-after-product-images-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.2 - 1.0.3",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-facebook-reviews",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "stop-wp-emails-going-to-spam",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "f4-tree",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.1.14",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "suffice",
    "type": "theme",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "premium-blog-addons",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "customer-chat-facebook",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.1.1",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "ultimate-sms-notifications",
    "type": "plugin",
    "affected_version": "1.2 - 1.9.9.5",
    "from_version": "1.2",
    "from_inclusive": true,
    "to_version": "1.9.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "mail-control",
    "type": "plugin",
    "affected_version": "0.2 - 0.2.8",
    "from_version": "0.2",
    "from_inclusive": true,
    "to_version": "0.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "locations-and-areas",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "lawpress",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "agncy",
    "type": "theme",
    "affected_version": "1.0.0 - 1.6.7",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-shipping-display-mode",
    "type": "plugin",
    "affected_version": "3.4 - 3.7.6",
    "from_version": "3.4",
    "from_inclusive": true,
    "to_version": "3.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "blockington",
    "type": "plugin",
    "affected_version": "1.0.2",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "1.3 - 1.3.70",
    "from_version": "1.3",
    "from_inclusive": true,
    "to_version": "1.3.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sql-reporting-services",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-sheet-editor-bulk-spreadsheet-editor-for-posts-and-pages",
    "type": "plugin",
    "affected_version": "1.4.3 - 2.25.2",
    "from_version": "1.4.3",
    "from_inclusive": true,
    "to_version": "2.25.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "preprocess-dezrez",
    "type": "plugin",
    "affected_version": "1.1 - 1.1.2",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "delete-duplicate-posts",
    "type": "plugin",
    "affected_version": "4.1.9 - 4.8.8",
    "from_version": "4.1.9",
    "from_inclusive": true,
    "to_version": "4.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "rss-control",
    "type": "plugin",
    "affected_version": "2.0.2 - 3.0.5",
    "from_version": "2.0.2",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cleanup-action-scheduler",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "media-download",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-link-bio",
    "type": "plugin",
    "affected_version": "1.2.0 - 1.4.5",
    "from_version": "1.2.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "geo-mashup",
    "type": "plugin",
    "affected_version": "1.9.1 - 1.13.11",
    "from_version": "1.9.1",
    "from_inclusive": true,
    "to_version": "1.13.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "woo-product-reviews-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "cpa-offerwall",
    "type": "plugin",
    "affected_version": "1.0.1 - 1.0.2",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "sites-monitor",
    "type": "plugin",
    "affected_version": "0.0.7 - 0.0.8",
    "from_version": "0.0.7",
    "from_inclusive": true,
    "to_version": "0.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "contact-list",
    "type": "plugin",
    "affected_version": "2.9.24 - 2.9.69",
    "from_version": "2.9.24",
    "from_inclusive": true,
    "to_version": "2.9.69",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "post-snippets",
    "type": "plugin",
    "affected_version": "3.0.0 - 4.0.3",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "how-to-wp",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.0.2",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-forge",
    "type": "theme",
    "affected_version": "* - 6.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "socialmark",
    "type": "plugin",
    "affected_version": "1.0.0 - 2.0.6",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "print-my-blog",
    "type": "plugin",
    "affected_version": "3.3.0 - 3.25.1",
    "from_version": "3.3.0",
    "from_inclusive": true,
    "to_version": "3.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "role-and-customer-based-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.4.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "notification",
    "type": "plugin",
    "affected_version": "* - 6.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "chic-lifestyle",
    "type": "theme",
    "affected_version": "1.1.3",
    "from_version": "1.1.3",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "delicious-recipes",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "treepress",
    "type": "plugin",
    "affected_version": "1.0 - 3.0.0.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "3.0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "noted-pro",
    "type": "plugin",
    "affected_version": "1.0 - 1.02",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "postcode-redirect",
    "type": "plugin",
    "affected_version": "2.1.1 - 4.4.1",
    "from_version": "2.1.1",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wc-product-author",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "autocomplete-address-and-location-picker-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.5",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-coupons-and-deals",
    "type": "plugin",
    "affected_version": "2.1.3 - 3.1.18",
    "from_version": "2.1.3",
    "from_inclusive": true,
    "to_version": "3.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "copy-the-code",
    "type": "plugin",
    "affected_version": "1.3.0 - 2.6.3",
    "from_version": "1.3.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "feedpress-generator",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "information-for-help",
    "type": "plugin",
    "affected_version": "* - 0.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "form-vibes",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freemius SDK \u003c= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get",
    "slug": "wp-automedic",
    "type": "plugin",
    "affected_version": "1.4.0 - 1.5.6",
    "from_version": "1.4.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.109",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.109",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5329",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Cart Abandonment Recovery \u003c= 1.2.26 - Cross-Site Request Forgery to Templates/Abandoned Orders Deletion",
    "slug": "woo-cart-abandonment-recovery",
    "type": "plugin",
    "affected_version": "* - 1.2.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2322",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 1.5.5.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.5.5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24270",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Socializer \u003c= 7.13.54 - Missing Authorization",
    "slug": "super-socializer",
    "type": "plugin",
    "affected_version": "* - 7.13.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.13.54",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41802",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MailChimp Subscribe Forms  \u003c= 4.0.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mailchimp-subscribe-sm",
    "type": "plugin",
    "affected_version": "* - 4.0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33328",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sweet Dessert \u003c 1.1.13 - Unauthenticated PHP Object Injection",
    "slug": "sweet-dessert",
    "type": "theme",
    "affected_version": "[*, 1.1.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-49073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49073",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Builder \u003c= 4.0.6 - Authenticated SQL Injection via order \u0026 orderby Parameters",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "[*, 4.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0228",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-DownloadManager \u003c= 1.68.10 - Authenticated (Administrator+) Arbitrary File Read",
    "slug": "wp-downloadmanager",
    "type": "plugin",
    "affected_version": "* - 1.68.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.68.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4798",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "HMH Footer Builder For Elementor \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hmh-footer-builder-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31749",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Check Pincode For Woocommerce \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "check-pincode-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54333",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Follow Me Plugin \u003c= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "follow-me",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3240",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "简数采集器 (Keydatas) \u003c= 2.5.2 - Unauthenticated Arbitrary File Upload",
    "slug": "keydatas",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6220",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Qi Addons for Elementor \u003c= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget",
    "slug": "qi-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8146",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVG Support \u003c= 2.3.19 Admin+ Cross-Site Scripting",
    "slug": "svg-support",
    "type": "plugin",
    "affected_version": "* - 2.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24686",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Greenshift – animation and page builder blocks \u003c= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 9.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6155",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sharebar \u003c= 1.4.1 - Cross-Site Request Forgery to Settings Update \u0026 Cross-Site Scripting",
    "slug": "sharebar",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1626",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress File Upload \u003c= 4.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Malicious SVG",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "[*, 4.16.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24960",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Product Bundles for WooCommerce \u003c= 7.3.1 - Cross-Site Request Forgery",
    "slug": "woo-product-bundle",
    "type": "plugin",
    "affected_version": "* - 7.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52127",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47505",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Monster – Event Management, Tickets Booking, Upcoming Event \u003c= 1.1.20 - Cross-Site Request Forgery",
    "slug": "event-monster",
    "type": "plugin",
    "affected_version": "* - 1.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3336",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multi Days Events and Multi Events in One Day Calendar \u003c= 1.1.3 - Cross-Site Request Forgery",
    "slug": "dragon-calendar-free-version",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31572",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Locator \u003c= 2.0.4 - Reflected Cross-Site Scripting",
    "slug": "simple-locator",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22513",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Latepoint \u003c= 5.1.92 - Unauthenticated Insecure Direct Object Reference",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 5.1.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.92",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3769",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Listamester \u003c= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "listamester",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30813",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bug Library \u003c= 2.1.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "bug-library",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24728",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPCS – WordPress Currency Switcher Professional \u003c= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Editing",
    "slug": "currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2557",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery Widget",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6283",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime \u003c= 3.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29776",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant Reservations Widget \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "restaurantconnect-reswidget",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48023",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Share and Follow \u003c= 1.80.3 - Cross-Site Scripting",
    "slug": "share-and-follow",
    "type": "plugin",
    "affected_version": "* - 1.80.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.80.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-2917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2917",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra \u003c= 2.6.6 - Authenticated (Contributor+) Server-Side Request Forgery in import_wpforms",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-36679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36679",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Advanced Sermons \u003c= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-sermons",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ghost \u003c= 0.5.5 - Missing Authorization Checks",
    "slug": "ghost",
    "type": "plugin",
    "affected_version": "* - 0.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10983",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 5.12.0 - Cross-Site Request Forgery",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 5.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38086",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Thumbnail Slider With Lightbox \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "wp-responsive-slider-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5531",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Links/Problem Reporter \u003c= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "report-broken-links",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Run Contests, Raffles, and Giveaways with ContestsWP \u003c= 2.0.6 - Reflected Cross-Site Scripting",
    "slug": "contest-code-checker",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32634",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Appointments \u003c= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-appointments",
    "type": "plugin",
    "affected_version": "* - 3.11.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2842",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Taxonomy/Term and Role based Discounts for WooCommerce \u003c= 5.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "taxonomy-discounts-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24625",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Persian Fonts \u003c= 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "persian-fonts",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7167",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog Designer - Post and Widget \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "blog-designer-for-post-and-widget",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4793",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Address Encoder 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "email-address-encoder",
    "type": "plugin",
    "affected_version": "1.0.22",
    "from_version": "1.0.22",
    "from_inclusive": true,
    "to_version": "1.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48765",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewsMunch \u003c= 1.0.35 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "newsmunch",
    "type": "theme",
    "affected_version": "* - 1.0.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10848",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3161",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "tagDiv Opt-In Builder \u003c= 1.4.4 - Authenticated (Admin+) SQL Injection",
    "slug": "td-subscription",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3416",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SlideDeck 2 \u003c= 2.3.3 - Local/Remote File Inclusion",
    "slug": "slidedeck2",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-7483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7483",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Autoptimize \u003c= 3.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Settings",
    "slug": "autoptimize",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2635",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting",
    "slug": "mailchimp-for-wp",
    "type": "plugin",
    "affected_version": "4.9.9 - 4.9.16",
    "from_version": "4.9.9",
    "from_inclusive": true,
    "to_version": "4.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8850",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Rotator \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "appten-image-rotator",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25089",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All Users Messenger \u003c= 1.24 - Authenticated (Subscriber+) Insecure Direct Object Reference to Message Deletion",
    "slug": "all-users-messenger",
    "type": "plugin",
    "affected_version": "* - 1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4023",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Data Dash \u003c= 1.2.3 - Reflected Cross-Site Scripting",
    "slug": "data-dash",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23751",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Directory Free \u003c= 1.7.2 - Unauthenticated Local File Inclusion",
    "slug": "web-directory-free",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3673",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup \u0026 Notification Bar Plugin With Elementor \u003c= 2.8.2 - Unauthenticated SQL Injection",
    "slug": "notificationx",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-1698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1698",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SP Project \u0026 Document Manager  \u003c= 4.67 - Authenticated (Subscriber+) SQL Injection",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.67",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-36677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36677",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP EasyCart \u003c= 5.4.8 - Cross-Site Request Forgery via process_bulk_activate_product",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2895",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Full Stripe Free \u003c= 7.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-full-stripe-free",
    "type": "plugin",
    "affected_version": "* - 7.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28934",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar \u003c= 5.1 - Missing Authorization",
    "slug": "mp3-music-player-by-sonaar",
    "type": "plugin",
    "affected_version": "* - 5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Traveler \u003c= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12811",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Job Portal \u003c= 2.0.6 - Cross-Site Request Forgery",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52184",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Google SEO Pressor Snippet \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "google-seo-author-snippets",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31775",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Allow SVG Files \u003c= 1.0 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "asf-allow-svg-files",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1939",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 3.1.1 - Reflected Cross-Site Scripting",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30194",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GoToWP \u003c= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gotowp",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0369",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Widget",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.15.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3517",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Social Feed Plugin \u003c= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "add-instagram",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24412",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Link Groups \u003c= 1.1.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "social-link-groups",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49619",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Accordion \u003c= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication",
    "slug": "accordions",
    "type": "plugin",
    "affected_version": "* - 2.2.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.96",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1641",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Memberlite Shortcodes \u003c= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via memberlite_accordion Shortcode",
    "slug": "memberlite-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11227",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ALD Dropping and Fulfillment for AliExpress and WooCommerce \u003c= 1.0.21 - Cross-Site Request Forgery to Order Information Disclosure",
    "slug": "woo-alidropship",
    "type": "plugin",
    "affected_version": "* - 1.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46811",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Top Bar \u003c= 3.3 - Missing Authorization",
    "slug": "ultimate-bar",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30581",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sailthru Triggermail \u003c= 1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "sailthru-triggermail",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11141",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple URLs \u003c= 114 - Reflected Cross-Site Scripting",
    "slug": "simple-urls",
    "type": "plugin",
    "affected_version": "* - 114",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "114",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0099",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grid Plus \u003c= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode",
    "slug": "grid-plus",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5250",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SP Project \u0026 Document Manager \u003c= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1693",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Feedify – Web Push Notifications \u003c= 2.4.5 - Reflected Cross-Site Scripting",
    "slug": "push-notification-by-feedify",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32540",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy \u003c= 2.6.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.6.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32198",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ESB Testimonials \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "esb-testimonials",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51936",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy Pro \u003c= 2.6.1 - Missing Authorization",
    "slug": "brizy-pro",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26901",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – PDF Invoices \u003c 1.0.4 - Cross-Site Scripting",
    "slug": "edd-invoices",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9518",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Website Showcase \u003c= 1.0 - Unauthenticated Arbitrary File Upload",
    "slug": "product-websites-showcase",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49611",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Demon image annotation \u003c= 5.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "demon-image-annotation",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-40215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40215",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "తెలుగు బైబిల్ వచనములు \u003c= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "telugu-bible-verse-daily",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24410",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YITH Custom Login \u003c= 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "yith-custom-login",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35732",
    "auth_type": "Privileged",
    "cvss_score": 4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Memberpress \u003c= 1.11.34 - Missing Authorization",
    "slug": "memberpress",
    "type": "plugin",
    "affected_version": "* - 1.11.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43956",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Contact Form 7 \u003c= 3.1.23 - Authenticated (Subscriber+) SQL Injection via id",
    "slug": "ultimate-addons-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 3.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-30495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30495",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Ultimate Exporter \u003c= 2.4.1 - Unauthenticated Information Disclosure",
    "slug": "wp-ultimate-exporter",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2487",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ACF Images Search And Insert \u003c= 1.1.4 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "acf-images-search-and-insert",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-48035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Video Store \u003c= 21.07 - Reflected Cross-Site Scripting",
    "slug": "photo-video-store",
    "type": "plugin",
    "affected_version": "* - 21.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.07",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23478",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.3.1 - Missing Authorization to Captcha Setting Update",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23729",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Make Builder \u003c= 1.1.10 - Authenticated (Subscriber+) Server-Side Request Forgery via make_builder_ajax_subscribe Function",
    "slug": "make-builder",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13856",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Prayer II \u003c= 2.4.7 - Cross-Site Request Forgery to Email Settings Update",
    "slug": "wp-prayers-request",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4480",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Custom Fields \u003c= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure",
    "slug": "smart-custom-fields",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1995",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Publitio \u003c= 2.2.1 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "publitio",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58962",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "워드프레스 결제 심플페이 – 우커머스 결제 플러그인 \u003c= 5.2.2 - Reflected Cross-Site Scripting via add_query_arg Function",
    "slug": "pgall-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11943",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Carousel Slider \u003c= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "post-carousel-slider",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23977",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDataTables (Premium) \u003c= 3.4.1 - Improper Access Control leading to Table Data Deletion",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "[*, 3.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24198",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "ACF to REST API \u003c= 3.2.0 - Insecure direct object reference via permalinks manipulation",
    "slug": "acf-to-rest-api",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-13700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13700",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Backlink Monitoring Manager \u003c= 0.1.3 - Reflected Cross-Site Scripting",
    "slug": "backlink-monitoring-manager",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12714",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Tooltip Glossary \u003c= 4.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "enhanced-tooltipglossary",
    "type": "plugin",
    "affected_version": "* - 4.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5026",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flipdish Ordering System \u003c= 1.5.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "flipdish-ordering-system",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30601",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "White Label CMS \u003c= 2.7.4 - Reflected Cross-Site Scripting",
    "slug": "white-label-cms",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43303",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SH Slideshow \u003c= 4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "sh-slideshow",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51632",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Standout Color Boxes and Buttons \u003c= 0.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "standout-color-boxes-and-buttons",
    "type": "plugin",
    "affected_version": "* - 0.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2474",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InfiniteWP Client \u003c= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "iwp-client",
    "type": "plugin",
    "affected_version": "* - 1.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2916",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Engine \u003c= 6.4.3 - Cross-Site Request Forgery",
    "slug": "wplr-sync",
    "type": "plugin",
    "affected_version": "* - 6.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54672",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wordpress Plugin Mobile App Native 3.0 \u003c= 3.0 - Arbitrary File Upload",
    "slug": "zen-mobile-app-native",
    "type": "plugin",
    "affected_version": "3.0",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-6104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6104",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEMA API \u003c= 5.27 - Reflected Cross-Site Scripting via catid Parameter",
    "slug": "sema-api",
    "type": "plugin",
    "affected_version": "* - 5.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12285",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Feed \u003c= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via fb_appid",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 6.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30180",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c= 7.9 - Reflected Cross-Site Scripting",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43487",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Read More Without Refresh \u003c= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "read-more-without-refresh",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23793",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visualizer \u003c= 3.10.5 - Reflected Cross-Site Scripting",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27958",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Support Plus Responsive Ticket System \u003c= 9.1.1 - Stored Cross-Site Scripting",
    "slug": "wp-support-plus-responsive-ticket-system",
    "type": "plugin",
    "affected_version": "[*, 9.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15331",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme Editor \u003c= 2.5 - Authenticated Arbitrary File Download",
    "slug": "theme-editor",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24154",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "TinyMCE Custom Styles \u003c= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tinymce-custom-styles",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23995",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Event Manager \u003c= 3.1.22 - Admin+ Stored Cross-Site Scripting",
    "slug": "wp-event-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24810",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Simple Shopping Cart \u003c= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "wordpress-simple-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6497",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blur Text \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blur-text",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24627",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer \u003c= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source'",
    "slug": "3d-flipbook-dflip-lite",
    "type": "plugin",
    "affected_version": "* - 2.3.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.65",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5314",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c=1.8.2 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "[*, 1.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24186",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Connections Business Directory \u003c= 10.4.2 - Admin+ Stored Cross-Site Scripting",
    "slug": "connections",
    "type": "plugin",
    "affected_version": "[*, 10.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24794",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CoolClock \u003c= 4.3.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "coolclock",
    "type": "plugin",
    "affected_version": "[*, 4.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCRM - CRM for Contact form CF7 \u0026 WooCommerce \u003c= 3.2.0 - Unauthenticated SQL Injection",
    "slug": "wpcrm",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24773",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Dokan Pro \u003c= 3.14.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dokan-pro",
    "type": "plugin",
    "affected_version": "* - 3.14.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39497",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.5.1 - Cross-Site Request Forgery",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6254",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Support Ticket System \u003c 1.2.1 - SQL Injection",
    "slug": "simple-support-ticket-system",
    "type": "plugin",
    "affected_version": "[*, 1.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-7670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7670",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP RSS Aggregator \u003c= 4.19.1 - Admin+ Stored Cross-Site Scripting",
    "slug": "wp-rss-aggregator",
    "type": "plugin",
    "affected_version": "* - 4.19.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24768",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamically Display Posts \u003c= 1.1 - Unauthenticated SQL Injection",
    "slug": "dynamically-display-posts",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-11501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11501",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MultiParcels Shipping For WooCommerce \u003c= 1.14.13 - Missing Authorization via get_history",
    "slug": "multiparcels-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.14.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3365",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "HT Easy GA4 – Google Analytics WordPress Plugin \u003c= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Update",
    "slug": "ht-easy-google-analytics",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1176",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Directorybox Manager \u003c= 2.5 - Authentication Bypass",
    "slug": "wp-directorybox-manager",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-0316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPML \u003c= 4.5.13 - Cross-Site Request Forgery",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "* - 4.5.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45071",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Infinite Slider \u003c= 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "infinite-slider",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52461",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Echo RSS Feed Post Generator \u003c= 5.4.6 - Unauthenticated Privilege Escalation",
    "slug": "rss-feed-post-generator-echo",
    "type": "plugin",
    "affected_version": "* - 5.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9265",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HM Portfolio \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "hm-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Keap Official Opt-in Forms \u003c= 1.0.11 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "infusionsoft-official-opt-in-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6941",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Lister Lite for eBay \u003c= 3.5.11 - Authenticated (Shop Manager+) Stored Cross-Site Scripting",
    "slug": "wp-lister-for-ebay",
    "type": "plugin",
    "affected_version": "* - 3.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32573",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login Logout Menu \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "login-logout-menu",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4625",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Builder for WPForms \u003c= 1.2.88 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-builder-for-wpforms",
    "type": "plugin",
    "affected_version": "* - 1.2.88",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.88",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29820",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Solid Mail – SMTP email and logging made by SolidWP \u003c= 2.1.5 - Unauthenticated Stored Cross-Site Scripting via Email",
    "slug": "wp-smtp",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1123",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Airdrop Manager \u003c= 1.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "airdrop",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49053",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Multivendor Marketplace – REST API \u003c= 1.6.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wcfm-marketplace-rest-api",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1311",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "School Management \u003c= 93.2.0 - Missing Authorization",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 93.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "93.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48108",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Js O3 Lite \u003c= 1.5.8.2 - Reflected Cross-Site Scripting",
    "slug": "js-o3-lite",
    "type": "theme",
    "affected_version": "* - 1.5.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22792",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-pricing-tables-vc-extension",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13582",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Forum  Server \u003c= 1.8.2 - Cross-Site Request Forgery",
    "slug": "forum-server",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53305",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Files Download Delay \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "files-download-delay",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12493",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nextend Social Login Pro \u003c= 3.1.16 - Authentication Bypass via Apple OAuth provider",
    "slug": "nextend-social-login-pro",
    "type": "plugin",
    "affected_version": "* - 3.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1061",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JetTabs \u003c= 2.2.3 - Authenticated (Contributor+) Arbitrary Local File Inclusion",
    "slug": "jet-tabs",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7146",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WHMPress - WHMCS Client Area \u003c= 4.3-revision-3- Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "WHMpress_Client_Area_Api",
    "type": "plugin",
    "affected_version": "[*, 4.3-revision-3]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3-revision-3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9195",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ship Per Product \u003c= 2.1.0 - Missing Authorization",
    "slug": "ship-per-product",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31773",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Geo Mashup \u003c= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode",
    "slug": "geo-mashup",
    "type": "plugin",
    "affected_version": "* - 1.13.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8990",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS – eLearning and online course solution \u003c=1.7.6 - SQL Injection",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "[*, 1.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24185",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Counter Box \u003c= 2.0.5 - Cross-Site Request Forgery",
    "slug": "counter-box",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24715",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Freesoul Deactivate Plugins \u003c= 1.9.4.0 - Information Disclosure",
    "slug": "freesoul-deactivate-plugins",
    "type": "plugin",
    "affected_version": "* - 1.9.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-22687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22687",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Download Monitor \u003c= 4.4.6 - Reflected Cross-Site Scripting",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36920",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adverts \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "adverts-click-tracker",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57911",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smooth Slider \u003c 2.7 - Authenticated SQL Injection",
    "slug": "smooth-slider",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9454",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery with thumbnail slider \u003c= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gallery-with-thumbnail-slider",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-42485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42485",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Injection Guard \u003c= 1.2.1 - Missing Authorization via ig_update",
    "slug": "injection-guard",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32574",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GD bbPress Attachments \u003c= 4.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gd-bbpress-attachments",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45816",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart: Free Client Photo Galleries for Photographers \u003c= 3.1.1 - Unauthenticated PHP Object Injection",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30221",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gianism \u003c= 5.2.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "gianism",
    "type": "plugin",
    "affected_version": "* - 5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58266",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple File Downloader \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-file-downloader",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4764",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ST Gallery WP \u003c= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "st-gallery-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22543",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Analytics for WP \u003c= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "analytics-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3839",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Loan Repayment Calculator and Application Form \u003c= 2.9.4 - Cross-Site Request Forgery",
    "slug": "quick-interest-slider",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31263",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Directory Kit \u003c= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2277",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AnWP Football Leagues \u003c= 0.16.17 - Authenticated (Administrator+) CSV Injection",
    "slug": "football-leagues-by-anwppro",
    "type": "plugin",
    "affected_version": "* - 0.16.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.16.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8767",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ird Slider \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ird-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9876",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada  \u003c= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "[*, 6.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36711",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) \u003c= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Cookie Consent'",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10980",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp Edit Password Protected \u003c= 1.3.4 - Open Redirect",
    "slug": "wp-edit-password-protected",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9034",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Analytics Cat – Google Analytics Made Easy \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "analytics-cat",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12072",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Store Toolkit for WooCommerce \u003c= 1.5.7 - Privilege Escalation",
    "slug": "woocommerce-store-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10923",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ForumWP – Forum \u0026 Discussion Board \u003c= 2.1.2 - Reflected Cross-Site Scripting",
    "slug": "forumwp",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10879",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial Slider Shortcode \u003c= 1.1.8 - Authenticated (Contributor+) Cross-Site Scripting Vulnerability via Shortcode",
    "slug": "testimonial-slider-shortcode",
    "type": "plugin",
    "affected_version": "[*, 1.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4795",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Testimonials \u003c= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4577",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Manager and Tickets Selling Plugin for WooCommerce \u003c= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 3.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0144",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Bing Map Pro \u003c= 4.1.4 - Cross-Site Request Forgery via AJAX actions",
    "slug": "api-bing-map-2018",
    "type": "plugin",
    "affected_version": "[*, 5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-45052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45052",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Digi Store \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "digi-store",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22354",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-DBManager \u003c 2.72 - OS Command Injection",
    "slug": "wp-dbmanager",
    "type": "plugin",
    "affected_version": "[*, 2.72)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.72",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-8334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8334",
    "auth_type": "Auth",
    "cvss_score": 7.8,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "i-transform \u003c= 3.0.9 - Cross-Site Request Forgery",
    "slug": "i-transform",
    "type": "theme",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38764",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Customize Login Image \u003c= 3.4 - Cross-Site Scripting",
    "slug": "customize-login-image",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-33851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-33851",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EndomondoWP \u003c= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "endomondowp",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50551",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Patricia Lite \u003c= 1.2.3 - Cross-Site Request Forgery",
    "slug": "patricia-lite",
    "type": "theme",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37939",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart App Banner \u003c= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "smart-app-banner",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46200",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "News Ticker Widget for Elementor \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "news-ticker-widget-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22812",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Typebot | Build beautiful conversational forms \u003c 1.4.3 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "typebot",
    "type": "plugin",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24902",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.8.5 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-3891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-3891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "woo-smart-quick-view",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "accordion-slider",
    "type": "plugin",
    "affected_version": "* - 1.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.47.7212",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.47.7212",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "envira-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 1.8.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.286",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.286",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "visual-portfolio",
    "type": "plugin",
    "affected_version": "* - 3.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "easy-fancybox",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "the-plus-addons-for-block-editor",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "fancybox-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "wp-carousel-free",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.59.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.59.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library",
    "slug": "easy-facebook-likebox-premium",
    "type": "plugin",
    "affected_version": "* - 6.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.2 - Authenticated Privilege Escalation",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "[*, 2.10.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24158",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Fancy User List \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fancy-user-listing",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51889",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Hijri \u003c= 1.5.3 - Reflected Cross-Site Scripting",
    "slug": "wp-hijri",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32560",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SMS \u003c= 6.1.4 - Reflected Cross-Site Scripting via 'delete_mobile'",
    "slug": "wp-sms",
    "type": "plugin",
    "affected_version": "* - 6.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32742",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AWeber Forms by Optin Cat \u003c= 2.5.7 - Reflected Cross-Site Scripting",
    "slug": "aweber-wp",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11325",
    "auth_type": "Unauth",
    "cvss_score": 5.2,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Builder \u003c= 4.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via livesite-pay Shortcode",
    "slug": "contact-form-with-a-meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10056",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdSense-Deluxe \u003c= 0.8 - Cross-Site Request Forgery",
    "slug": "adsense-deluxe",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-2828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-2828",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 2.0.5 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2006-6808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-6808",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Airbnb Review Slider \u003c= 3.2 - Cross-Site Request Forgery",
    "slug": "wp-airbnb-review-slider",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23890",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unilevel MLM Plan \u003c= 1.1.0 - Reflected Cross-Site Scripting via 'page'",
    "slug": "unilevel-mlm-plan",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12324",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WIP Incoming Lite \u003c= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wip-incoming-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11416",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Employee Spotlight \u003c= 5.1.1 - Unauthenticated PHP Object Injection",
    "slug": "employee-spotlight",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53583",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Potent Donations for WooCommerce \u003c= 1.1.9 - Cross-Site Request Forgery in hm_wcdon_admin_page",
    "slug": "donations-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35912",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CATS Job Listings \u003c= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cats-job-listings",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13577",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup | Custom Popup Builder \u003c= 1.3 - Denial of Service",
    "slug": "m-wp-popup",
    "type": "plugin",
    "affected_version": "[*, 1.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0214",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Ibtana – WordPress Website Builder \u003c= 1.1.4.7 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "ibtana-visual-editor",
    "type": "plugin",
    "affected_version": "[*, 1.1.4.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25014",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Custom Templates Lite \u003c= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-custom-templates-lite",
    "type": "plugin",
    "affected_version": "* - 1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31767",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) \u003c= 3.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "leaflet-maps-marker",
    "type": "plugin",
    "affected_version": "* - 3.12.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3670",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sliding Widgets \u003c= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "sliding-widgets",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33938",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPFront User Role Editor \u003c= 3.2.1.11184 - Limited Information Exposure",
    "slug": "wpfront-user-role-editor",
    "type": "plugin",
    "affected_version": "* - 3.2.1.11184",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1.11184",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2931",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Driving Directions \u003c= 1.4.4 - Reflected Cross-Site Scripting",
    "slug": "ddirections",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28903",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TwitterPosts \u003c= 1.0.2 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "twitter-posts",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7297",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive Contact Form Builder \u0026 Lead Generation Plugin \u003c 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "lead-form-builder",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-23179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23179",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PPOM for WooCommerce \u003c= 23.9 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "woocommerce-product-addon",
    "type": "plugin",
    "affected_version": "* - 23.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "23.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25018",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.4.9.4 - Missing Authorization to Email Disclosure",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.4.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6155",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Xorbin Digital Flash Clock \u003c 1.0 - DOM Cross-Site Scripting",
    "slug": "xorbin-digital-flash-clock",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-4693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4693",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Like Page Plugin \u003c= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-facebook-plugin",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3583",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LWS Tools \u003c= 2.3.1 - Cross-Site Request Forgery",
    "slug": "lws-tools",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-27453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27453",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Login with phone number  \u003c= 1.4.2 - Reflected Cross-Site Scripting",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "[*, 1.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-23492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23492",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PVN Auth Popup \u003c= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pvn-auth-popup",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6713",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnDash LMS \u003c= 4.10.1 - Sensitive Information Exposure via assignments",
    "slug": "sfwd-lms",
    "type": "plugin",
    "affected_version": "* - 4.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1209",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Libsyn Publisher Hub \u003c= 1.4.4 - Sensitive Information Exposure",
    "slug": "libsyn-podcasting",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45834",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.3 - Reflected Cross-Site Scripting via date",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4215",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Calendar – Google Calendar Plugin \u003c= 3.4.2 - Reflected Cross-Site Scripting",
    "slug": "google-calendar-events",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8549",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-DownloadManager Plugin \u003c 1.61 - Cross-Site Scripting",
    "slug": "wp-download-manager",
    "type": "plugin",
    "affected_version": "[*, 1.61)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.61",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-2697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2697",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Extension For Mailchimp \u003c= 0.5.70 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "contact-form-7-mailchimp-extension",
    "type": "plugin",
    "affected_version": "* - 0.5.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22134",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Modern Events Calendar \u003c= 7.21.9 - Information Exposure",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 7.21.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.21.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5733",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "jQuery T(-) Countdown Widget \u003c= 2.3.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde",
    "slug": "jquery-t-countdown-widget",
    "type": "plugin",
    "affected_version": "* - 2.3.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0171",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Author Bio \u003c= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "social-autho-bio",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30545",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swifty Bar, sticky bar by WPGens \u003c= 1.2.10 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "swifty-bar",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41737",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FireStorm Shopping Cart eCommerce Plugin \u003c= 2.07.02 - SQL Injection",
    "slug": "fs-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 2.07.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.07.02",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10951",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Business Card \u003c= 1.0.0 - Authenticated (Admin+) Arbitrary File Uplaod",
    "slug": "business-card-by-esterox-100",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5807",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "KiviCare \u003c= 3.2.0 - Reflected Cross-Site Scripting via 'filterType'",
    "slug": "kivicare-clinic-management-system",
    "type": "plugin",
    "affected_version": "[*, 3.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2624",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Online Booking and Scheduling Plugin – Bookly \u003c= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter",
    "slug": "bookly-responsive-appointment-booking-tool",
    "type": "plugin",
    "affected_version": "* - 23.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "23.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5584",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Permalink Manager Lite \u003c= 2.2.12 - Admin+ SQL Injection",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24769",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CMSMasters Content Composer \u003c 2.5.7 - Unauthenticated Local File Inclusion",
    "slug": "cmsmasters-content-composer",
    "type": "plugin",
    "affected_version": "[*, 2.5.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-4414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4414",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Question Answer \u003c= 1.2.70 - Reflected Cross-Site Scripting",
    "slug": "question-answer",
    "type": "plugin",
    "affected_version": "* - 1.2.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32646",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget Options \u003c= 4.0.8 - Missing Authorization to Notice Dismissal",
    "slug": "widget-options",
    "type": "plugin",
    "affected_version": "* - 4.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22722",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Staff Directory – Employee Directory for WordPress \u003c= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "employee-directory",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5531",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow SE \u003c= 2.5.20 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "slideshow-se",
    "type": "plugin",
    "affected_version": "* - 2.5.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35769",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GWP-Histats \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gwp-histats",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33926",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Photo Gallery Final Tiles Grid \u003c= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "final-tiles-grid-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 2.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3710",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clyp \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "clyp",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51617",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder \u003c= 3.4.8 - Admin Access via Password Reset",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "[*, 3.4.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24527",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VS Contact Form \u003c= 13.9 - Missing Authorization",
    "slug": "very-simple-contact-form",
    "type": "plugin",
    "affected_version": "* - 13.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41862",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Addpub \u003c= 1.2.8 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-addpub",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5563",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ruby Help Desk \u003c= 1.3.3 - Missing Authorization to Arbitrary Ticket Modification",
    "slug": "ruby-help-desk",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1125",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TwentyTwenty \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "twentytwenty",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11352",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Course Booking System \u003c= 6.1.2 - Reflected Cross-Site Scripting",
    "slug": "course-booking-system",
    "type": "plugin",
    "affected_version": "* - 6.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32508",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meta pixel for WordPress \u003c= 2.2.2 - PHP Object Injection",
    "slug": "official-facebook-pixel",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24217",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Custom Pages \u003c= 0.5.0.1 - Path Traversal",
    "slug": "wp-custom-pages",
    "type": "plugin",
    "affected_version": "* - 0.5.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2011-1669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-1669",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Contact Form by BestWebSoft \u003c= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_address",
    "slug": "contact-form-plugin",
    "type": "plugin",
    "affected_version": "* - 4.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2198",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MaxA/B \u003c= 2.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "maxab",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28933",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Menu Plugin — Superfly Responsive Menu \u003c= 5.0.29 - Cross-Site Request Forgery to Arbitrary File Deletion",
    "slug": "superfly-menu",
    "type": "plugin",
    "affected_version": "* - 5.0.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.29",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3238",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Certain Time to Show Content \u003c= 1.2.2 - Reflected Cross-Site Scripting",
    "slug": "simple-certain-time-to-show-content",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10152",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FREE DOWNLOAD MANAGER \u003c= 1.0.0 - Unauthenticated Arbitrary File Download",
    "slug": "free-download-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49315",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Abstracts \u003c= 2.7.3 - Cross-Site Request Forgery to Arbitrary Account Deletion",
    "slug": "wp-abstracts-manuscripts-manager",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12386",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "The Great Firewords of China \u003c= 1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "sensitive-chinese-words-scanner",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22771",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenverse \u003c= 1.8.5 - Missing Authorization via 'data/update' API Endpoint",
    "slug": "gutenverse",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35875",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MSTW League Manager \u003c= 2.10 - Cross-Site Request Forgery",
    "slug": "mstw-league-manager",
    "type": "plugin",
    "affected_version": "* - 2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58852",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Property Hive \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12585",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPFunnels \u003c= 2.7.16 - Reflected Cross-Site Scripting",
    "slug": "wpfunnels",
    "type": "plugin",
    "affected_version": "* - 2.7.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37977",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Table by WBW \u003c= 2.1.2 - Unuthenticated SQL Injection",
    "slug": "woo-product-tables",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13234",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Photo Gallery - GT3 Image Gallery \u0026 Gutenberg Block Gallery \u003c= 2.7.7.24 - Reflected Cross-Site Scripting",
    "slug": "gt3-photo-video-gallery",
    "type": "plugin",
    "affected_version": "* - 2.7.7.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24707",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Request Forgery to Authentication Takeover",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.3",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9033",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Request Forgery to Authentication Takeover",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.3",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9033",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Request Forgery to Authentication Takeover",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.1",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9033",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Request Forgery to Authentication Takeover",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9033",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Praison SEO WordPress \u003c= 4.0.15 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "seo-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34801",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProveSource Social Proof \u003c= 3.0.5 - Unauthenticated Sensitive Information Disclosure",
    "slug": "provesource",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48355",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "cformsII \u003c= 15.0.4 - Cross-Site Request Forgery leading to Settings Updates",
    "slug": "cforms2",
    "type": "plugin",
    "affected_version": "* - 15.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25449",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Side Slide Responsive Menu \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "side-slide-responsive-menu",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9880",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Predictive Search \u003c= 5.8.0 - Missing Authorization via multiple AJAX actions",
    "slug": "woocommerce-predictive-search",
    "type": "plugin",
    "affected_version": "* - 5.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32963",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Frontend Profile \u003c= 1.3.1 - Unauthenticated Privilege Escalation",
    "slug": "wp-front-end-profile",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51483",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PowerBI Embed Reports \u003c= 1.2.0 - Unauthenticated Sensitive Information Disclosure",
    "slug": "embed-power-bi-reports",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10750",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 4.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2742",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP RSS Aggregator \u003c= 4.19.2 - Subscriber+ Stored Cross-Site Scripting",
    "slug": "wp-rss-aggregator",
    "type": "plugin",
    "affected_version": "[*, 4.19.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24988",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyWorks WooCommerce Sync for QuickBooks Online \u003c= 2.9.1 - Reflected Cross-Site Scripting",
    "slug": "myworks-woo-sync-for-quickbooks-online",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32524",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fleetwire Fleet Management Plugin \u003c= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via fleetwire_list Shortcode",
    "slug": "fleetwire-fleet-management",
    "type": "plugin",
    "affected_version": "* - 1.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6261",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder \u003c= 3.9.7 - Missing Authorization to Initial Page Creation",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "[*, 3.9.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4059",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inline Tweets \u003c= 2.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "inline-tweets",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22570",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pretty Links Lite \u003c 1.6.3 - Stored Cross-Site Scripting",
    "slug": "pretty-link",
    "type": "plugin",
    "affected_version": "[*, 1.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-1636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1636",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Masteriyo - LMS \u003c= 1.11.6 - Missing Authorization",
    "slug": "learning-management-system",
    "type": "plugin",
    "affected_version": "* - 1.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43159",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Rankology SEO – On-site SEO \u003c= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "rankology-seo-all-in-one-seo-analytics",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32491",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DuoGeek Blocks  0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "duogeek-blocks",
    "type": "plugin",
    "affected_version": "0.1.1",
    "from_version": "0.1.1",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51868",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swift Framework \u003c= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update",
    "slug": "swift-framework",
    "type": "plugin",
    "affected_version": "* - 2.7.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3915",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c= 4.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12770",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MF Gig Calendar \u003c= 1.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mf-gig-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3755",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 – Dynamic Text Extension \u003c= 4.5 - Information Disclosure via Shortcode",
    "slug": "contact-form-7-dynamic-text-extension",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10084",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Projects Portfolio with Client Testimonials \u003c= 3.0 - Reflected Cross-Site Scripting",
    "slug": "wp-projects-portfolio",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13114",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS Icon Widget \u003c= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "rss-icon-widget",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12203",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Active Products Tables for WooCommerce \u003c= 1.0.6.2 - Missing Authorization",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32691",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "iframe \u003c= 4.4 - Authenticated Stored Cross Site Scripting",
    "slug": "iframe",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-12696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12696",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel Engine – Tour Booking Plugin – Tour Operator Software \u003c= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 6.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7526",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Customer Reviews \u003c= 3.0.8 - Cross-Site Request Forgery",
    "slug": "wp-customer-reviews",
    "type": "plugin",
    "affected_version": "[*, 3.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10902",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP w3all phpBB \u003c= 2.9.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-w3all-phpbb-integration",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32575",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-SVG \u003c= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-svg",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11644",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Products Manager for WooCommerce \u003c= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "related-products-manager-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50045",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Job Manager \u003c= 2.0.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "js-jobs",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32146",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dovetail \u003c= 1.2.13 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dovetail",
    "type": "plugin",
    "affected_version": "* - 1.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25984",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hover Effects for Elementor \u003c= 1.0.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "image-hover-effects-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 1.0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22323",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Push Notifications for WordPress by PushAssist \u003c= 3.0.8 - Reflected Cross-Site Scripting",
    "slug": "push-notification-for-wp-by-pushassist",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0644",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tweeple \u003c= 0.9.5 - Reflected Cross-Site Scripting via id",
    "slug": "tweeple",
    "type": "plugin",
    "affected_version": "* - 0.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30781",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Egg \u003c= 5.3.0 - Reflected Cross-Site Scripting",
    "slug": "content-egg",
    "type": "plugin",
    "affected_version": "[*, 5.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0428",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Keep Backup Daily \u003c= 2.0.8 - Unauthenticated Information Disclosure",
    "slug": "keep-backup-daily",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48024",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Betheme \u003c= 26.6.2 - Missing Authorization to Post Title Change",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 26.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45349",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Drag \u0026 Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications \u0026 more! \u003c= 1.4.19 - Reflected Cross-Site Scripting",
    "slug": "pie-forms-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.4.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11436",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Downloads List \u003c= 1.4.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "simple-downloads-list",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13594",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light \u003c= 2.4.37 - Unauthenticated Local File Inclusion",
    "slug": "excel-like-price-change-for-woocommerce-and-wp-e-commerce-light",
    "type": "plugin",
    "affected_version": "* - 2.4.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.37",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39378",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sellsy \u003c= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sellsy",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12592",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ClickWhale \u003c= 2.4.6 - Missing Authorization",
    "slug": "clickwhale",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47612",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \u003c= 3.2.0.1 - Missing Authorization to Privilege Escalation",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 3.2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4958",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ListApp Mobile Manager \u003c= 1.7.7 - Missing Authorization to Privilege Escalation",
    "slug": "listapp-mobile-manager",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54295",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "eCommerce Product Catalog \u003c= 3.3.26 - Sensitive Information Exposure via CSV Files",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "[*, 3.3.27)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.27",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-51688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51688",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.1.1 - Missing Authorization to Authenticated (Subscriber+) Order Information Disclosure",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48333",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Eventin \u003c= 3.3.57 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 3.3.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.57",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37507",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PW WooCommerce On Sale! \u003c= 1.39 - Missing Authorization",
    "slug": "pw-woocommerce-on-sale",
    "type": "plugin",
    "affected_version": "* - 1.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49888",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager  \u003c= 4.70 - Missing Authorization Stored Cross-Site Scripting",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31118",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARForms Form Builder \u003c= 1.6.1 - Missing Authorization",
    "slug": "arforms-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31270",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElementsReady Addons for Elementor \u003c= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "element-ready-lite",
    "type": "plugin",
    "affected_version": "* - 6.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9444",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11372",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "BuddyPress XProfile Custom Image Field \u003c= 3.0.1 - Unauthenticated Arbitrary File Deletion",
    "slug": "buddypress-xprofile-image-field",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48158",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP QuickLaTeX \u003c= 3.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-quicklatex",
    "type": "plugin",
    "affected_version": "* - 3.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5529",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPQA - Builder forms Addon For WordPress \u003c 5.2 - Stored Cross-Site Scripting via Profile fields",
    "slug": "wpqa",
    "type": "plugin",
    "affected_version": "[*, 5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1051",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Superb slideshow gallery \u003c= 13.1 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "superb-slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5434",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Helpful \u003c= 4.5.25 - Sensitive Information Disclosure",
    "slug": "helpful",
    "type": "plugin",
    "affected_version": "* - 4.5.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2834",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Elementor \u003c= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.24.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.24.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6757",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4945",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.8 - Insecure Direct Object Reference",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8123",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher Widget",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.12.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1393",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup and Staging by WP Time Capsule \u003c= 1.22.21 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "wp-time-capsule",
    "type": "plugin",
    "affected_version": "* - 1.22.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49684",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pet World \u003c= 2.8 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "petsworld",
    "type": "theme",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32284",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.1.3",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-34624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34624",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slazzer Background Changer \u003c= 3.14 - Missing Authorization",
    "slug": "slazzer-background-changer",
    "type": "plugin",
    "affected_version": "* - 3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39531",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Awin Data Feed \u003c= 1.7 - Reflected Cross-Site Scripting",
    "slug": "awin-data-feed",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1937",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3DPrint \u003c= 3.5.4.7 - Cross-Site Request Forgery to Arbitrary File Deletion",
    "slug": "3dprint",
    "type": "plugin",
    "affected_version": "* - 3.5.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3899",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image horizontal reel scroll slideshow \u003c= 13.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "image-horizontal-reel-scroll-slideshow",
    "type": "plugin",
    "affected_version": "* - 13.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52492",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for WPBakery Page Builder \u003c= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "Ultimate_VC_Addons",
    "type": "plugin",
    "affected_version": "* - 3.19.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5253",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.34",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.32",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.32",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.24",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.7",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.4",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.23",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.19",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.14",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.15",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.31",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.22",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.18",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.10",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.6",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.2",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.34",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.31",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.28",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.1",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hotel Galaxy \u003c= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hotel-galaxy",
    "type": "theme",
    "affected_version": "* - 4.4.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43991",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Name Directory \u003c= 1.29.0 - Reflected Cross-Site Scripting",
    "slug": "name-directory",
    "type": "plugin",
    "affected_version": "* - 1.29.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43938",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Free Downloads \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "edd-free-downloads",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9514",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPress Podcasting \u003c= 11.12.6 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 11.12.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.12.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32691",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "The Novel Design Store Directory \u003c= 4.3.0 - Unauthenticated Arbitrary File Upload",
    "slug": "noveldesign-store-directory",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-51788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51788",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks \u003c= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.80",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Woo Search \u003c= 2.96 - Reflected Cross-Site Scripting",
    "slug": "advanced-woo-search",
    "type": "plugin",
    "affected_version": "* - 2.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.96",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0251",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Powie's Uptime Robot \u003c= 0.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "powies-uptime-robot",
    "type": "plugin",
    "affected_version": "* - 0.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30638",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Limit Login Attempts \u003c= 4.0.4 - Stored Cross-Site Scripting",
    "slug": "miniorange-limit-login-attempts",
    "type": "plugin",
    "affected_version": "[*, 4.0.50)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.50",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24657",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 1.1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-notify-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26882",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kognetiks Chatbot for WordPress \u003c= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "chatbot-chatgpt",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35738",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Connexion Logs \u003c= 3.0.2 - Authenticated (Admin+) SQL Injection",
    "slug": "logs-de-connexion",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11372",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Job Manager - \u003c 0.7.23 - Stored Cross-Site Scripting",
    "slug": "job-manager",
    "type": "plugin",
    "affected_version": "[*, 0.7.23)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.23",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-2321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2321",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sendle Shipping \u003c= 5.17 - Reflected Cross-Site Scripting",
    "slug": "official-sendle-shipping-method",
    "type": "plugin",
    "affected_version": "* - 5.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45761",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API – Create Native Android \u0026 iOS Apps On The Cloud \u003c= 4.17.4 - Unauthenticated Limited Privilege Escalation",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.17.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.17.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3438",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Favicon Generator \u003c= 1.5 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "favicon-generator",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7863",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Attractive Donations System \u003c 1.29 - Cross-Site Request Forgery",
    "slug": "wp-attractive-donations-system-easy-stripe-paypal-donations",
    "type": "plugin",
    "affected_version": "[*, 1.29)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-58956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58956",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Invoices \u003c= 1.0.3 - Cross-Site Scripting",
    "slug": "edd-invoices",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9516",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feedpress Generator – External RSS Frontend Customizer \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "feedpress-generator",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11457",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Autotitle for WordPress \u003c= 1.0.3 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting",
    "slug": "autotitle-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6946",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Demo Importer – A Modern One-Click Demo Import Solution \u003c= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "easy-demo-importer",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9071",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Affiliate \u003c= 2.3 - Reflected Cross-Site Scripting",
    "slug": "wc-affiliate",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12321",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Telegram for WP \u003c= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "telegram-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5939",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "When Last Login \u003c= 1.2.1 - Cross-Site Request Forgery via wll_hide_subscription_notice",
    "slug": "when-last-login",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27461",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UltraLight \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "the-ultralight",
    "type": "theme",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23998",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "B Slider- Gutenberg Slider Block for WP \u003c= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation",
    "slug": "b-slider",
    "type": "plugin",
    "affected_version": "* - 1.1.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.30",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8418",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 6.3.0 - Unauthenticated SQL Injection",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 6.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4458",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WHMpress \u003c= 6.2-revision-9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "whmpress",
    "type": "plugin",
    "affected_version": "[*, 6.2-revision-9]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2-revision-9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39492",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple File List  \u003c= 4.4.11 - Reflected Cross-Site Scripting",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "* - 4.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3207",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBITS Addons For Elementor Page Builder \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpbits-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56285",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager \u003c= 4.71 - Insecure Direct Object Reference",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3748",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Explore pages \u003c= 1.01 - Reflected Cross-Site Scripting",
    "slug": "explore-pages",
    "type": "plugin",
    "affected_version": "* - 1.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23563",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CubePM \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "cubepm",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23574",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chat Button \u003c= 1.8.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "whatshelp-chat-button",
    "type": "plugin",
    "affected_version": "* - 1.8.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32292",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Limit Login Attempts Reloaded \u003c= 2.25.25 - Missing Authorization",
    "slug": "limit-login-attempts-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.25.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5525",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tune Library \u003c 1.5.5 - SQL Injection",
    "slug": "tune-library",
    "type": "plugin",
    "affected_version": "[*, 1.5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-3314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3314",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 5.3.1 - Authenticated (or Cross-Site Request Forgery) Blind SQL Injection",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "[*, 5.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0439",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.4.3 - Unauthenticated SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28982",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Redirect After Login \u003c= 0.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "redirect-after-login",
    "type": "plugin",
    "affected_version": "* - 0.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27624",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Contact Button \u003c= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "floating-contact",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7891",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NEX-Forms \u003c= 7.7.1 - Missing Authorization on Various AJAX Actions",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 7.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36670",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Wordpress Plugin Smart Product Review \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload",
    "slug": "smart-product-review",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-4455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4455",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Font Awesome 4 Menus \u003c= 4.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "font-awesome-4-menus",
    "type": "plugin",
    "affected_version": "* - 4.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3829",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customizer Export/Import \u003c= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import",
    "slug": "customizer-export-import",
    "type": "plugin",
    "affected_version": "* - 0.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7620",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Sticky Social \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-sticky-social",
    "type": "plugin",
    "affected_version": "1.0.1",
    "from_version": "1.0.1",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lock Your Updates \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "lock-your-updates",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32537",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Animated Typed JS Shortcode \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "animated-typed-js-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38679",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Entries \u003c= 1.2.3 - Reflected Cross-Site Scripting",
    "slug": "contact-form-entries",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25079",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Binary MLM Plan \u003c= 3.0 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "binary-mlm-plan",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11895",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Bulk NoIndex \u0026 NoFollow Toolkit \u003c= 1.42 - Reflected Cross-Site Scripting via 's'",
    "slug": "bulk-noindex-nofollow-toolkit-by-mad-fish",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-45065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45065",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donation Block For PayPal \u003c=  2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "donations-block",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0535",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Menu Manager | WPZest \u003c= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "easy-menu-manager-wpzest",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9366",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media-Tags \u003c= 3.2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "media-tags",
    "type": "plugin",
    "affected_version": "* - 3.2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24899",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 4.7 - SQL Injection",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "[*, 4.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24750",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Forms for ACF \u003c= 1.6.8 - Insecure Direct Object Reference",
    "slug": "advanced-forms",
    "type": "plugin",
    "affected_version": "[*, 1.6.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24892",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Statistics for Feeds \u003c= 20250322 - Cross-Site Request Forgery",
    "slug": "simple-feed-stats",
    "type": "plugin",
    "affected_version": "* - 20250322",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20250322",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57892",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Canonical Attachments \u003c= 1.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "canonical-attachments",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32543",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Meta \u003c= 3.1.2 - Reflected Cross-Site Scripting",
    "slug": "user-meta",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47611",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import / Export Customizer Settings \u003c= 1.0.3 - Cross-Site Request Forgery Bypass",
    "slug": "astra-import-export",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36737",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Replace Default Words \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "replace-default-words",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Database Cleaner \u003c= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action",
    "slug": "advanced-database-cleaner",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0668",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Similarity \u003c= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "similarity",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3972",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rife Elementor Extensions \u0026 Templates \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rife-elementor-extensions",
    "type": "plugin",
    "affected_version": "[*, 1.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24265",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "URL Shortener by MyShop \u003c= 1.0.17 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mts-url-shortener",
    "type": "plugin",
    "affected_version": "* - 1.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5802",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woody Ad Snippets \u003c= 2.2.8 - Authenticated Cross-Site Scripting",
    "slug": "insert-php",
    "type": "plugin",
    "affected_version": "[*, 2.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16289",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.6.2 - SQL Injection",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1281",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Partners \u003c= 0.2.0 - Unauthenticated PHP Object Injection",
    "slug": "partners",
    "type": "plugin",
    "affected_version": "* - 0.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56059",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Link Whisper Free \u003c= 0.6.9",
    "slug": "link-whisper",
    "type": "plugin",
    "affected_version": "* - 0.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31934",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Read and Understood \u003c 2.2 - Cross-Site Scripting",
    "slug": "read-and-understood",
    "type": "plugin",
    "affected_version": "[*, 2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5668",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "amtyThumb posts \u003c= 8.2.0 - Cross-Site Scripting",
    "slug": "amty-thumb-recent-post",
    "type": "plugin",
    "affected_version": "* - 8.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17059",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pods 2.4.4.1 - 2.7.26 - Authenticated Stored Cross-Site Scripting",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "[2.4.4.1, 2.7.27)",
    "from_version": "2.4.4.1",
    "from_inclusive": true,
    "to_version": "2.7.27",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24338",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FooGallery \u003c= 1.8.12 - Cross-Site Scripting",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 1.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20182",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My auctions allegro \u003c= 3.6.20 - Authenticated (Contributor+) SQL Injection",
    "slug": "my-auctions-allegro-free-edition",
    "type": "plugin",
    "affected_version": "* - 3.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31542",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Google Street View \u003c= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-google-street-view",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30799",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Online Order for Clover \u003c= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion",
    "slug": "clover-online-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7032",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Get Cash \u003c= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "get-cash",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58823",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP JobHunt \u003c= 7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Account Deletion",
    "slug": "wp-jobhunt",
    "type": "plugin",
    "affected_version": "* - 7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6585",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Turnkey bbPress by WeaverTheme \u003c= 1.6.3 - Reflected Cross-Site Scripting via _wpnonce Parameter",
    "slug": "weaver-for-bbpress",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO LAT Auto Post \u003c= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)",
    "slug": "seo-beginner-auto-post",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12252",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gravity 2 PDF \u003c= 3.1.3 - Reflected Cross-Site Scripting",
    "slug": "gf2pdf",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28911",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPML \u003c 3.1.9 - Cross-Site Scripting",
    "slug": "wpml",
    "type": "plugin",
    "affected_version": "[*, 3.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-2315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2315",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Help Desk \u003c= 2.7.1 - Unauthenticated SQL Injection",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47151",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Awesome Support – WordPress HelpDesk \u0026 Support Plugin \u003c 3.1.7 - Cross-Site Scripting",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "[*, 3.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9317",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Platform \u003c= 1.4.8 - Reflected Cross-Site Scripting",
    "slug": "smdp-affiliate-platform",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49645",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode Button \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcode-button",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10194",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Terms descriptions \u003c= 3.4.6 - Reflected Cross-Site Scripting",
    "slug": "terms-descriptions",
    "type": "plugin",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9374",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.6.0 - Authenticated(Student+) HTML Injection via Q\u0026A",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1128",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CM WordPress Search And Replace Plugin \u003c= 1.3.8 - Cross-Site Request Forgery to Plugin Setting Reset",
    "slug": "cm-on-demand-search-and-replace",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5028",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CLUEVO LMS, E-Learning Platform \u003c= 1.13.2 - Cross-Site Request Forgery to Module Deletion",
    "slug": "cluevo-lms",
    "type": "plugin",
    "affected_version": "* - 1.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11444",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tera Charts \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "tera-charts",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000151",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.29",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.23",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.13",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.1",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.2",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.26",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.26",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.18",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.5",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.27",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.19",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.17",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.13",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.29",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.9",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.10",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Language Translator \u003c= 5.0.05 - Cross-Site Scripting",
    "slug": "google-language-translator",
    "type": "plugin",
    "affected_version": "[*, 5.0.06)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.06",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10870",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] \u003c= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "faq-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5669",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cost Calculator Builder \u003c= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "* - 3.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6011",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login by Auth0 \u003c= 3.11.3 - Insecure Direct Object Reference",
    "slug": "auth0",
    "type": "plugin",
    "affected_version": "* - 3.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-7948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7948",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "TinyMCE Custom Styles \u003c= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tinymce-custom-styles",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2967",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Triggers Lite \u003c= 2.5.3 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-triggers-lite",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13095",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Email Subscription Popup \u003c= 1.2.16 - Reflected Cross-Site Scripting",
    "slug": "email-subscribe",
    "type": "plugin",
    "affected_version": "[*, 1.2.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-30489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30489",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Data Collector \u003c= 2.2.3 - Reflected Cross-Site Scripting",
    "slug": "form-data-collector",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11461",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog Designer \u003c= 3.1.8 - Missing Authorization",
    "slug": "blog-designer",
    "type": "plugin",
    "affected_version": "* - 3.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57990",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Builder, Contact Widget \u003c= 2.1.7 - Authentication Request Bypass",
    "slug": "contact-forms-builder",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35747",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Ajax Chat Plugin \u003c= 20220115 - Sensitive Information Disclosure",
    "slug": "simple-ajax-chat",
    "type": "plugin",
    "affected_version": "* - 20220115",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20220115",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27849",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Forget About Shortcode Buttons \u003c= 2.1.2 - Missing Authorization via fasc_buttons",
    "slug": "forget-about-shortcode-buttons",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32579",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Software Issue Manager \u003c= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter",
    "slug": "software-issue-manager",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8314",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto-hyperlink URLs \u003c= 5.4.1 - Tab Nabbing",
    "slug": "auto-hyperlink-urls",
    "type": "plugin",
    "affected_version": "* - 5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2600",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce \u0026 Most Popular Form Plugins. Also, Display Google sheet as a Table. \u003c= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "wpgsi",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6590",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Quick Paypal Payments \u003c= 5.7.25 - Authenticated (Contributor+) Cross Site Scripting",
    "slug": "quick-paypal-payments",
    "type": "plugin",
    "affected_version": "* - 5.7.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23889",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Keep \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "email-keep",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13825",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Politic \u003c= 2.3.7 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation",
    "slug": "wp-politic",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0504",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.4 - Missing Authorization to Test Email Sending",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5419",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CSV Import Export \u003c= 1.1 - Cross-Site Scripting",
    "slug": "csv-import-export",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17753",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WpGenius Job Listing \u003c= 1.0.2 - Stored Cross-Site Scripting",
    "slug": "wpgenious-job-listing",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39335",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail Subscribe List \u003c= 2.0.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "mail-subscribe-list",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-10026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-10026",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c= 3.2.3 - Missing Authorization",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24407",
    "auth_type": "Privileged",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Booster (\u003c= 5.6.2), Booster Plus (\u003c 6.0.0), and Booster Elite (\u003c 6.0.0) for WooCommerce - Reflected Cross-Site Scripting",
    "slug": "booster-plus-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 6.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4227",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster (\u003c= 5.6.2), Booster Plus (\u003c 6.0.0), and Booster Elite (\u003c 6.0.0) for WooCommerce - Reflected Cross-Site Scripting",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 5.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4227",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster (\u003c= 5.6.2), Booster Plus (\u003c 6.0.0), and Booster Elite (\u003c 6.0.0) for WooCommerce - Reflected Cross-Site Scripting",
    "slug": "booster-elite-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 6.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4227",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Japanized For WooCommerce \u003c= 2.5.6 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-for-japan",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0948",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Insert PHP Code Snippet \u003c= 1.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "insert-php-code-snippet",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0658",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Social Sharing \u003c= 2.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-social-sharing",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4198",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Youtube Video \u003c= 1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "embed-youtube-video",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24395",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MyWaze \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "my-waze",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25594",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Code Snippets \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "easy-code-snippets",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11464",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyForms \u003c= 2.7.2 - Authenticated (Contributor+) Stored Stored Cross-Site Scripting",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38971",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Spreadsheet \u003c= 0.62 - SQL Injection",
    "slug": "wpSS",
    "type": "plugin",
    "affected_version": "* - 0.62",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.62",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-8363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8363",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Express for Google \u003c= 0.3.2 - Reflected Cross-Site Scripting",
    "slug": "photo-express-for-google",
    "type": "plugin",
    "affected_version": "* - 0.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27361",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapSVG \u003c= 8.5.34 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "mapsvg",
    "type": "plugin",
    "affected_version": "* - 8.5.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47562",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPCasa \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpcasa",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39575",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML5 Radio Player - WPBakery Page Builder Addon \u003c= 2.5 - Unauthenticated Arbitrary File Upload",
    "slug": "lbg-cleverbakery",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31070",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Coupons for WooCommerce Coupons \u003c= 4.5 - Cross-Site Request Forgery",
    "slug": "advanced-coupons-for-woocommerce-free",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43481",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JoomSport – for Sports: Team \u0026 League, Football, Hockey \u0026 more \u003c= 5.2.5 - Authenticated (Admin+) SQL Injection via orderby",
    "slug": "joomsport-sports-league-results-management",
    "type": "plugin",
    "affected_version": "* - 5.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2718",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.14 - Missing Authorization in Several AJAX Actions",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6631",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Lenix scss compiler \u003c= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "lenix-scss-compiler",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60144",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Select Box Editor Button \u003c= 0.6 - Cross-Site Request Forgery",
    "slug": "contact-form-7-select-box-editor-button",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28902",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Website File Changes Monitor \u003c= 1.8.2 - Authenticated (Admin+) SQL Injection",
    "slug": "website-file-changes-monitor",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2269",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.10",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.8",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.5",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.4",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.17",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.17",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.14",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.9",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.20",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.20",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.18",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Abstracts \u003c= 2.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-abstracts-manuscripts-manager",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32591",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKT Addons for Elementor \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate and Creative Slider Widgets",
    "slug": "skt-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5091",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Gallery: Hybrid – Advanced Visual Gallery \u003c= 1.4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hybrid-gallery",
    "type": "plugin",
    "affected_version": "* - 1.4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23951",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2 - Reflected Cross-Site Scripting via ipf",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4212",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Waitlist Woocommerce ( Back in stock notifier ) \u003c= 2.7.5 - Reflected Cross-Site Scripting",
    "slug": "waitlist-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8724",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extra Product Options Builder for WooCommerce \u003c= 1.2.104 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "additional-product-fields-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.104",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.104",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31940",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Master Bar \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "master-bar",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51698",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ColorMag \u003c= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation",
    "slug": "colormag",
    "type": "theme",
    "affected_version": "* - 4.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9202",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6 - Cross-Site Request Forgery via meks_remove_notification",
    "slug": "meks-audio-player",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25989",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6 - Cross-Site Request Forgery via meks_remove_notification",
    "slug": "meks-simple-flickr-widget",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25989",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6 - Cross-Site Request Forgery via meks_remove_notification",
    "slug": "meks-easy-instagram-widget",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25989",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6 - Cross-Site Request Forgery via meks_remove_notification",
    "slug": "meks-easy-ads-widget",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25989",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6 - Cross-Site Request Forgery via meks_remove_notification",
    "slug": "meks-themeforest-smart-widget",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25989",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6 - Cross-Site Request Forgery via meks_remove_notification",
    "slug": "meks-easy-maps",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25989",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6 - Cross-Site Request Forgery via meks_remove_notification",
    "slug": "meks-smart-author-widget",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25989",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6 - Cross-Site Request Forgery via meks_remove_notification",
    "slug": "meks-time-ago",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25989",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6 - Cross-Site Request Forgery via meks_remove_notification",
    "slug": "meks-video-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25989",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6 - Cross-Site Request Forgery via meks_remove_notification",
    "slug": "meks-smart-social-widget",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25989",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Awesome Fitness Testimonials \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "awesome-fitness-testimonials",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51806",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Tickets – Accessible Event Ticketing \u003c= 2.0.16 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "my-tickets",
    "type": "plugin",
    "affected_version": "* - 2.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3761",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Computer Repair Shop \u003c= 3.8119 - Authenticated (Customer+) Privilege Esclation via Account Takeover",
    "slug": "computer-repair-shop",
    "type": "plugin",
    "affected_version": "* - 3.8119",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8119",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56061",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Hits Counter \u003c= 2.8.23 - Reflected Cross-Site Scripting",
    "slug": "hits-counter",
    "type": "plugin",
    "affected_version": "* - 2.8.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53725",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCS ( WordPress Custom Search ) \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpcs-wp-custom-search",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34418",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce - Store Exporter \u003c= 2.7.2 - Reflected Cross-Site Scripting via 'filter'",
    "slug": "woocommerce-exporter",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46822",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Show Posts \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-show-posts",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4459",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53796",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 1.6.6 - Missing Authorization",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4370",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Awesome Event Booking \u003c= 2.8.4 - Reflected Cross-Site Scripting",
    "slug": "awesome-event-booking",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31416",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ajax Contact Form \u003c= 2.2.2 - Cross-Site Request Forgery to Arbitrary Email Deletion",
    "slug": "wp-ajax-contact-form",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5808",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Title Experiments Free \u003c= 9.0.4 - Cross-Site Request Forgery",
    "slug": "wp-experiments-free",
    "type": "plugin",
    "affected_version": "* - 9.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22562",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "W3SPEEDSTER \u003c= 7.19 - Cross-Site Request Forgery via launch",
    "slug": "w3speedster-wp",
    "type": "plugin",
    "affected_version": "* - 7.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24708",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quick Restaurant Menu \u003c= 2.0.2 - Insecure Direct Object Reference",
    "slug": "quick-restaurant-menu",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0550",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.202",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.202",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10490",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajax Search Lite \u003c 4.12 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ajax-search-lite",
    "type": "plugin",
    "affected_version": "* - 4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7084",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGlobus – Multilingual Everything! \u003c= 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting via wpglobus_option[selector_wp_list_pages][show_selector]",
    "slug": "wpglobus",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5365",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds \u003c= 1.5.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting",
    "slug": "woo-wallet",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32584",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Mobile Pack \u003c= 3.4.1 - Cross-Site Request Forgery",
    "slug": "wordpress-mobile-pack",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37391",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "EventON \u003c= 2.2.16 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6910",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS Pro – eLearning and online course solution \u003c= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection",
    "slug": "tutor-pro",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6184",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Viral Loops WP Integration \u003c= 3.8.1 - Unauthenticated Sensitive Information Disclosure",
    "slug": "viral-loops-wp-integration",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31842",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Secret Meta \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "facebook-secret-meta",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25086",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SocialDriver \u003c 2024 - Prototype Pollution",
    "slug": "socialdriver",
    "type": "plugin",
    "affected_version": "[*, 2024)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4826",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Card Block \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "business-card-block",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26952",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search Exclude \u003c= 2.4.9 - Missing Authorization to Unauthenticated Plugin Settings Modification",
    "slug": "search-exclude",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2821",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Pages \u003c= 1.4.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ninja-page-categories-and-tags",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1454",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Launcher: Coming Soon \u0026 Maintenance Mode \u003c 1.0.11 - Stored Cross-Site Scripting",
    "slug": "launcher",
    "type": "plugin",
    "affected_version": "[*, 1.0.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-7411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-7411",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Golo - Directory \u0026 Listing, Travel WordPress Theme \u003c= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password Change",
    "slug": "golo",
    "type": "theme",
    "affected_version": "* - 1.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12876",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads \u003c= 2.11.2 - Reflected Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 2.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39354",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FAT Event Lite \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fat-event-lite",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Maker – Popup for opt-ins, lead gen, \u0026 more \u003c= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.18.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2336",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elastic Email Subscribe Form \u003c= 1.2.2 - Missing Authorization",
    "slug": "elastic-email-subscribe-form",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28985",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Charts \u003c= 3.3.2 - Unauthenticated Information Exposure",
    "slug": "ninja-charts",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58797",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Blightly Explorer \u003c= 2.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "blighty-explorer",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27321",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1  - Denial of Service via Long Password",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9034",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.0.1  - Denial of Service via Long Password",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.4",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9034",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.0.1  - Denial of Service via Long Password",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.4",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9034",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.0.1  - Denial of Service via Long Password",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.2",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9034",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.0.1  - Denial of Service via Long Password",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9034",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Plugin for Google Reviews \u003c= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "widget-google-reviews",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6884",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM Perks Forms \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "crm-perks-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30446",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cost Calculator Builder Pro \u003c= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "cost-calculator-builder-pro",
    "type": "plugin",
    "affected_version": "* - 3.1.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4789",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paytium: Mollie payment forms \u0026 donations \u003c= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25099",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cart66 Cloud \u003c= 2.3.7 - Reflected Cross-Site Scripting",
    "slug": "cart66-cloud",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32653",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteGuard WP Plugin \u003c= 1.7.6 - Login Page Disclosure",
    "slug": "siteguard",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37881",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Classic Addons – WPBakery Page Builder \u003c= 3.0 - Authenticated (Editor+) Local File Inclusion",
    "slug": "classic-addons-wpbakery-page-builder-addons",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56286",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Awesome Support \u003c= 6.3.5 - Authenticated (Support Manager+) PHP Object Injection",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58662",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Float Menu \u003c= 4.3 - Arbitrary Menu Deletion via Cross-Site Request Forgery",
    "slug": "float-menu",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0313",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form and Calls To Action by vcita \u003c= 2.7.1 - Missing Authorization to Authenticated (Subscriber+) Contact/Widget Toggle",
    "slug": "lead-capturing-call-to-actions-by-vcita",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13717",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form Block \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "form-block",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-30616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30616",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Estatebud – Properties \u0026 Listings \u003c= 5.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "estatebud-properties-listings",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23994",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carousel, Slider, Gallery by WP Carousel \u003c= 2.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-carousel-free",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13314",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPsoonOnlinePage \u003c= 1.9 - Cross-Site Request Forgery",
    "slug": "wp-soononline-page",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49760",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpSOL \u003c= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wpsol",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22343",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c= 2.1.7 - Cross-Site Scripting",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "[*, 2.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5671",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 3.3.1 - Reflected Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27987",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPS Hide Login \u003c= 1.5.2.2 - Login Page Disclosure via 'action=rp'",
    "slug": "wps-hide-login",
    "type": "plugin",
    "affected_version": "* - 1.5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15825",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "1app Business Forms \u003c= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "1app-business-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44631",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zippy \u003c= 1.6.5 - Authenticated(Author+) PHP Object Injection via unzipPosts",
    "slug": "zippy",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-36381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36381",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Trusty Whistleblowing \u003c= 1.5.2 - Missing Authorization",
    "slug": "trusty-whistleblowing-solution",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52818",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Board Document Manager from CHUHPL \u003c= 1.9.1 - Reflected Cross-Site Scripting",
    "slug": "board-document-manager-from-chuhpl",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54238",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leaky Paywall \u003c= 4.16.5 Authenticated Stored Cross-Site Scripting",
    "slug": "leaky-paywall",
    "type": "plugin",
    "affected_version": "* - 4.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39357",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ocean Extra \u003c= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49068",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Asset CleanUp: Page Speed Booster \u003c= 1.3.9.8 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "wp-asset-clean-up",
    "type": "plugin",
    "affected_version": "* - 1.3.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53738",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Bootstrap Menu \u003c= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "my-bootstrap-menu",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30527",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Notices \u003c= 6.1 - Reflected Cross-Site Scripting",
    "slug": "notices",
    "type": "plugin",
    "affected_version": "* - 6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38328",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kona Gallery Block \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kona-instagram-feed-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25080",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Forms - Drag \u0026 Drop Contact Form Builder \u003c= 1.0.5 - Authenticated (Admin+) Arbitrary System File Read",
    "slug": "lastform",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24689",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Invite Anyone \u003c 1.3.16 - Cross-Site Request Forgery",
    "slug": "invite-anyone",
    "type": "plugin",
    "affected_version": "[*, 1.3.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18544",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All in One SEO Pack \u003c= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "[*, 3.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-35946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35946",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tainacan \u003c= 0.20.7 - Missing Authorization",
    "slug": "tainacan",
    "type": "plugin",
    "affected_version": "* - 0.20.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.20.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30529",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Heat Trackr \u003c 1.01 - Reflected Cross-Site Scripting",
    "slug": "heat-trackr",
    "type": "plugin",
    "affected_version": "[*, 1.01)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-1000136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000136",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Delivery Date for WooCommerce - Lite \u003c= 2.8.0 - Reflected Cross-Site Scripting",
    "slug": "product-delivery-date-for-woocommerce-lite",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10882",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TS Poll – Survey, Versus Poll, Image Poll, Video Poll \u003c= 2.3.9 - Authenticated (Admin+) SQL Injection",
    "slug": "poll-wp",
    "type": "plugin",
    "affected_version": "* - 2.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8625",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP User Merger \u003c= 1.5.2 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-user-merger",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3848",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP ERP \u003c= 1.13.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12808",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Obfuscate Shortcode \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "email-obfuscate-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Breakdance \u003c= 1.7.2 - Missing Authorization",
    "slug": "breakdance",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5331",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spotlight Social Media Feeds \u003c= 1.6.10 - Cross-Site Request Forgery",
    "slug": "spotlight-social-photo-feeds",
    "type": "plugin",
    "affected_version": "* - 1.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31381",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "got (JS Package) \u003c= 11.8.4 and 12.0-\u003c12.1.0 - Open Redirect",
    "slug": "simple-page-ordering",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-33987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33987",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "got (JS Package) \u003c= 11.8.4 and 12.0-\u003c12.1.0 - Open Redirect",
    "slug": "simple-podcasting",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-33987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33987",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "got (JS Package) \u003c= 11.8.4 and 12.0-\u003c12.1.0 - Open Redirect",
    "slug": "safe-redirect-manager",
    "type": "plugin",
    "affected_version": "* - 1.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-33987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33987",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Geo Controller \u003c= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution",
    "slug": "cf-geoplugin",
    "type": "plugin",
    "affected_version": "* - 8.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7381",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Affiliate Manager \u003c= 2.8.6 - Admin+ SQL injection",
    "slug": "affiliates-manager",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24844",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Rentals \u003c= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wprentals",
    "type": "theme",
    "affected_version": "* - 3.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53330",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.2 - Reflected Cross-Site Scripting via dn",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4213",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print My Blog – Print, PDF, \u0026 eBook Converter WordPress Plugin \u003c= 3.4.1 - Cross-Site Request Forgery",
    "slug": "print-my-blog",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24636",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Notifikácie.sk \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "notifikacie-sk",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23596",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cart66 Cloud \u003c= 2.3.7 - Unauthenticated Information Exposure",
    "slug": "cart66-cloud",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2841",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Advanced lazy load \u003c=  1.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "advanced-lazy-load",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46508",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sheets To WP Table Live Sync \u003c= 2.12.15 - Cross-Site Request Forgery",
    "slug": "sheets-to-wp-table-live-sync",
    "type": "plugin",
    "affected_version": "* - 2.12.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26535",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Viral Loops WP Integration \u003c= 3.8.1 - Missing Authorization",
    "slug": "viral-loops-wp-integration",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28995",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BizCalendar Web \u003c= 1.1.0.53 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "bizcalendar-web",
    "type": "plugin",
    "affected_version": "* - 1.1.0.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0.53",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7650",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AutomateWoo \u003c= 5.7.1 - Cross-Site Request Forgery",
    "slug": "automatewoo",
    "type": "plugin",
    "affected_version": "* - 5.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32745",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better Comments \u003c= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "better-comments",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2402",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tainá \u003c= 0.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "taina",
    "type": "theme",
    "affected_version": "* - 0.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26919",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shipping via Planzer for WooCommerce \u003c= 1.0.25 - Reflected Cross-Site Scripting via processed-ids",
    "slug": "wc-planzer-shipping",
    "type": "plugin",
    "affected_version": "* - 1.0.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12337",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Event Aggregator \u003c= 1.8.2 - Reflected Cross-Site Scripting",
    "slug": "wp-event-aggregator",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24700",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.1.3 - Media Related Security Issue",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3122",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Juicer \u003c= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "juicer",
    "type": "plugin",
    "affected_version": "* - 1.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0172",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF for WPForms \u003c= 5.5.0 - Missing Authorization",
    "slug": "pdf-for-wpforms",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49289",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Player for WPBakery \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "video-player-for-wpbakery",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Post Generator | AutoWriter \u003c= 3.5 - Missing Authorization to Authenticated (Contributor+) Post/Page Deletion",
    "slug": "ai-post-generator",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11709",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CALL ME NOW \u003c= 3.0 - Cross-Site Request Forgery",
    "slug": "lokalyze-call-now",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32602",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Alone \u003c= 7.8.2 - Unauthenticated Remote Code Execution",
    "slug": "alone",
    "type": "theme",
    "affected_version": "* - 7.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-52718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52718",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Hide \u0026 Security Enhancer \u003c= 2.5.1 - Missing Authorization to Unauthenticated Arbitrary File Contents Deletion",
    "slug": "wp-hide-security-enhancer",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11585",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Rescue Shortcodes \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rescue-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39528",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Blog Card \u003c= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-blog-card",
    "type": "plugin",
    "affected_version": "* - 1.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4035",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR CCPA Compliance Support \u003c= 2.3 - PHP Object Injection",
    "slug": "ninja-gdpr-compliance",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36718",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Asset CleanUp \u003c= 1.3.8.4 - Reflected Cross-Site Scripting",
    "slug": "wp-asset-clean-up",
    "type": "plugin",
    "affected_version": "* - 1.3.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24937",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lazy Blocks \u003c= 4.1.0 - Missing Authorization",
    "slug": "lazy-blocks",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58258",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MPL-Publisher  \u003c= 1.30.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mpl-publisher",
    "type": "plugin",
    "affected_version": "* - 1.30.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39343",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Football Pool \u003c= 2.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "football-pool",
    "type": "plugin",
    "affected_version": "* - 2.12.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53280",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Videos \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-youtube-videos",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Font Awesome \u003c= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-font-awesome",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0271",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TerraClassifieds \u003c= 2.0.3 - Cross-Site Request Forgery",
    "slug": "terraclassifieds",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51474",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "spam-byebye \u003c= 2.2.1 - Unauthenticated Cross-Site Scripting",
    "slug": "spam-byebye",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-16206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16206",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via InfoBox",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2751",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "allegiant",
    "type": "theme",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "naturemag-lite",
    "type": "theme",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "newsmag",
    "type": "theme",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "shapely",
    "type": "theme",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "bonkers",
    "type": "theme",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "regina-lite",
    "type": "theme",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "transcend",
    "type": "theme",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "sparkling",
    "type": "theme",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "newspaper-x",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "antreas",
    "type": "theme",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "affluent",
    "type": "theme",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "brilliance",
    "type": "theme",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "activello",
    "type": "theme",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "illdy",
    "type": "theme",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "medzone-lite",
    "type": "theme",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Function Injection",
    "slug": "pixova-lite",
    "type": "theme",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36708",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Drag and Drop Multiple File Upload for WooCommerce \u003c= 1.1.4 - Unauthenticated Arbitrary File Move",
    "slug": "drag-and-drop-multiple-file-upload-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2941",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 3.8.7 - SQL Injection",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 3.8.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-0894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-0894",
    "auth_type": "Unauth",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Auto Amazon Links – Amazon Associates Affiliate Plugin \u003c= 5.4.2 - Reflected Cross-Site Scripting",
    "slug": "amazon-auto-links",
    "type": "plugin",
    "affected_version": "* - 5.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9349",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 12.6.5 - Stored Cross-Site Scripting",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 12.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-12566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12566",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xola \u003c= 1.6 - Missing Authorization",
    "slug": "xola-bookings-for-tours-activities",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23955",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPLMS Learning Management System for WordPress \u003c= 4.962 - Unauthenticated Arbitrary File Read and Deletion",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "* - 4.962",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.962",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10470",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Video Background \u003c= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "video-background",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4652",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Findgo \u003c= 1.3.55 - Cross-Site Request Forgery",
    "slug": "fingo",
    "type": "theme",
    "affected_version": "* - 1.3.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.55",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58250",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Awesome Tool Tip \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "awesome-tool-tip",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52349",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mr. Murphy - Custom Dress Tailoring Clothing WordPress Theme \u003c 1.2.12.1 - Unauthenticated PHP Object Injection",
    "slug": "mr-murphy",
    "type": "theme",
    "affected_version": "[*, 1.2.12.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.12.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-49072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49072",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPML \u003c= 3.1.9 - SQL Injection via lang Parameter",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-2314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2314",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI Content Creator \u003c= 1.2.6 - Cross-Site Request Forgery",
    "slug": "ai-content-creator",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32247",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zoho Flow \u003c= 2.14.1 - Cross-Site Request Forgery",
    "slug": "zoho-flow",
    "type": "plugin",
    "affected_version": "* - 2.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8479",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Option Editor \u003c= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "option-editor",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13852",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Media File Manager \u003c= 1.4.2 - Reflected Cross-Site Scripting",
    "slug": "media-file-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-19041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19041",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AR For Woocommerce \u003c= 6.2 - Unauthenticated Arbitrary File Upload",
    "slug": "ar-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cards for Beaver Builder \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cards Widget",
    "slug": "bb-bootstrap-cards",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5663",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP MAPS – Easiest \u0026 Most Advanced WordPress Plugin for Google Maps \u003c 4.0.4 - Cross-Site Scripting",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "[*, 4.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-0577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0577",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Manager \u003c= 2.1.23 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-team-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30868",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Subscribe To Unlock \u003c= 1.1.5 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "subscribe-to-unlock",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-60153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60153",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Formidable Forms \u003c= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "* - 6.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6725",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Cumulus \u003c= 1.22 - Cross-Site Scripting via tagcloud",
    "slug": "wp-cumulus",
    "type": "plugin",
    "affected_version": "* - 1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-4168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-4168",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schedule Posts Calendar \u003c= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings",
    "slug": "schedule-posts-calendar",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40560",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TemplatesNext OnePager \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "templatesnext-onepager",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35753",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.3.24 - Cross-Site Request Forgery",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60093",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "QR Twitter Widget \u003c= 0.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "qr-twitter-widget",
    "type": "plugin",
    "affected_version": "* - 0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45628",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit Form \u003c= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6123",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes - Authenticated (Subscriber+) Arbitrary Plugin Activation and Deactivation",
    "slug": "grip",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52488",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes - Authenticated (Subscriber+) Arbitrary Plugin Activation and Deactivation",
    "slug": "gaga-lite",
    "type": "theme",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52488",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes - Authenticated (Subscriber+) Arbitrary Plugin Activation and Deactivation",
    "slug": "one-paze",
    "type": "theme",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52488",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes - Authenticated (Subscriber+) Arbitrary Plugin Activation and Deactivation",
    "slug": "accesspress-staple",
    "type": "theme",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52488",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Poll Maker – Versus Polls, Anonymous Polls, Image Polls \u003c= 5.4.6 - Authenticated (Administrator+) SQL Injection via Order_by Parameter",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9475",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Real Estate Pack \u003c= 1.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-real-estate-pack-4",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1646",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pure Chat – Live Chat \u0026 More! \u003c= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName Parameter",
    "slug": "pure-chat",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13736",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Onclick Show Popup \u003c= 8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "onclick-show-popup",
    "type": "plugin",
    "affected_version": "* - 8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44228",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tribulant Gallery Voting \u003c= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "gallery-voting",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26931",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SearchIQ \u003c= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "searchiq",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30867",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Rosters \u003c= 4.7 - Reflected Cross-Site Scripting via 'tab'",
    "slug": "team-rosters",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadcast Live Video – Live Streaming \u003c 4.27.4 - Cross-Site Scripting",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "[*, 4.27.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.27.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4569",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ConvertBox Auto Embed WordPress plugin \u003c= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "convertbox-auto-embed",
    "type": "plugin",
    "affected_version": "* - 1.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23664",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36898",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MiniOrange Limit Login Attempts \u003c= 4.0.72 - Administrator+ Cross-Site Scripting",
    "slug": "miniorange-limit-login-attempts",
    "type": "plugin",
    "affected_version": "* - 4.0.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1029",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woffice \u003c= 5.4.14 - Unauthenticated Privilege Escalation",
    "slug": "woffice",
    "type": "theme",
    "affected_version": "* - 5.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.14",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43234",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yoast SEO: Local \u003c= 14.8 - Cross-Site Request Forgery",
    "slug": "wpseo-local",
    "type": "plugin",
    "affected_version": "* - 14.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28780",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Thim Elementor Kit \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "thim-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4329",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FastBook \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "fastbook-responsive-appointment-booking-and-scheduling-system",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25173",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Layers \u003c= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "layers",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10130",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager \u003c 2.4.4 - Multiple SQL Injection",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "[*, 2.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-9178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9178",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Bet \u003c= 1.0.7 - Reflected Cross-Site Scripting",
    "slug": "easy-bet",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23787",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inline Google Spreadsheet Viewer \u003c= 0.9.6 - Cross-Site Request Forgery",
    "slug": "inline-google-spreadsheet-viewer",
    "type": "plugin",
    "affected_version": "* - 0.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10108",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "[*, 4.8.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-34007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34007",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quick Contact Form \u003c= 8.0.3.1 - Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "quick-contact-form",
    "type": "plugin",
    "affected_version": "* - 8.0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47608",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCS – WordPress Currency Switcher Professional \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2558",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.977 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.977",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.977",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39543",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cool Author Box \u003c= 2.9.9 - Missing Authorization",
    "slug": "hm-cool-author-box-widget",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30830",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jobify - Job Board WordPress Theme \u003c= 4.2.3 - Unauthenticated Arbitrary File Read",
    "slug": "jobify",
    "type": "theme",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52481",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "Smart Forms \u003c= 2.6.91 - Missing Authorization to Notice Dismissal",
    "slug": "smart-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33593",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery Builder \u003c= 3.0 - Missing Authorization",
    "slug": "photo-gallery-builder",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49325",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "One to one user Chat by WPGuppy \u003c= 1.1.0 - Authorization Bypass",
    "slug": "wpguppy-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24643",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GS Insever Portfolio \u003c= 1.4.4 - Cross-Site Request Forgery",
    "slug": "gs-instagram-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47156",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Serious Slider \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "cryout-serious-slider",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11108",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Checker \u003c= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "broken-link-checker",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25592",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "University quizzes online \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "university-quizzes-online",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23724",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.7",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2213",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.6",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2213",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.6",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2213",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.3",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2213",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-2213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2213",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.9",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2213",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.9",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2213",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Team Showcase \u003c= 1.22.15 - Object Injection",
    "slug": "team",
    "type": "plugin",
    "affected_version": "[*, 1.22.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-35939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35939",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Logo Carousel \u003c 1.7.2 - Stored Cross-Site Scripting",
    "slug": "kiwi-logo-carousel",
    "type": "plugin",
    "affected_version": "[*, 1.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9434",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks \u0026 More \u003c= 2.5.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "content-control",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11153",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "OPcache Dashboard \u003c= 0.3.1 - Reflected Cross-Site Scripting via 'page'",
    "slug": "opcache",
    "type": "plugin",
    "affected_version": "* - 0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45064",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Builder \u003c= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themify-builder",
    "type": "plugin",
    "affected_version": "* - 7.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9353",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP OAuth2 Server \u003c= 1.0.1 - Authentication Bypass",
    "slug": "oauth2-server",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-34839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "aThemes Addons for Elementor \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "athemes-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60112",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CE21 Suite \u003c= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change",
    "slug": "ce21-suite",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10294",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Heateor Login – Social Login Plugin \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "heateor-login",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9857",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Contact \u003c= 0.1.2 - Reflected Cross-Site Scripting",
    "slug": "easy-contact",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30970",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Directory Free \u003c= 1.7.6 - Unauthenticated SQL Injection",
    "slug": "web-directory-free",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28904",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GERRYWORKS Post by Mail \u003c= 1.0 - Contributor+ Privilege Escalation",
    "slug": "gerryworks-post-by-mail",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49608",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Feed Them Social – for Twitter feed, Youtube and more \u003c= 2.9.8.5 - Unauthenticated PHAR Deserialization",
    "slug": "feed-them-social",
    "type": "plugin",
    "affected_version": "* - 2.9.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-2437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2437",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventON Lite \u003c= 2.4.6 - Authenticated (Contributor+) Information Disclosure",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8091",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AppPresser – Mobile App Framework \u003c= 4.4.10 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "apppresser",
    "type": "plugin",
    "affected_version": "* - 4.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1561",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advance Search for WooCommerce \u003c= 1.0.9 - Cross-Site Scripting",
    "slug": "woo-advance-search",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-11486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11486",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download, Downloads – WordPress Download plugin By Edmon \u003c= 1.4.2 - Reflected Cross-Site Scripting",
    "slug": "ydn-download",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23541",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backwp \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "backwp",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28956",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Access Manager \u003c= 6.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-access-manager",
    "type": "plugin",
    "affected_version": "* - 6.9.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50881",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Naver Map \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "naver-map",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0146",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stripe Payment Plugin for WooCommerce \u003c= 3.7.9 - Missing Authorization to Arbitrary Order Status Modification",
    "slug": "payment-gateway-stripe-and-woocommerce-integration",
    "type": "plugin",
    "affected_version": "3.7.9",
    "from_version": "3.7.9",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4040",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP VR \u003c= 8.3.4 - Reflected Cross-Site Scripting",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40663",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "infolinks Ad Wrap \u003c= 1.0.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "infolinks-ad-wrap",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8044",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Modern Footnotes \u003c= 1.4.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "modern-footnotes",
    "type": "plugin",
    "affected_version": "* - 1.4.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5618",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Splitter for WooCommerce \u003c= 5.3.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "woo-order-splitter",
    "type": "plugin",
    "affected_version": "* - 5.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31089",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Olevmedia Shortcodes \u003c= 1.1.8 - Reflected Cross-Site Scripting",
    "slug": "olevmedia-shortcodes",
    "type": "plugin",
    "affected_version": "[*, 1.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9421",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Show Me The Cookies \u003c= 1.0 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "show-me-the-cookies",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1509",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Vistered Little (Unspecified Version) - Cross-Site Scripting",
    "slug": "Vistered-Little",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-3240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-3240",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Ajax Search \u003c= 2.4.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "yith-woocommerce-ajax-search",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4455",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Restaurant Menu \u003c= 2.0.2 - Authenticated (Administrator+) Cross-Site Scripting",
    "slug": "quick-restaurant-menu",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0553",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slingblocks",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13675",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slide Anything – Responsive Content / HTML Slider and Carousel \u003c= 2.3.46 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "slide-anything",
    "type": "plugin",
    "affected_version": "* - 2.3.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2413",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Filter \u0026 Grids \u003c= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ymc-smart-filter",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39665",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Starter Templates — Elementor, Gutenberg \u0026 Beaver Builder Templates  \u003c= 2.7.0 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "astra-sites",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-42360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42360",
    "auth_type": "Auth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"
  },
  {
    "title": "Content Staging \u003c= 2.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "content-staging",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39356",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Motors – Car Dealer, Classifieds \u0026 Listing \u003c= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10970",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Wechat Social login \u003c= 1.3.0 - Unauthenticated Arbitrary File Upload",
    "slug": "wechat-social-login",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9108",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Klarna Checkout for WooCommerce \u003c= 2.13.4 - Denial of Service",
    "slug": "klarna-checkout-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.13.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13925",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "eCommerce Product Catalog plugin for WordPress \u003c= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1470",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IndieBlocks \u003c= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter",
    "slug": "indieblocks",
    "type": "plugin",
    "affected_version": "* - 0.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5950",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-BusinessDirectory \u003c= 3.1.2 - Unauthenticated Arbitrary File Deletion",
    "slug": "wp-businessdirectory",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32629",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Anti Hacker \u003c= 4.34 - Cross-Site Request Forgery via antihacker_ajax_scan",
    "slug": "antihacker",
    "type": "plugin",
    "affected_version": "[*, 4.35)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.35",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50858",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Build Private Store For Woocommerce \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "build-private-store-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22731",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Parallax Image \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via dd-parallax Shortcode",
    "slug": "parallax-image",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9898",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "azon-addon-js-composer",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30631",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Email Users \u003c= 1.7.6 - SQL Injection",
    "slug": "wp-email-users",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24959",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Tweet Walls \u003c= 1.0.3 - Cross-Site Request Forgery",
    "slug": "wp-tweet-walls",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38344",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ACF: Google Font Selector \u003c= 3.0.1 - Reflected Cross-Site Scripting",
    "slug": "acf-google-font-selector-field",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39382",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tooltip CK \u003c= 2.2.15 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "tooltip-ck",
    "type": "plugin",
    "affected_version": "* - 2.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35756",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Purchase Orders \u003c= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wc-purchase-orders",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5391",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Blog Manager Light \u003c= 1.20 - Cross-Site Request Forgery via bml_settings",
    "slug": "blog-manager-light",
    "type": "plugin",
    "affected_version": "* - 1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45102",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YOP Poll \u003c= 6.0.2 - Reflected Cross-Site Scripting via poll_id Parameter",
    "slug": "yop-poll",
    "type": "plugin",
    "affected_version": "[*, 6.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-9914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9914",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cache control by Cacholong \u003c= 5.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cache-control-by-cacholong",
    "type": "plugin",
    "affected_version": "* - 5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31764",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Translate Multilingual sites – TranslatePress \u003c= 2.7.5 - Cross-Site Request Forgery",
    "slug": "translatepress-multilingual",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34827",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MBE eShip \u003c= 2.1.2 - Information Exposure",
    "slug": "mail-boxes-etc",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38742",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Gameplan - Event and Gym Fitness WordPress Theme \u003c= 1.6.4 - Reflected Cross-Site Scripting",
    "slug": "gameplan",
    "type": "theme",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-11568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11568",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export Users Data Distinct \u003c= 1.3 - Authenticated (Subscriber+) CSV Injection",
    "slug": "export-users-data-distinct",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46804",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.31 - Missing Authorization to Information Disclosure",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4205",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form Clean and Simple \u003c 4.4.1 - Cross-Site Scripting",
    "slug": "clean-and-simple-contact-form-by-meg-nicholas",
    "type": "plugin",
    "affected_version": "[*, 4.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-8955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8955",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AllWebMenus WordPress Menu Plugin \u003c 1.1.9 - Arbitrary File Upload",
    "slug": "allwebmenus-wordpress-menu-plugin",
    "type": "plugin",
    "affected_version": "[*, 1.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-1010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-1010",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sticky Social Media Icons \u003c= 2.0 - Missing Authorization via ajax_request_handle",
    "slug": "sticky-social-media-icons",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40672",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler \u003c= 1.6.4 - Missing Authorization via Several AJAX Action",
    "slug": "cf7-styler",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34826",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Seznam Webmaster \u003c= 1.4.7 - Cross-Site Request Forgery",
    "slug": "seznam-webmaster",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47523",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Mailto Links \u003c= 3.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-mailto-links",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53464",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Store Finder \u003c= 7.2 - Unauthenticated SQL Injection",
    "slug": "superstorefinder-wp",
    "type": "plugin",
    "affected_version": "* - 7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39445",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Charitable \u003c= 1.8.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "* - 1.8.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47520",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woffice Core \u003c= 5.4.8 - Missing Authorization",
    "slug": "woffice-core",
    "type": "plugin",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37470",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Job Board Manager \u003c= 2.1.59 - Cross-Site Request Forgery",
    "slug": "job-board-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24622",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UserPro \u003c= 4.9.23 - Unauthenticated Cross-Site Scripting",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 4.9.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-16285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16285",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Pricing With Discount Rules for WooCommerce \u003c= 4.5.8 - Authenticated (Shop manager+) SQL Injection",
    "slug": "aco-woo-dynamic-pricing",
    "type": "plugin",
    "affected_version": "* - 4.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47544",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "TablePress \u003c= 1.14 - Authenticated (Author+) CSV Injection",
    "slug": "tablepress",
    "type": "plugin",
    "affected_version": "* - 1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-20180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20180",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Music Store – WordPress eCommerce \u003c= 1.1.19 - Reflected Cross-Site Scripting",
    "slug": "music-store",
    "type": "plugin",
    "affected_version": "* - 1.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24626",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Builder – Meet the Team \u003c= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "team-display",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13687",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lana Downloads Manager \u003c= 1.7.1 - Authenticated (Contributor+) Arbitrary File Download",
    "slug": "lana-downloads-manager",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2392",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.8.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3935",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grid Kit Premium \u003c 2.2.0 - Reflected Cross-Site Scripting",
    "slug": "grid-kit-premium",
    "type": "plugin",
    "affected_version": "[*, 2.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-3292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3292",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FontAwesome.io ShortCodes \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fontawesomeio-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23824",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP MAPS \u003c= 4.3.9 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "* - 4.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23878",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebP Converter for Media – Convert WebP and AVIF \u0026 Optimize Images \u003c= 1.0.2 - Cross-Site Request Forgery",
    "slug": "webp-converter-for-media",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15834",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BetterLinks \u003c= 1.6.0 - Improper Authorization to Data Import and Export",
    "slug": "betterlinks",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45104",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "FV Player \u003c= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.46.7212",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.46.7212",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6338",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SportsPress – Sports Club \u0026 League Manager \u003c= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update",
    "slug": "sportspress",
    "type": "plugin",
    "affected_version": "* - 2.7.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1178",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Mobile Menu – The Mobile-Friendly Responsive Menu \u003c= 2.8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Alt",
    "slug": "mobile-menu",
    "type": "plugin",
    "affected_version": "* - 2.8.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3987",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram Collect – Easy Form, Lead Collection and Subscription plugin \u003c= 1.3.14 - Missing Authorization",
    "slug": "icegram-rainmaker",
    "type": "plugin",
    "affected_version": "* - 1.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43273",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Community by PeepSo \u003c= 6.2.7.0 - Unauthenticated Sensitive Information Disclosure via Log file",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25923",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "YARPP – Yet Another Related Posts Plugin \u003c= 5.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "yet-another-related-posts-plugin",
    "type": "plugin",
    "affected_version": "* - 5.30.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.30.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4471",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue \u003c= 3.1.30 - Reflected Cross-Site Scripting via lang \u0026 pid Parameters",
    "slug": "mailin",
    "type": "plugin",
    "affected_version": "[*, 3.1.31)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.31",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24874",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "a3 Portfolio \u003c= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "a3-portfolio",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29097",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid \u003c= 1.1.7 - Cross-Site Request Forgery",
    "slug": "blog-designer-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8481",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BulletProof Security \u003c .52.5 - Cross-Site Scripting",
    "slug": "bulletproof-security",
    "type": "plugin",
    "affected_version": "[*, .52.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": ".52.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9230",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Speed Increaser \u003c= 2.2.1 - Cross-Site Request Forgery",
    "slug": "advanced-speed-increaser",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31753",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ConvertKit \u003c= 2.2.0 - Reflected Cross-Site Scripting",
    "slug": "convertkit",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2337",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Highlight Focus \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "highlight-focus",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3462",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP EasyPay \u003c= 4.0.4 - Reflected Cross-Site Scripting",
    "slug": "wp-easy-pay",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1465",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager  \u003c= 4.69 - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.69",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.69",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-24868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24868",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DIOT SCADA with MQTT \u003c= 1.0.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ecava-diot-scada",
    "type": "plugin",
    "affected_version": "* - 1.0.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4216",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates \u0026 Patterns \u003c= 2.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zoloblocks",
    "type": "plugin",
    "affected_version": "* - 2.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9075",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.2.10 - Missing Authorization to Account Logout",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2415",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "GST for WooCommerce \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "gst-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60173",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rock Convert \u003c= 2.11.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "rock-convert",
    "type": "plugin",
    "affected_version": "* - 2.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36428",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Meta – User Profile Builder and User management plugin \u003c= 3.1.2 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "user-meta",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9693",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Indexer \u003c= 3.0.6.1 - Authenticated (Super Admin+) SQL Injection",
    "slug": "post-indexer",
    "type": "plugin",
    "affected_version": "[*, 3.0.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10947",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Autoptimize \u003c= 2.7.7 - Arbitrary File Upload (and Remote Code Execution) via Import Settings",
    "slug": "autoptimize",
    "type": "plugin",
    "affected_version": "[*, 2.7.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24376",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WSB Brands \u003c= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via $logo",
    "slug": "wsb-brands",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47437",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "QR Code Generator \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "qrcode-wprhe",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23831",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hesabfa Accounting \u003c= 2.1.8 - Cross-Site Request Forgery",
    "slug": "hesabfa-accounting",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30815",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Testimonial Widget \u003c= 3.1 - Missing Authorization",
    "slug": "wp-testimonial-widget",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7390",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Cron Manager – debug \u0026 control  \u003c= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-cron-manager",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31926",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Custom Templates Lite \u003c= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "post-custom-templates-lite",
    "type": "plugin",
    "affected_version": "* - 1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30942",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media File Manager \u003c= 1.4.2 -  Directory Traversal to Directory Listing",
    "slug": "media-file-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-19040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19040",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging \u003c= 4.23.12 - Missing Authorization",
    "slug": "wp-rss-aggregator",
    "type": "plugin",
    "affected_version": "* - 4.23.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.23.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9583",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Symposium \u003c= 15.8 - Unauthenticated SQL Injection",
    "slug": "wp-symposium",
    "type": "plugin",
    "affected_version": "[*, 15.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-6522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6522",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "License For Envato \u003c= 1.0.0 - Unauthenticated Local File Inclusion",
    "slug": "license-envato",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39399",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50368",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Case Theme User \u003c= 1.0.3 - Authentication Bypass via Social Login",
    "slug": "case-theme-user",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5821",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin \u003c= 5.7.26 - Missing Authorization",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5703",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OpenMenu \u003c= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "open-menu",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31593",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Solidres \u003c= 0.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "solidres",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1374",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Target Notifications \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "target-notifications",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22357",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CBX Bookmark \u0026 Favorite \u003c= 1.7.21 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cbxwpbookmark",
    "type": "plugin",
    "affected_version": "* - 1.7.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32577",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Verowa Connect \u003c= 3.0.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "verowa-connect",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32676",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Media File Manager \u003c= 1.4.2 - Directory Traversal to Arbitrary File Relocation",
    "slug": "media-file-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-19042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19042",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NextScripts: Social Networks Auto-Poster \u003c= 4.3.24 - Arbitrary Post Deletion via Cross-Site Request Forgery",
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "type": "plugin",
    "affected_version": "[*, 4.3.25)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.25",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25072",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "SEO, Nutrition and Print for Recipes by Edamam \u003c= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "seo-nutrition-and-print-for-recipes-by-edamam",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32555",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ApplyOnline – Application Form Builder and Manager \u003c= 2.5.5 - Reflected Cross-Site Scripting",
    "slug": "apply-online",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45756",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sucuri Security \u003c= 1.8.33 - Cross-Site Request Forgery",
    "slug": "sucuri-scanner",
    "type": "plugin",
    "affected_version": "* - 1.8.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.33",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TPG Get Posts \u003c= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tpg-get-posts",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11906",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter2Go \u003c= 4.0.14 - Missing Authorization to Authenticated (Subscriber+) Style Reset",
    "slug": "newsletter2go",
    "type": "plugin",
    "affected_version": "* - 4.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12618",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.0.4 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2006-5705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-5705",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "My Calendar \u003c 1.10.5 - Cross-Site Scripting",
    "slug": "my-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.10.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6527",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive \u003c= 5.0.2 - Missing Authorization to HTML Injection",
    "slug": "responsive",
    "type": "theme",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2848",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Icegram Email Subscribers \u0026 Newsletters Plugin for WordPress \u003c= 4.5.0 - Cross-Site Request Forgery",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "[*, 4.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-5767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5767",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ajax Pagination and Infinite Scroll \u003c= 2.0.1 - Cross-Site Request Forgery",
    "slug": "malinky-ajax-pagination",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34033",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ni WooCommerce Customer Product Report \u003c= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "ni-woocommerce-customer-product-report",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7827",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Monster \u003c= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Meta",
    "slug": "event-monster",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1895",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Availability Calendar \u003c= 1.2.6 - Cross-Site Request Forgery via add_availability_calendar_create_admin_page()",
    "slug": "availability-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48744",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \u003c= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu Widget",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5542",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 4.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via class",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 4.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30179",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Post List \u003c= 0.5.6.2 - Cross-Site Request Forgery",
    "slug": "advanced-post-list",
    "type": "plugin",
    "affected_version": "* - 0.5.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30968",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Shipping Label \u003c= 2.3.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting",
    "slug": "shipping-labels-for-woo",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-32834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32834",
    "auth_type": "Privileged",
    "cvss_score": 3.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Slick Popup \u003c= 1.7.1 - Privilege Escalation",
    "slug": "slick-popup",
    "type": "plugin",
    "affected_version": "[*, 1.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15867",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HivePress Claim Listings \u003c= 1.1.3 - Missing Authorization",
    "slug": "hivepress-claim-listings",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60122",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LeanPress \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "leanpress",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52483",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick/Bulk Order Form for WooCommerce \u003c= 3.5.7 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "woocommerce-bulk-order-form",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34170",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IRivYou \u003c= 2.2.1 - Cross-Site Request Forgery via saveOptionsReviewsPlugin",
    "slug": "wooreviews-importer",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45267",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "URL Shortener \u003c= 3.0.7 - Unauthenticated SQL Injection",
    "slug": "exact-links",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28959",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "webpack JS package \u003c= 5.75.0 - Sandbox Bypass",
    "slug": "restricted-site-access",
    "type": "plugin",
    "affected_version": "* - 7.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28154",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "webpack JS package \u003c= 5.75.0 - Sandbox Bypass",
    "slug": "elasticpress",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28154",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Error Log Viewer \u003c= 1.0.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "error-log-viewer-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32681",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.7",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.7",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.4",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.10",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.10",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.8",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP VTiger Synchronization \u003c= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "msstiger",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23455",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DELUCKS SEO \u003c= 2.5.8 - Authenticated (Subscriber+) Arbitrary File Read",
    "slug": "delucks-seo",
    "type": "plugin",
    "affected_version": "* - 2.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54259",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Rife Elementor Extensions \u0026 Templates \u003c= 1.1.10 - Missing Authorization via import_templates",
    "slug": "rife-elementor-extensions",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27454",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP-Player \u003c= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-player",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23947",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WCMultiShipping \u003c= 2.3.5 - Missing Authorization to Log Export",
    "slug": "wc-multishipping",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48274",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-tabs",
    "type": "plugin",
    "affected_version": "* - 2.1.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.25.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-blog",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-theme-core",
    "type": "plugin",
    "affected_version": "* - 2.1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-compare-wishlist",
    "type": "plugin",
    "affected_version": "* - 1.5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-woo-builder",
    "type": "plugin",
    "affected_version": "* - 2.1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-reviews",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-tricks",
    "type": "plugin",
    "affected_version": "* - 1.4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-menu",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-woo-product-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action",
    "slug": "jet-smart-filters",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48760",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Button Block \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "button-block",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22815",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI ChatBot with ChatGPT and Content Generator by AYS \u003c= 2.0.9 - Missing Authorization",
    "slug": "ays-chatgpt-assistant",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7714",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Catalog Enquiry for WooCommerce by MultiVendorX \u003c= 5.0.5 - Cross-Site Request Forgery via REST API",
    "slug": "woocommerce-catalog-enquiry",
    "type": "plugin",
    "affected_version": "* - 5.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25929",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive Flickr Slideshow \u003c= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mobile-friendly-flickr-slideshow",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13660",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web3 – Crypto wallet Login \u0026 NFT token gating \u003c= 2.6.0 - Authentication Bypass",
    "slug": "web3-authentication",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-3249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3249",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Map Store Locator \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "map-store-location",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51920",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ALD - AliExpress Dropshipping and Fulfillment for WooCommerce Premium \u003c= 1.1.0 - Sensitive Information Disclosure",
    "slug": "woocommerce-alidropship",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41623",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid  \u003c= 0.9.70 - Authenticated Arbitrary File Read",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27844",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ShopLentor – WooCommerce Builder for Elementor \u0026 Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \u003c= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5530",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better User Shortcodes \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "better-user-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22594",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photoxhibit \u003c= 2.1.8 - Reflected Cross-Site Scripting",
    "slug": "photoxhibit",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000144",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eCommerce \u003c 3.8.7.6 - SQL Injection",
    "slug": "wp-e-commerce",
    "type": "plugin",
    "affected_version": "[*, 3.8.7.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.7.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-5310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5310",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Word Balloon \u003c= 4.21.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "word-balloon",
    "type": "plugin",
    "affected_version": "* - 4.21.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-35781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35781",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Prodigy Commerce \u003c= 3.1.2 - Missing Authorization",
    "slug": "prodigy-commerce",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 3.63 - Authenticated Settings Modification, Configuration Disclosure, and User Data Export",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 3.63",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.63",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-10195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10195",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "bbPress \u003c= 2.6.4 -  Authenticated (Admin+) Stored Cross-Site Scripting via the forums list table",
    "slug": "bbpress",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-13487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13487",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hotel Booking \u003c= 2.2.1 - Improper Input Validation to Authenticated (Subscriber+) Rating Manipulation",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8942",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Testimonials \u003c= 1.4.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "testimonial-widgets",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-25924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25924",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Time Countdown for WooCommerce \u003c= 1.6.4 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "product-countdown-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57908",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Responsive Gallery Album \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "ai-responsive-gallery-album",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52467",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapPress Maps \u003c= 2.54.5 - Remote Code Execution via Improper Capability Checks in AJAX Calls",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.54.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.54.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-12675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12675",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hostinger \u003c= 1.9.7 - Missing Authorization to Maintenance Mode Activation",
    "slug": "hostinger",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6751",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Plugin Info Card \u003c= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via containerid Parameter",
    "slug": "wp-plugin-info-card",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5116",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CodePen Embedded Pens Shortcode \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "codepen-embedded-pen-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50440",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopLentor – WooCommerce Builder for Elementor \u0026 Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \u003c= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8668",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings \u003c= 8.0.12 - Unauthenticated User Information Exposure",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 8.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12041",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "W3 Total Cache \u003c= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12365",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Celestial Aura \u003c= 2.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "celestial-aura",
    "type": "theme",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26892",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Depicter Slider \u003c= 3.2.2 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "depicter",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47381",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WR Price List Manager For Woocommerce \u003c= 1.0.8 - Missing Authorization to Arbitrary Content Deletion",
    "slug": "wr-price-list-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31794",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User List \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "user-list",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27319",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sync Post With Other Site \u003c= 1.5.1 - Cross-Site Request Forgery",
    "slug": "sync-post-with-other-site",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32082",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IP Blacklist Cloud \u003c= 5.00 - Authenticated (Administrator+) SQL Injection",
    "slug": "ip-blacklist-cloud",
    "type": "plugin",
    "affected_version": "* - 5.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.00",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43462",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Global Content Blocks \u003c= 2.1.5 - Cross-Site Request Forgery",
    "slug": "global-content-blocks",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-20090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20090",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PowerPack for Beaver Builder \u003c= 2.33.0 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "bbpowerpack",
    "type": "plugin",
    "affected_version": "* - 2.33.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.33.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-39633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39633",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "404s \u003c= 3.4.9 - Administrator+ Cross-Site Scripting",
    "slug": "404s",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2118",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Parallax Scroll \u003c= 2.0.1 - Cross-Site Scripting",
    "slug": "adamrob-parallax-scroll",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-7413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-7413",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extensions for Leaflet Map \u003c= 3.4.1 - Reflected Cross-Site Scripting",
    "slug": "extensions-leaflet-map",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31074",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50514",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Download Monitor \u003c 3.5.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "[*, 3.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5213",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FLOWFACT WP Connector \u003c= 2.1.8 - Reflected Cross-Site Scripting",
    "slug": "flowfact-wp-connector",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46626",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.40",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1311",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "yet-another-stars-rating",
    "type": "plugin",
    "affected_version": "[*, 2.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "events-addon-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.9.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers",
    "type": "plugin",
    "affected_version": "[*, 2.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "acf-blocks",
    "type": "plugin",
    "affected_version": "[*, 2.6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ultimeter",
    "type": "plugin",
    "affected_version": "[*, 2.7.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "past-events-extension",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "pootle-page-builder",
    "type": "plugin",
    "affected_version": "[*, 5.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "local-delivery-drivers-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ultimate-gutenberg",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "required-taxonomies",
    "type": "plugin",
    "affected_version": "[*, 1.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "featured-products-first-for-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ssl-zen",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "streak-crm-for-gmail-integration-for-contact-form-7",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-dev-powers-acf-color-coded-field-types",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "dancepress-trwa",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-advanced-product-size-chart",
    "type": "plugin",
    "affected_version": "[*, 2.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-my-admin-bar",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "setka-editor",
    "type": "plugin",
    "affected_version": "[*, 2.1.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "localseomap-for-elementor",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-prayer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "adfoxly",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-get-personal-lite",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "edd-cashapp",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "server-info",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "add-fields-to-checkout-page-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "krsp-frontend-file-upload",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "panorama",
    "type": "plugin",
    "affected_version": "[*, 1.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bulk-attachment-download",
    "type": "plugin",
    "affected_version": "[*, 1.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "autosave-net",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "premmerce-woocommerce-wholesale-pricing",
    "type": "plugin",
    "affected_version": "[*, 1.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "any-popup",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "edd-venmo",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woocommerce-product-payments",
    "type": "plugin",
    "affected_version": "[*, 3.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "hqtheme-extra",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "vit-website-reviews",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woocommerce-eu-vat-assistant",
    "type": "plugin",
    "affected_version": "[*, 2.0.28.220224)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.28.220224",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "gutenslider",
    "type": "plugin",
    "affected_version": "[*, 5.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "surbma-magyar-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 30.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "30.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "kvoucher",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "yt-player",
    "type": "plugin",
    "affected_version": "[*, 1.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "error-log-monitor",
    "type": "plugin",
    "affected_version": "[*, 1.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "slidedeck",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "premmerce-woocommerce-multi-currency",
    "type": "plugin",
    "affected_version": "[*, 2.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "booking-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 4.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-event-partners",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woosquare",
    "type": "plugin",
    "affected_version": "[*, 4.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "add-expires-headers",
    "type": "plugin",
    "affected_version": "[*, 2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "forcefield",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "featured-image-toolkit",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "all-in-one-invite-codes",
    "type": "plugin",
    "affected_version": "[*, 1.0.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-conditional-discount-rules-for-checkout",
    "type": "plugin",
    "affected_version": "[*, 2.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "[*, 1.9.9.170)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.170",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "cf7-grid-and-styler-for-divi",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "protect-uploads-with-login-page",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "atlas-knowledge-base",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "simple-sitemap",
    "type": "plugin",
    "affected_version": "[*, 3.5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "super-video-player",
    "type": "plugin",
    "affected_version": "[*, 1.6.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-books-gallery",
    "type": "plugin",
    "affected_version": "[*, 3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ajax-search-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.17.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "tag-groups",
    "type": "plugin",
    "affected_version": "[*, 1.43.10.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.43.10.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-free-ssl",
    "type": "plugin",
    "affected_version": "[*, 1.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "clickervolt",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "consultpress-lite",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "cf7-styler-for-divi",
    "type": "plugin",
    "affected_version": "[*, 1.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "streamweasels-twitch-integration",
    "type": "plugin",
    "affected_version": "[*, 1.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "mobilook",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "zip-codes-redirect",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "guestofy-restaurant-reservations",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "cf7-constant-contact-fields-mapping",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bookit",
    "type": "plugin",
    "affected_version": "[*, 2.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ethereumico",
    "type": "plugin",
    "affected_version": "[*, 2.3.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "rt-easy-builder-advanced-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-contact-slider",
    "type": "plugin",
    "affected_version": "[*, 2.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woocommerce-country-based-payments",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "filr-protection",
    "type": "plugin",
    "affected_version": "[*, 1.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "elasta",
    "type": "theme",
    "affected_version": "[*, 1.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "interactive-geo-maps",
    "type": "plugin",
    "affected_version": "[*, 1.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "animate-everything",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-notification-bell",
    "type": "plugin",
    "affected_version": "[*, 1.3.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "activity-log-mainwp",
    "type": "plugin",
    "affected_version": "[*, 1.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "connected-sermons",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bulk-edit-user-profiles-in-spreadsheet",
    "type": "plugin",
    "affected_version": "[*, 1.5.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "yandex-money-button",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bulk-woocommerce-category-creator",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "cf7-easy-math-captcha",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-awesome-faq",
    "type": "plugin",
    "affected_version": "[*, 4.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "better-elementor-addons",
    "type": "plugin",
    "affected_version": "[*, 1.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 7.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wc-place-order-without-payment",
    "type": "plugin",
    "affected_version": "[*, 2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "super-transactional-emails-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "demomentsomtres-address",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "out-of-stock-display-for-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "[*, 2.4.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bulk-image-title-attribute",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-radio",
    "type": "plugin",
    "affected_version": "[*, 3.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "book-press",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "qyrr-code",
    "type": "plugin",
    "affected_version": "[*, 0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wplocalplus-lite",
    "type": "plugin",
    "affected_version": "[*, 1.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "accessibility-checker",
    "type": "plugin",
    "affected_version": "[*, 1.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "web-disrupt-funnelmentals",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "blockspare",
    "type": "plugin",
    "affected_version": "[*, 2.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "forms-to-zapier",
    "type": "plugin",
    "affected_version": "[*, 1.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woorousell",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "better-robots-txt",
    "type": "plugin",
    "affected_version": "[*, 1.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "gfirem-fields",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-coupon-usage",
    "type": "plugin",
    "affected_version": "[*, 4.16.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-post-block",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-attest",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "acf-frontend-form-element",
    "type": "plugin",
    "affected_version": "[*, 3.3.33)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.33",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "giveasap",
    "type": "plugin",
    "affected_version": "[*, 2.42.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.42.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wptools-masonry-gallery-posts-for-divi",
    "type": "plugin",
    "affected_version": "[*, 3.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "gfirem-action-after",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-ukrposhta",
    "type": "plugin",
    "affected_version": "[*, 1.6.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "annasta-woocommerce-product-filters",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-lead-stream",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "[*, 5.14.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.14.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "focus-on-reviews-for-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "email-tracker",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "block-styler-for-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 6.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "custom-page-templates-by-vegacorp",
    "type": "plugin",
    "affected_version": "[*, 1.1.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wc-product-customer-list",
    "type": "plugin",
    "affected_version": "[*, 3.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-moose",
    "type": "theme",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "gs-team-members",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "floating-links",
    "type": "plugin",
    "affected_version": "[*, 3.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "south-pole-the-offset-movement",
    "type": "plugin",
    "affected_version": "[*, 1.0.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "littlebot-invoices",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "genealogical-tree",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "automatic-youtube-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.6.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wc-thanks-redirect",
    "type": "plugin",
    "affected_version": "[*, 3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-marijuana-age-verify",
    "type": "plugin",
    "affected_version": "[*, 1.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woocommerce-upcoming-product",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "frontend-admin",
    "type": "plugin",
    "affected_version": "[*, 3.3.33)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.33",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "sv-tracking-manager",
    "type": "plugin",
    "affected_version": "[*, 1.8.02)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.02",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-easy-pay",
    "type": "plugin",
    "affected_version": "[*, 4.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "seo-checklist",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wgauge",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "[*, 2.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "[*, 2.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-tools-divi-product-carousel",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "front-editor",
    "type": "plugin",
    "affected_version": "[*, 3.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "social-gallery-lite",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "stackable-ultimate-gutenberg-blocks",
    "type": "plugin",
    "affected_version": "[*, 3.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "five-star-ratings-shortcode",
    "type": "plugin",
    "affected_version": "[*, 1.2.39)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.39",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "advanced-nocaptcha-recaptcha",
    "type": "plugin",
    "affected_version": "[*, 7.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "premmerce-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "[*, 1.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "[*, 7.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "surbma-gdpr-proof-google-analytics",
    "type": "plugin",
    "affected_version": "[*, 17.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "advance-menu-manager",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-live-tv",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "market-exporter",
    "type": "plugin",
    "affected_version": "* - 2.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "adminify",
    "type": "plugin",
    "affected_version": "[*, 2.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "tk-google-fonts",
    "type": "plugin",
    "affected_version": "[*, 2.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "starfish-reviews",
    "type": "plugin",
    "affected_version": "[*, 3.0.26)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.26",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-emaily",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "education-addon",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "sv-provenexpert",
    "type": "plugin",
    "affected_version": "[*, 1.8.01)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.01",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "surveyfunnel-lite",
    "type": "plugin",
    "affected_version": "[*, 1.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "advanced-classifieds-and-directory-pro",
    "type": "plugin",
    "affected_version": "[*, 1.8.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "music-player-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "cryptocurrency-product-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 3.14.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "next-order-coupon-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "overlay-image-divi-module",
    "type": "plugin",
    "affected_version": "[*, 1.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "email-header-footer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "embed-office-viewer",
    "type": "plugin",
    "affected_version": "[*, 2.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "price-bands-for-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "[*, 1.11.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "smart-variations-images",
    "type": "plugin",
    "affected_version": "[*, 5.1.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "featured-images-for-rss-feeds",
    "type": "plugin",
    "affected_version": "[*, 1.5.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "simple-sponsorships",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "joli-table-of-contents",
    "type": "plugin",
    "affected_version": "[*, 1.3.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "sparrow",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "auto-advance-for-gravity-forms",
    "type": "plugin",
    "affected_version": "[*, 4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "magic-post-thumbnail",
    "type": "plugin",
    "affected_version": "[*, 3.3.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "live-scores-for-sportspress",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "hide-shipping-method-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ultimate-carousel-for-divi",
    "type": "plugin",
    "affected_version": "[*, 4.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-meta-and-date-remover",
    "type": "plugin",
    "affected_version": "[*, 1.9.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "image-carousel-for-divi",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "comments-not-replied-to",
    "type": "plugin",
    "affected_version": "[*, 1.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "integration-of-capsule-crm-for-contact-form-7",
    "type": "plugin",
    "affected_version": "[*, 1.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "opensea",
    "type": "plugin",
    "affected_version": "[*, 1.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "tranzly",
    "type": "plugin",
    "affected_version": "[*, 1.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woocommerce-google-adwords-conversion-tracking-tag",
    "type": "plugin",
    "affected_version": "[*, 1.14.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "modern-addons-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "viralike",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-dev-powers-element-selector-jquery-powers",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-munich-blocks",
    "type": "plugin",
    "affected_version": "[*, 0.11.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.11.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "date-time-picker-field",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "mrkwp-footer-for-divi",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-stripe-donation",
    "type": "plugin",
    "affected_version": "[*, 2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "new-user-approve",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "gfirem-advance-search",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wpmailer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "shared-files",
    "type": "plugin",
    "affected_version": "[*, 1.6.72)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.72",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wpbits-addons-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "speculor",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-google-street-view",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "everse-starter-sites",
    "type": "plugin",
    "affected_version": "[*, 1.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "[*, 1.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "choice-payment-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "domain-mapping-system",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "order-and-inventory-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ninjalibs-ses",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "delete-all-comments-of-website",
    "type": "plugin",
    "affected_version": "[*, 4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-cron-status-checker",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "custom-codes",
    "type": "plugin",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "[*, 2.1.34)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.34",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "change-wc-price-title",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "edge-gallery",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "glorious-services-support",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-newsletter-signups",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bulletin-announcements",
    "type": "plugin",
    "affected_version": "[*, 3.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "advanced-database-replacer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "multisite-robotstxt-manager",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "simple-facebook-twitter-widget",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-country-restrictions-advanced",
    "type": "plugin",
    "affected_version": "[*, 1.13.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "front-end-pm",
    "type": "plugin",
    "affected_version": "[*, 11.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "sumo-divi-modules",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "xt-woo-points-rewards",
    "type": "plugin",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-products-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "delivery-woo",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-twilio-core",
    "type": "plugin",
    "affected_version": "[*, 1.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "security-ninja",
    "type": "plugin",
    "affected_version": "[*, 5.135)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.135",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "tinymce-annotate",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "justified-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "book-buyback-prices",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "fuse-social-floating-sidebar",
    "type": "plugin",
    "affected_version": "[*, 5.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-hr-manager",
    "type": "plugin",
    "affected_version": "[*, 3.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "emails-blacklist-everest-forms",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "all-in-one-video-gallery",
    "type": "plugin",
    "affected_version": "[*, 2.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-admin-product-notes",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "remove-add-to-cart-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wc-zelle",
    "type": "plugin",
    "affected_version": "[*, 2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-tools-gravity-forms-divi-module",
    "type": "plugin",
    "affected_version": "[*, 6.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "everse",
    "type": "theme",
    "affected_version": "[*, 1.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "run-time-image-resizing",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "rest-routes",
    "type": "plugin",
    "affected_version": "[*, 4.24.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "widget-for-contact-form-7",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "add-pinterest-conversion-tags",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wpgsi",
    "type": "plugin",
    "affected_version": "[*, 3.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-bugbot",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "integrate-google-drive",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "nokke",
    "type": "theme",
    "affected_version": "[*, 1.0.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-customers-spreadsheet-bulk-edit",
    "type": "plugin",
    "affected_version": "[*, 1.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "sync-ecommerce-neo",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "preloader-for-divi",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "more-better-reviews-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "basepress",
    "type": "plugin",
    "affected_version": "[*, 2.15.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "webba-booking-lite",
    "type": "plugin",
    "affected_version": "[*, 4.2.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "shuban",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "acf-for-woocommerce-product",
    "type": "plugin",
    "affected_version": "[*, 1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "scheduled-notification-bar",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "3d-viewer",
    "type": "plugin",
    "affected_version": "[*, 1.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "animated-fullscreen-menu",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "photoblocks-grid-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "[*, 2.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "demomentsomtres-grid-archive",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "inbound-brew",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-photo-effects",
    "type": "plugin",
    "affected_version": "[*, 1.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wpoptin",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-conditional-product-fees-for-checkout",
    "type": "plugin",
    "affected_version": "[*, 3.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "reset-course-progress-for-learndash",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "podcast-box",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "protected-page",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "turbo-widgets",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "content-protector",
    "type": "plugin",
    "affected_version": "[*, 3.5.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "gift-message-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "azw-woocommerce-file-uploads",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "blog-designer-pack",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "broadcast-lite",
    "type": "theme",
    "affected_version": "[*, 2.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "foobar-notifications-lite",
    "type": "plugin",
    "affected_version": "[*, 2.1.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "sexy-author-bio",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "rw-divi-unite-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "tablesome",
    "type": "plugin",
    "affected_version": "[*, 0.6.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "product-image-watermark-for-woo",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "advanced-form-integration",
    "type": "plugin",
    "affected_version": "[*, 1.49.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.49.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "revolution-for-elementor",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "coneblog-widgets",
    "type": "plugin",
    "affected_version": "[*, 1.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-under-construction",
    "type": "plugin",
    "affected_version": "[*, 4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-gratify",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "automizy-gravity-forms",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "widgets-on-pages",
    "type": "plugin",
    "affected_version": "[*, 1.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "feedback-suite",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "buffer-my-post",
    "type": "plugin",
    "affected_version": "[*, 2020.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2020.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "content-aware-sidebars",
    "type": "plugin",
    "affected_version": "[*, 3.17.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.17.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bani",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "fast-wp",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "skt-templates",
    "type": "plugin",
    "affected_version": "[*, 4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "[*, 1.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "add-search-to-menu",
    "type": "plugin",
    "affected_version": "[*, 5.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "add-twitter-pixel",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "xt-woo-variation-swatches",
    "type": "plugin",
    "affected_version": "[*, 1.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "url-shortify",
    "type": "plugin",
    "affected_version": "[*, 1.5.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-authorize-net-gateway-aim",
    "type": "plugin",
    "affected_version": "[*, 5.1.27)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.27",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wc4bp",
    "type": "plugin",
    "affected_version": "[*, 3.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "review-engine",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "glossary-by-codeat",
    "type": "plugin",
    "affected_version": "[*, 2.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-seo-keyword-optimizer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "cartoon-url",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "display-admin-page-on-frontend",
    "type": "plugin",
    "affected_version": "[*, 1.17.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bp-toolkit",
    "type": "plugin",
    "affected_version": "[*, 3.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "menu-image",
    "type": "plugin",
    "affected_version": "[*, 3.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "xt-woo-ajax-add-to-cart",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "one-click-login",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ether-and-erc20-tokens-woocommerce-payment-gateway",
    "type": "plugin",
    "affected_version": "[*, 4.12.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "order-on-chat-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woocommerce-shipping-gateway-per-product",
    "type": "plugin",
    "affected_version": "[*, 2.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "purosa",
    "type": "theme",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "nichetable",
    "type": "plugin",
    "affected_version": "[*, 2.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "advanced-page-visit-counter",
    "type": "plugin",
    "affected_version": "[*, 6.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-sierra",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-checkout-for-digital-goods",
    "type": "plugin",
    "affected_version": "[*, 3.6.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "seo-booster",
    "type": "plugin",
    "affected_version": "[*, 3.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "fullworks-anti-spam",
    "type": "plugin",
    "affected_version": "[*, 1.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ultimate-widgets-light",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "insert-or-embed-articulate-content-into-wordpress",
    "type": "plugin",
    "affected_version": "[*, 4.3000000016)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3000000016",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "appexperts",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ultimate-post-kit",
    "type": "plugin",
    "affected_version": "[*, 2.9.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "caxton",
    "type": "plugin",
    "affected_version": "[*, 1.30.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "nitek-carousel-cool-transitions",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "extend-filter-products-by-price-widget",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "blockmeister",
    "type": "plugin",
    "affected_version": "[*, 3.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "yatri-tools",
    "type": "plugin",
    "affected_version": "[*, 1.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "restricted-content",
    "type": "plugin",
    "affected_version": "[*, 2.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "change-prices-with-time-for-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-extra-flat-rate",
    "type": "plugin",
    "affected_version": "[*, 4.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "responsive-facebook-and-twitter-widget",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "menu-item-scheduler",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "blog-sidebar-widget",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "multipurpose-block",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "full-page-blog-designer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-swatches-manager",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-security-audit-log",
    "type": "plugin",
    "affected_version": "[*, 4.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "simple-feature-requests",
    "type": "plugin",
    "affected_version": "[*, 2.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bulk-edit-categories-tags",
    "type": "plugin",
    "affected_version": "[*, 1.5.23)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.23",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "license-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "sky-login-redirect",
    "type": "plugin",
    "affected_version": "[*, 3.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ga-for-wp",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "collage-for-divi",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-persistent-login",
    "type": "plugin",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "deal-of-the-day",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "lktags-linkedin-insight-tags",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-settings-for-learndash",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "share-this-image",
    "type": "plugin",
    "affected_version": "[*, 1.67)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.67",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "[*, 6.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "nexus",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "meridia",
    "type": "theme",
    "affected_version": "[*, 2.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "webinar-ignition",
    "type": "plugin",
    "affected_version": "[*, 2.8.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "delete-old-posts-programmatically",
    "type": "plugin",
    "affected_version": "[*, 2.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "brand",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "addons-for-visual-composer",
    "type": "plugin",
    "affected_version": "[*, 2.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-table-builder",
    "type": "plugin",
    "affected_version": "[*, 1.3.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "[*, 1.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "content-restrictor-for-divi",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "logo-showcase-with-slick-slider",
    "type": "plugin",
    "affected_version": "[*, 2.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "premmerce-woocommerce-variation-swatches",
    "type": "plugin",
    "affected_version": "[*, 1.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "portfolio-elementor",
    "type": "plugin",
    "affected_version": "[*, 2.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ssl-atlas-free-ssl-certificate-https-redirect",
    "type": "plugin",
    "affected_version": "[*, 1.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "simply-gallery-block",
    "type": "plugin",
    "affected_version": "[*, 2.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-tiktok-feed",
    "type": "plugin",
    "affected_version": "[*, 1.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "pop-over-xyz",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bulk-image-alt-text-with-yoast",
    "type": "plugin",
    "affected_version": "[*, 1.4.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "number-chat",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "rating-widget",
    "type": "plugin",
    "affected_version": "[*, 3.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "spotlight-social-photo-feeds",
    "type": "plugin",
    "affected_version": "[*, 0.10.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.10.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "expire-tags",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "go-viral",
    "type": "plugin",
    "affected_version": "[*, 1.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "cf7-styler",
    "type": "plugin",
    "affected_version": "[*, 1.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "dashylite",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "premmerce-user-roles",
    "type": "plugin",
    "affected_version": "[*, 1.0.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "radio-station",
    "type": "plugin",
    "affected_version": "[*, 2.4.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "[*, 2.4.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "seo-site-auditor-agency",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "reviewpress",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "[*, 5.3.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "mobile-menu",
    "type": "plugin",
    "affected_version": "[*, 2.8.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-smart-export",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easync-booking",
    "type": "plugin",
    "affected_version": "[*, 1.1.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-conference-schedule",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-fiscalita-italiana",
    "type": "plugin",
    "affected_version": "[*, 1.3.23)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.23",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "anfrageformular",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "premmerce-woocommerce-brands",
    "type": "plugin",
    "affected_version": "[*, 1.2.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ethereum-wallet",
    "type": "plugin",
    "affected_version": "[*, 4.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "limb-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "code-manager",
    "type": "plugin",
    "affected_version": "[*, 1.0.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "payment-gateway-payfabric",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "cp-simple-newsletter",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ach-for-stripe-plaid",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "aquarella-lite",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "commerce-coinbase-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "villar",
    "type": "theme",
    "affected_version": "[*, 1.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "map-location-picker-at-checkout-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "age-verification-screen-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-ecommerce-tracking-for-google-and-facebook",
    "type": "plugin",
    "affected_version": "[*, 3.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "joli-faq-seo",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "mass-pagesposts-creator",
    "type": "plugin",
    "affected_version": "[*, 2.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-relevant-ads",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "glorious-sites-installer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-facebook-group",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "airpress",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-structured-data-schema",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "giveaways-for-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "login-customizer",
    "type": "plugin",
    "affected_version": "[*, 2.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "learnmore",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "demomentsomtres-media-tools-auto",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "[*, 1.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "kk-star-ratings",
    "type": "plugin",
    "affected_version": "[*, 5.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "drop-shadow-boxes",
    "type": "plugin",
    "affected_version": "[*, 1.7.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "faq-manager-with-structured-data",
    "type": "plugin",
    "affected_version": "[*, 5.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "app-ads-txt",
    "type": "plugin",
    "affected_version": "[*, 1.1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "quick-contact-form",
    "type": "plugin",
    "affected_version": "[*, 8.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-front-end-profile",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "svg-flags-lite",
    "type": "plugin",
    "affected_version": "[*, 0.9.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "drip-feed-content-extended-for-learndash",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "post-list-designer",
    "type": "plugin",
    "affected_version": "[*, 2.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "conversion-de-moneda",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "vidseo",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "before-and-after-product-images-for-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bo-wc-customer-review-watson",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "lawpress",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-shipping-display-mode",
    "type": "plugin",
    "affected_version": "[*, 3.7.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "[*, 1.3.33)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.33",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "sql-reporting-services",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-sheet-editor-bulk-spreadsheet-editor-for-posts-and-pages",
    "type": "plugin",
    "affected_version": "[*, 2.24.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.24.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "delete-duplicate-posts",
    "type": "plugin",
    "affected_version": "[*, 4.7.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ws-bootstrap-vc",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "clean-social-icons",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "media-download",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-link-bio",
    "type": "plugin",
    "affected_version": "[*, 1.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "automatic-internal-links-for-seo",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "geo-mashup",
    "type": "plugin",
    "affected_version": "[*, 1.13.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-product-reviews-shortcode",
    "type": "plugin",
    "affected_version": "[*, 1.0.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "contact-list",
    "type": "plugin",
    "affected_version": "[*, 2.9.50)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.50",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "post-snippets",
    "type": "plugin",
    "affected_version": "[*, 3.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "socialmark",
    "type": "plugin",
    "affected_version": "[*, 2.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "print-my-blog",
    "type": "plugin",
    "affected_version": "[*, 3.11.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "delicious-recipes",
    "type": "plugin",
    "affected_version": "[*, 1.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "treepress",
    "type": "plugin",
    "affected_version": "[*, 2.0.21)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.21",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "postcode-redirect",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wc-product-author",
    "type": "plugin",
    "affected_version": "[*, 1.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-coupons-and-deals",
    "type": "plugin",
    "affected_version": "[*, 3.1.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "feedpress-generator",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "form-vibes",
    "type": "plugin",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-automedic",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "banner-management-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "duplicate-variations-for-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "send-prebuilt-emails",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "helpie-faq",
    "type": "plugin",
    "affected_version": "[*, 1.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "livemesh-siteorigin-widgets",
    "type": "plugin",
    "affected_version": "[*, 2.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "addons-for-beaver-builder",
    "type": "plugin",
    "affected_version": "[*, 2.8.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "tabs-with-posts",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woocommerce-es",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-auto-republish",
    "type": "plugin",
    "affected_version": "[*, 1.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-fail2ban",
    "type": "plugin",
    "affected_version": "[*, 4.4.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ultra-elementor-addons",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "recurwp",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "buttonizer-multifunctional-button",
    "type": "plugin",
    "affected_version": "[*, 2.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "quick-event-manager",
    "type": "plugin",
    "affected_version": "[*, 9.2.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "final-tiles-grid-gallery-lite",
    "type": "plugin",
    "affected_version": "[*, 3.5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "foobox-image-lightbox",
    "type": "plugin",
    "affected_version": "[*, 2.7.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-dev-powers-display-screen-dimensions-to-admin",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ultimate-bulk-seo-noindex-nofollow",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-data-access",
    "type": "plugin",
    "affected_version": "[*, 5.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woocustomizer",
    "type": "plugin",
    "affected_version": "[*, 2.3.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-top-news",
    "type": "plugin",
    "affected_version": "[*, 2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "user-menus",
    "type": "plugin",
    "affected_version": "[*, 1.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "contact-form-7-multi-step-module",
    "type": "plugin",
    "affected_version": "[*, 4.1.91)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.91",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-age-verify",
    "type": "plugin",
    "affected_version": "[*, 1.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "blocked-in-china",
    "type": "plugin",
    "affected_version": "[*, 1.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-conditional-payment-gateways",
    "type": "plugin",
    "affected_version": "[*, 1.13.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "awesome-ssl",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "iks-menu",
    "type": "plugin",
    "affected_version": "[*, 1.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "purus",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "hooked-editable-content",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "contest-code-checker",
    "type": "plugin",
    "affected_version": "[*, 1.9.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "post-carousel-divi",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "rm-mailchimp-manager",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-permalink-manager",
    "type": "plugin",
    "affected_version": "[*, 2.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "secure-ip-logins",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "video-embed-thumbnail-generator",
    "type": "plugin",
    "affected_version": "[*, 4.7.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-customers-manager",
    "type": "plugin",
    "affected_version": "[*, 1.1.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "anywhere-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "addons-for-divi",
    "type": "plugin",
    "affected_version": "[*, 3.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "events-calendar-registration-booking-by-events-plus",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "rocket-maintenance-mode",
    "type": "plugin",
    "affected_version": "[*, 4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-woo-commerce-sync-for-g-sheet",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-smooth-scroll-links",
    "type": "plugin",
    "affected_version": "[*, 2.23.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.23.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "kioken-blocks",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "cryptocurrency",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "go-fetch-jobs-wp-job-manager",
    "type": "plugin",
    "affected_version": "* - 1.7.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "quick-affiliate-store",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-tools-divi-blog-carousel",
    "type": "plugin",
    "affected_version": "[*, 1.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "post-to-google-my-business",
    "type": "plugin",
    "affected_version": "[*, 3.0.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "nichebase",
    "type": "theme",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "visitor-info",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "premmerce",
    "type": "plugin",
    "affected_version": "[*, 1.3.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "cartpops",
    "type": "plugin",
    "affected_version": "[*, 1.4.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "scrollsequence",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "elation",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "cuisine-palace",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-product-attachment",
    "type": "plugin",
    "affected_version": "[*, 2.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "master-blocks",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "uni-woo-custom-product-options",
    "type": "plugin",
    "affected_version": "[*, 4.9.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-offers",
    "type": "plugin",
    "affected_version": "[*, 1.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "tripetto",
    "type": "plugin",
    "affected_version": "[*, 5.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "widgets-on-pages-and-posts",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "better-messages-wcfm-integration",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "sheetpress",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "acf-options-importexport",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "quick-paypal-payments",
    "type": "plugin",
    "affected_version": "[*, 5.7.22)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.22",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "card-oracle",
    "type": "plugin",
    "affected_version": "[*, 1.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "better-sharing",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "restrict-user-access",
    "type": "plugin",
    "affected_version": "[*, 2.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wupo-group-attributes",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "nugget-by-ingot",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "feedbackscout",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "arendelle",
    "type": "theme",
    "affected_version": "[*, 1.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-zillow-reviews",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ds-suit",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woocommerce-store-toolkit",
    "type": "plugin",
    "affected_version": "[*, 2.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wcc-seo-keyword-research",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "elements-for-lifterlms",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "custom-registration-and-login-forms-with-new-recaptcha",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-add-to-quote",
    "type": "plugin",
    "affected_version": "[*, 1.4.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wadi-survey",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "performance-kit",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "starterblocks",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "fusionspan-impexium-single-sign-on",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "xt-woo-quick-view-lite",
    "type": "plugin",
    "affected_version": "[*, 1.9.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "drag-and-drop-form-builder-for-contact-form-7",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "primary-addon-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "jds-portfolio",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "twentyfourth-wp-scraper",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "blocksy-companion",
    "type": "plugin",
    "affected_version": "[*, 1.8.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.20",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wpgt-google-translate",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "hasium",
    "type": "theme",
    "affected_version": "[*, 1.6.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "station-pro",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "event-tickets",
    "type": "plugin",
    "affected_version": "[*, 5.3.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-paylate",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "meta-tags-for-seo",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "co2ok-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.9.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-seo-addon",
    "type": "plugin",
    "affected_version": "[*, 2.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-wholesale-pricing",
    "type": "plugin",
    "affected_version": "[*, 1.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "frontend-group-restriction-for-learndash",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "really-simple-featured-video",
    "type": "plugin",
    "affected_version": "* - 0.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "widget-for-eventbrite-api",
    "type": "plugin",
    "affected_version": "[*, 4.4.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-floating-cart-lite",
    "type": "plugin",
    "affected_version": "[*, 2.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "gdpr-cookie-consent",
    "type": "plugin",
    "affected_version": "[*, 2.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-spid-italia",
    "type": "plugin",
    "affected_version": "[*, 2.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "tier-pricing-table",
    "type": "plugin",
    "affected_version": "[*, 2.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "prime-mover",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "postmatic",
    "type": "plugin",
    "affected_version": "[*, 2.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "court-reservation",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "vo-locator-the-wp-store-locator",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "get-directions",
    "type": "plugin",
    "affected_version": "[*, 2.15.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "premmerce-redirect-manager",
    "type": "plugin",
    "affected_version": "[*, 1.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "snazzyadmin-wp-admin-theme",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "amela",
    "type": "theme",
    "affected_version": "[*, 1.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-customers-order-history",
    "type": "plugin",
    "affected_version": "[*, 5.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ethpress",
    "type": "plugin",
    "affected_version": "[*, 1.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "admin-notices-for-team",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-coupons-bulk-editor",
    "type": "plugin",
    "affected_version": "[*, 1.3.28)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.28",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woocommerce-pay-per-post",
    "type": "plugin",
    "affected_version": "[*, 3.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "bbresolutions",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "advance-wc-analytics",
    "type": "plugin",
    "affected_version": "[*, 3.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "tk-smugmug-slideshow-shortcode",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "everlightbox",
    "type": "plugin",
    "affected_version": "[*, 1.1.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "unakit",
    "type": "theme",
    "affected_version": "[*, 1.2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-affiliate-disclosure",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "ilab-media-tools",
    "type": "plugin",
    "affected_version": "[*, 4.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "racar-clear-cart-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-disable-sitemap",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "internal-links",
    "type": "plugin",
    "affected_version": "[*, 1.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "block-slider",
    "type": "plugin",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "pinblocks",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "contact-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "tickera-event-ticketing-system",
    "type": "plugin",
    "affected_version": "[*, 3.4.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "streamcast",
    "type": "plugin",
    "affected_version": "[*, 2.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "sticky-add-to-cart-for-woo",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "blockypage",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "pro-links-maintainer-dev",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-school-calendar-lite",
    "type": "plugin",
    "affected_version": "[*, 3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "listplus",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "walker-core",
    "type": "plugin",
    "affected_version": "[*, 1.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "content-warning-v2",
    "type": "plugin",
    "affected_version": "[*, 4.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "modern-designs-for-gravity-forms",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "rankbear",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "stax",
    "type": "plugin",
    "affected_version": "[*, 1.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "fast-checkout-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.1.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woocommerce-payplug",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-code-snippets",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "w3s-cf7-zoho",
    "type": "plugin",
    "affected_version": "[*, 2.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "widget-detector-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "add-tiktok-advertising-pixel",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-letsencrypt-ssl",
    "type": "plugin",
    "affected_version": "[*, 5.7.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "better-messages-wc-vendors-integration",
    "type": "plugin",
    "affected_version": "[*, 1.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "alley-business-toolkit",
    "type": "plugin",
    "affected_version": "[*, 1.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "premmerce-woocommerce-product-filter",
    "type": "plugin",
    "affected_version": "[*, 3.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wp-search-filter",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "easy-post-views-count",
    "type": "plugin",
    "affected_version": "[*, 1.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "power-ups-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "social-kit",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "post-slider-and-carousel",
    "type": "plugin",
    "affected_version": "[*, 2.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "hm-multiple-roles",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "commenting-feature",
    "type": "plugin",
    "affected_version": "[*, 2.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "alt-manager",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "premmerce-search",
    "type": "plugin",
    "affected_version": "[*, 2.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "security-safe",
    "type": "plugin",
    "affected_version": "[*, 2.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woo-bulk-edit-products",
    "type": "plugin",
    "affected_version": "[*, 1.7.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "da-reactions",
    "type": "plugin",
    "affected_version": "[*, 3.20.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "food-store",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "abeta-punchout",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "wootrello",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "page-builder-sandwich",
    "type": "plugin",
    "affected_version": "[*, 4.5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "activitytime",
    "type": "plugin",
    "affected_version": "[*, 1.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "woowgallery",
    "type": "plugin",
    "affected_version": "[*, 1.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "upfiv-complete-all-in-one-seo-wizard",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "[*, 1.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Freemius SDK \u003c= 2.4.2 - Missing Authorization Checks",
    "slug": "restaurant-cafe-addon-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4974",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Musician's Pack for Elementor \u003c= 1.8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "music-pack-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.8.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32190",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Catalog Enquiry \u003c= 3.0.5 - Arbitrary File Upload",
    "slug": "woocommerce-catalog-enquiry",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-18592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18592",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pay Per Media Player \u003c= 1.24 - Cross-Site Scripting",
    "slug": "pay-per-media-player",
    "type": "plugin",
    "affected_version": "* - 1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4543",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Reviews Import Export for WooCommerce \u003c= 1.4.8 - CSV Injection",
    "slug": "product-reviews-import-export-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46802",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Collapsing Categories \u003c= 3.0.8 - Unauthenticated SQL Injection",
    "slug": "collapsing-categories",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12025",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Posts Carousel \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play_timeout Parameter",
    "slug": "wp-posts-carousel",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1491",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 2.7.9.8 - Missing Authorization to Update License",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 2.7.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2714",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4857",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Integrate Google Drive \u003c= 1.3.8 - Missing Authorization to Unauthenticated Settings Modification and Export",
    "slug": "integrate-google-drive",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-2086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2086",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"
  },
  {
    "title": "Business \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "business",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51596",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailerLite – Signup forms (official) \u003c= 1.5.7 - Cross-Site Request Forgery",
    "slug": "official-mailerlite-sign-up-forms",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-33201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33201",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Ban-User \u003c= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "wp-ban-user",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54440",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVG Support 2.5 - 2.5.1 - Insecure Plugin Defaults to Cross-Site Scripting",
    "slug": "svg-support",
    "type": "plugin",
    "affected_version": "2.5 - 2.5.1",
    "from_version": "2.5",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4022",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SSL Zen – Free Let\u0026#039;s Encrypt SSL Certificate \u0026 HTTPS/SSL Redirect WordPress Plugin \u003c= 4.5.0 - Sensitive Information Exposure",
    "slug": "ssl-zen",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1076",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Himer \u003c= 2.1.0 - Cross-Site Request Forgery to Private Group Join",
    "slug": "himer",
    "type": "theme",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "alfred24 Click \u0026 Collect \u003c= 1.1.7 - Authenticated (Administrator+) Stored Cross Site Scripting",
    "slug": "alfred-click-collect",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47158",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "* - 8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49400",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IDonate \u003c= 2.1.9 - Unauthenticated Local File Inclusion",
    "slug": "idonate",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32519",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "W3 Total Cache \u003c= 2.8.1 Information Exposure via Log Files",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12008",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Admin Trim Interface \u003c= 3.5.1 - Unauthenticated Full Path Disclosure",
    "slug": "admin-trim-interface",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6545",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Liveticker (by stklcode) \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stklcode-liveticker",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13701",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JustRows free \u003c= 0.2 - Reflected Cross-Site Scripting",
    "slug": "justrows-free",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13330",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JoomSport – for Sports: Team \u0026 League, Football, Hockey \u0026 more \u003c= 5.1.7 - Object Injection",
    "slug": "joomsport-sports-league-results-management",
    "type": "plugin",
    "affected_version": "[*, 5.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24384",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Logs Book \u003c= 1.0.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-logs-book",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4477",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NIX Anti-Spam Light \u003c= 0.0.4 - Unauthenticated PHP Object Injection",
    "slug": "nix-anti-spam-light",
    "type": "plugin",
    "affected_version": "* - 0.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52432",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Ads – Ad Manager \u0026 AdSense \u003c= 1.52.1 - Authenticated (Admin+) PHP Object Injection",
    "slug": "advanced-ads",
    "type": "plugin",
    "affected_version": "* - 1.52.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.52.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2290",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stock in \u0026 out \u003c= 1.0.4 - SQL Injection",
    "slug": "stock-in",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24520",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GravityForms \u003c= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter",
    "slug": "gravityforms",
    "type": "plugin",
    "affected_version": "* - 2.9.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13377",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP AntiDDOS \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "wpantiddos",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26556",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Noisa \u003c= 2.6.0 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "noisa",
    "type": "theme",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53560",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Save as PDF Plugin by Pdfcrowd \u003c= 4.4.0 - Unauthenticated PHP Object Injection",
    "slug": "save-as-pdf-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 4.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24671",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Feed PRO for WooCommerce by AdTribes – WooCommerce Product Feeds for Google, Facebook/Meta, Bing, \u0026 More \u003c= 13.3.1 - Sensitive Information Exposure via Log Files",
    "slug": "woo-product-feed-pro",
    "type": "plugin",
    "affected_version": "* - 13.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32513",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ovic Importer \u003c= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "ovic-import-demo",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35754",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Name Directory \u003c= 1.30.0 - Missing Authorization",
    "slug": "name-directory",
    "type": "plugin",
    "affected_version": "* - 1.30.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39454",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WebinarIgnition \u003c= 3.05.8 - Cross-Site Request Forgery",
    "slug": "webinar-ignition",
    "type": "plugin",
    "affected_version": "* - 3.05.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.05.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32445",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "eDS Responsive Menu \u003c= 1.2 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "eds-responsive-menu",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58839",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bricks \u003c= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting",
    "slug": "bricks",
    "type": "theme",
    "affected_version": "* - 1.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3410",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ajax Pagination (twitter Style) \u003c= 1.1 - Local File Inclusion",
    "slug": "ajax-pagination",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-2674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2674",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mediavine Control Panel \u003c= 2.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mediavine-control-panel",
    "type": "plugin",
    "affected_version": "* - 2.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43218",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "xili-dictionary \u003c= 2.12.5.2 - Reflected Cross-Site Scripting",
    "slug": "xili-dictionary",
    "type": "plugin",
    "affected_version": "* - 2.12.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52778",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP doodlez \u003c= 1.0.10 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wpdoodlez",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25159",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Track, Analyze \u0026amp; Optimize by WP Tao \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "wp-tao",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48145",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stray Random Quotes \u003c= 1.9.9 - Reflected Cross-Site Scripting",
    "slug": "stray-quotes",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13570",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP OAuth Server (OAuth Authentication) \u003c= 4.2.5 - Cross-Site Request Forgery",
    "slug": "oauth2-provider",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3926",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Skip To \u003c= 2.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "skip-to",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51652",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Social Comments \u003c= 1.7.3 - Missing Authorization via wpfc_allow_comments()",
    "slug": "gs-facebook-comments",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32689",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress CTA \u003c= 1.7.0 - Cross-Site Request Forgery",
    "slug": "easy-sticky-sidebar",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53270",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Larsens Calender \u003c= 1.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "larsens-calender",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-23762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-23762",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Estimate and Quote \u003c= 1.0.2.5 - Reflected Cross-Site Scripting",
    "slug": "wc-estimate-and-quote",
    "type": "plugin",
    "affected_version": "* - 1.0.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32514",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 4.9.4 - Authenticated (Admin+) SQL Injection",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "[*, 4.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-30501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30501",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0661",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Optio Dentistry \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "optio-dentistry",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12507",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MAZ Loader – Preloader Builder for WordPress \u003c= 1.3.2 - SQL Injection",
    "slug": "maz-loader",
    "type": "plugin",
    "affected_version": "[*, 1.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24669",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WpStream – Live Streaming, Video on Demand, Pay Per View \u003c= 4.5.4 - Cross-Site Request Forgery via wpstream_update_local_event_settings",
    "slug": "wpstream",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38512",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AForms Eats \u003c= 1.3.1 - Unauthenticated Full Path Disclosure",
    "slug": "aforms-eats",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13539",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "bxSlider integration for WordPress \u003c= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bxslider-integration",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48347",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kunze Law \u003c 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "kunze-law",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments Evolved for WordPress \u003c= 1.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gplus-comments",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34420",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Email \u003c= 1.2.65 - Cross-Site Scripting",
    "slug": "contact-form-to-email",
    "type": "plugin",
    "affected_version": "* - 1.2.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.65",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20963",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swift Framework \u003c= 2.7.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "swift-framework",
    "type": "plugin",
    "affected_version": "* - 2.7.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3916",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yellow Yard Searchbar \u003c= 2.7.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "yellow-yard",
    "type": "plugin",
    "affected_version": "* - 2.7.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1110",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XLSXviewer \u003c= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "xlsx-viewer",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23562",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Content No Cache \u003c= 0.1.4 - Unauthenticated Arbitrary Function Call",
    "slug": "content-no-cache",
    "type": "plugin",
    "affected_version": "* - 0.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28993",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Contact Form Email \u003c= 1.3.44 - Unauthenticated Sensitive Information Exposure",
    "slug": "contact-form-to-email",
    "type": "plugin",
    "affected_version": "* - 1.3.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31302",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0897",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 2.9.5 - Authorization Bypass",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-20634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-20634",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Events Planner \u003c= 1.3.10 - Reflected Cross-Site Scripting",
    "slug": "events-planner",
    "type": "plugin",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26586",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2308",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Events Calendar Free \u0026 Pro \u003c= 6.4.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Events Access",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1295",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "The Events Calendar Free \u0026 Pro \u003c= 6.4.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Events Access",
    "slug": "events-calendar-pro",
    "type": "plugin",
    "affected_version": "* - 6.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1295",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WS Form LITE \u003c= 1.9.170 - Authenticated(Administrator+) SQL Injection",
    "slug": "ws-form",
    "type": "plugin",
    "affected_version": "[*, 1.9.171)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.171",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-52135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52135",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 3.0.3 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2010-4536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4536",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Marksheet Creator : eMarksheet \u003c= 5.4.3 - Reflected Cross-Site Scripting",
    "slug": "emarksheet",
    "type": "plugin",
    "affected_version": "* - 5.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Charity-thermometer \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "charitydonation-thermometer",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23860",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support Board \u003c 3.3.6 - Cross-Site Request Forgery",
    "slug": "supportboard",
    "type": "plugin",
    "affected_version": "[*, 3.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24823",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "JetFormBuilder \u003c= 3.1.4 - Unauthenticated Content Injection",
    "slug": "jetformbuilder",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48763",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Coming Soon \u0026 Maintenance \u003c= 1.0.9 - Missing Authorization to Unauthenticated Template Activation",
    "slug": "ultimate-coming-soon",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9706",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP No-Bot Question \u003c= 0.1.7 - Cross-Site Request Forgery",
    "slug": "wp-no-bot-question",
    "type": "plugin",
    "affected_version": "* - 0.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28909",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CURCY – Multi Currency for WooCommerce \u003c= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function",
    "slug": "woo-multi-currency",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13487",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WPlite \u003c= 1.3.1 - Cross-Site Request Forgery",
    "slug": "wplite",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1831",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Inventory Manager \u003c= 2.1.0.11 - Reflected Cross-Site Scripting via 'message'",
    "slug": "wp-inventory-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1806",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon Maintenance Mode \u003c= 1.0.5 - Information Exposure",
    "slug": "coming-soon-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1475",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Booster Elite for WooCommerce \u003c 1.1.7 - Authenticated (Admin/Shop Manager+) Arbitrary File Download",
    "slug": "booster-elite-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-3762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3762",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Additional Fees On Checkout (Free) \u003c= 1.4.7 - Reflected Cross-Site Scripting via 'number'",
    "slug": "woo-additional-fees-on-checkout-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12395",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile browser color select \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mobile-browser-color-select",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1969",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Website Builder – More than Just a Page Builder \u003c= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.20.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2117",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce UPS Shipping – Live Rates and Access Points \u003c= 2.2.4 - Cross-Site Request Forgery",
    "slug": "flexible-shipping-ups",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31944",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TI WooCommerce Wishlist \u003c= 2.9.0 - Unauthenticated SQL Injection via 'lang'",
    "slug": "ti-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9156",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Falang multilanguage \u003c= 1.3.51 - Cross-Site Request Forgery",
    "slug": "falang",
    "type": "plugin",
    "affected_version": "* - 1.3.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37240",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Preschool and Kindergarten \u003c= 1.2.1 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "preschool-and-kindergarten",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37413",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Meta and Date Remover \u003c= 2.3.0 - Cross-Site Request Forgery via updateSettings",
    "slug": "wp-meta-and-date-remover",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Hide WP Toolbar \u003c= 2.7 - Missing Authorization",
    "slug": "hide-wp-toolbar",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57969",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Integration of Zoho CRM and Contact Form 7 \u003c= 1.0.6 - Open Redirect",
    "slug": "integration-of-zoho-crm-and-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31821",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pretty Links – Link Management, Branding, Tracking \u0026 Sharing Plugin \u003c 1.5.6 - Reflected Cross-Site Scripting",
    "slug": "pretty-link",
    "type": "plugin",
    "affected_version": "[*, 1.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-4595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4595",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LatePoint \u003c= 5.0.12 - Authentication Bypass",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 5.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8943",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "워드프레스 결제 심플페이 – 우커머스 결제 플러그인 \u003c= 5.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting pafw_instant_payment Shortcode",
    "slug": "pgall-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11228",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MDJM Event Management \u003c= 1.7.5.2 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "mobile-dj-manager",
    "type": "plugin",
    "affected_version": "* - 1.7.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31074",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Subscribe to Download Lite \u003c= 1.2.9 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "subscribe-to-download-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30782",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Social Login \u003c= 3.0.4 - Reflected Cross-Site Scripting",
    "slug": "wordpress-social-login",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34023",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "CallRail Phone Call Tracking \u003c= 0.4.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "callrail-phone-call-tracking",
    "type": "plugin",
    "affected_version": "* - 0.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36796",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uploading SVG, WEBP and ICO files \u003c= 1.0.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "uploading-svgwebp-and-ico-files",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-34648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34648",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk images optimizer: Resize, optimize, convert to webp, rename ... \u003c= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update",
    "slug": "bulk-image-resizer",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9361",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Duplicator \u003c= 1.2.28 – Unauthenticated Stored Cross-Site Scripting",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "* - 1.2.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-16815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Takeover \u003c= 1.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "page-takeover",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31470",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cache Images \u003c= 3.2 - Cross-Site Request Forgery to Image Upload",
    "slug": "cache-images",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2091",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Secure Copy Content Protection and Content Locking \u003c= 4.4.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "secure-copy-content-protection",
    "type": "plugin",
    "affected_version": "* - 4.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30905",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Beaver Builder \u003c= 1.35.13 - Authenticated(Contributor+) Directory Traversal to Arbitrary File Download",
    "slug": "bb-ultimate-addon",
    "type": "plugin",
    "affected_version": "* - 1.35.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.35.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51401",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Page Builder Gutenberg Blocks – CoBlocks \u003c= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "coblocks",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1049",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sniplets \u003c 1.2.3 - Remote Code Execution",
    "slug": "sniplets",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2008-1060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-1060",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks \u003c= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.80",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3155",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVS Pricing Tables \u003c= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion",
    "slug": "svs-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2960",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "USPS Shipping for WooCommerce – Live Rates \u003c= 1.9.2 - Cross-Site Request Forgery",
    "slug": "flexible-shipping-usps",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31943",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Travel Map \u003c= 1.0.1 - Unauthenticated Cross-Site Scripting",
    "slug": "travelmap-blog",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-41860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41860",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sync QCloud COS Plugin \u003c 2.0.1 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "sync-qcloud-cos",
    "type": "plugin",
    "affected_version": "[*, 2.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0659",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Blocks \u003c= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Photo Sphere \u003c= 0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-photo-sphere",
    "type": "plugin",
    "affected_version": "* - 0.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22532",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vehica Core \u003c= 1.0.100 - Cross-Site Request Forgery",
    "slug": "vehica-core",
    "type": "plugin",
    "affected_version": "* - 1.0.100",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.100",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60117",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Copymatic – AI Content Writer \u0026 Generator \u003c= 1.6 - Unauthenticated Arbitrary File Upload",
    "slug": "copymatic",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31351",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Greenshift – animation and page builder blocks \u003c= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 4.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4653",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "gap-hub-user-role \u003c= 3.4.1 - Cross-Site Request Forgery",
    "slug": "gap-hub-user-role",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56206",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "404 SEO Redirection \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "404-redirection-manager",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24325",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Show Posts \u003c= 1.1.5 - Improper Authorization to Information Exposure",
    "slug": "wp-show-posts",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6731",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ACF Photo Gallery Field \u003c= 2.6 - Missing Authorization in apgf_update_donation",
    "slug": "navz-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23518",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YARPP \u003c= 5.30.4 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "yet-another-related-posts-plugin",
    "type": "plugin",
    "affected_version": "* - 5.30.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.30.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45374",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Forms, Live Support, CRM, Video Messages \u003c= 1.10.3 - Unauthenticated Information Disclosure",
    "slug": "live-support-tickets",
    "type": "plugin",
    "affected_version": "* - 1.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49235",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jobs for WordPress \u003c= 2.5.10.2 - Authenticated (Author+) Cross Site Scripting",
    "slug": "job-postings",
    "type": "plugin",
    "affected_version": "* - 2.5.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44743",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bricks 1.0 - 1.5.3 - Missing Authorization to Arbitrary Content Creation/Modification",
    "slug": "bricks",
    "type": "theme",
    "affected_version": "1.0 - 1.5.3",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3400",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Gravity Forms WebHooks \u003c= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook",
    "slug": "gravityformswebhooks",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13845",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Poll \u003c 34.06 - SQL Injection",
    "slug": "cardoza-wordpress-poll",
    "type": "plugin",
    "affected_version": "* - 34.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "34.05",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-1400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1400",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Sorter \u003c= 1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "the-sorter",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24399",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.59 - Reflected Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4710",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Pagespeed Insights \u003c= 4.0.3 - Reflected Cross-Site Scripting",
    "slug": "google-pagespeed-insights",
    "type": "plugin",
    "affected_version": "[*, 4.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0431",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Grouped Product for WooCommerce \u003c= 4.4.2 - Missing Authorization",
    "slug": "wpc-grouped-product",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32520",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Material Dashboard \u003c= 1.4.5 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "material-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31014",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mail Logging \u003c= 1.11.1 - Unauthenticated Stored Cross-Site Scripting via Email",
    "slug": "wp-mail-logging",
    "type": "plugin",
    "affected_version": "* - 1.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3081",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Menu \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "custom-sub-menus",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38321",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow Gallery LITE \u003c= 1.7.6 - Cross-Site Request Forgery via admin_slides",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28497",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "AnWP Football Leagues \u003c= 0.16.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "football-leagues-by-anwppro",
    "type": "plugin",
    "affected_version": "* - 0.16.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.16.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8917",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register \u003c= 2.0.13 - Missing Authorization",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "* - 2.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-8802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8802",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Image Metadata Cruncher  \u003c 1.8 - Reflected Cross Site Scripting",
    "slug": "image-metadata-cruncher",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-1614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1614",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "School Management System for Wordpress \u003c= 93.1.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 93.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "93.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3740",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hide My WP \u003c= 6.2.3 - SQL Injection",
    "slug": "hide_my_wp",
    "type": "plugin",
    "affected_version": "* - 6.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36916",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"
  },
  {
    "title": "User Activity Tracking and Log \u003c= 4.0.8 - Cross-Site Request Forgery",
    "slug": "user-activity-tracking-and-log",
    "type": "plugin",
    "affected_version": "* - 4.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Calendar \u003c= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "event-calendars",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8701",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Estonian Shipping Methods for WooCommerce \u003c= 1.7.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "estonian-shipping-methods-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58656",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Locatoraid Store Locator \u003c= 3.9.50 - Unauthenticated PHP Object Injection",
    "slug": "locatoraid",
    "type": "plugin",
    "affected_version": "* - 3.9.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.50",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56283",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Torro Forms \u003c= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "torro-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36791",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Registrations for the Events Calendar \u003c= 2.7.9 - Reflected Cross-Site Scripting",
    "slug": "registrations-for-the-events-calendar",
    "type": "plugin",
    "affected_version": "[*, 2.7.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25083",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smush – Lazy Load Images, Optimize \u0026 Compress Images \u003c= 3.9.8 - Cross-Site Scripting",
    "slug": "wp-smushit",
    "type": "plugin",
    "affected_version": "* - 3.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1009",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Target Video Easy Publish \u003c= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via brid_override_yt Shortcode",
    "slug": "brid-video-easy-publish",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13561",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Customer Area \u003c= 8.2.4 - Cross-Site Request Forgery to Bulk Deletion",
    "slug": "customer-area",
    "type": "plugin",
    "affected_version": "* - 8.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12436",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Olevmedia Shortcodes \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "olevmedia-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0168",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "About Me 3000 widget \u003c= 2.2.6 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "about-me-3000",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25474",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "XStore \u003c= 9.3.8 - Reflected Cross-Site Scripting",
    "slug": "xstore",
    "type": "theme",
    "affected_version": "* - 9.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33562",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Event Manager \u003c= 3.2.0 - Missing Authorization",
    "slug": "wp-event-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32225",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Complianz | GDPR/CCPA Cookie Consent \u003c= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settings",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6498",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Poll \u003c= 36 - SQL Injection",
    "slug": "cardoza-wordpress-poll",
    "type": "plugin",
    "affected_version": "* - 36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "36",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-24315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24315",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.91 - Google Drive Client Secret Exposure",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.91",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5576",
    "auth_type": "Unauth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N"
  },
  {
    "title": "Houzez \u003c= 2.8.2 - Unauthenticated SQL Injection",
    "slug": "houzez",
    "type": "theme",
    "affected_version": "[*, 2.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-29432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29432",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPCHURCH \u003c= 2.7.0 - Reflected Cross-Site Scripting",
    "slug": "church-management",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31642",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Manager Pro – Filester \u003c= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation",
    "slug": "filester",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12331",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Taggbox \u003c= 3.3 - Cross-Site Request Forgery",
    "slug": "taggbox-widget",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38754",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks with AI by Kadence WP – Page Builder Features \u003c= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5289",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login Block IPs \u003c= 1.0.0 - IP Spoofing to Protection Mechanism Bypass",
    "slug": "login-block-ips",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1579",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52389",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pocket Widget \u003c= 0.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pocket-widget",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7918",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Social Media Share Buttons \u003c= 3.2.3 - Admin+ Stored Cross-Site Scripting",
    "slug": "simple-social-buttons",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24656",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Compare \u003c= 2.37.0 - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-compare",
    "type": "plugin",
    "affected_version": "* - 2.37.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.37.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32699",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Enable SVG, WebP \u0026 ICO Upload \u003c= 1.1.0 - Arbitrary File Upload",
    "slug": "enable-svg-webp-ico-upload",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-34154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34154",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Media Library Assistant \u003c= 3.07 - Reflected Cross-Site Scripting",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34010",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Landingi Landing Pages \u003c= 3.1.1 - Cross-Site Request Forgery",
    "slug": "landingi-landing-pages",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30521",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Tag Lists \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "advanced-tag-list",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32476",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12599",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exertio Framework \u003c= 1.3.1 - Unauthenticated Arbitrary User Password Update",
    "slug": "exertio-framework",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13373",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SiteOrigin Widgets Bundle \u003c= 1.68.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element Attribute",
    "slug": "so-widgets-bundle",
    "type": "plugin",
    "affected_version": "* - 1.68.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.68.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5585",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.37.7212",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.37.7212",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4520",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form DB \u003c= 2.8.26 - Authenticated Cross-Site Scripting",
    "slug": "contact-form-7-to-database-extension",
    "type": "plugin",
    "affected_version": "* - 2.8.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-2040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2040",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "AAWEP Obfuscator \u003c= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "aawp-obfuscator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3432",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Font Organizer \u003c= 2.1.1 - Reflected Cross-Site Scripting",
    "slug": "font-organizer",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-9908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9908",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SecuPress Free \u003c= 2.2.5.3 - Missing Authorization",
    "slug": "secupress",
    "type": "plugin",
    "affected_version": "* - 2.2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43228",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress HelpDesk \u0026 Support Ticket System Plugin – Octrace Support \u003c= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "octrace-support",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22762",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simpolio - Fullscreen Portfolio \u0026 Blog HTML Theme \u003c= 1.3.2 - Arbitrary Options Update",
    "slug": "simpolio",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9474",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate YouTube Video \u0026 Shorts Player With Vimeo \u003c= 3.3 - Missing Authorization to Authenticated (Subscriber+) Setting Exposure",
    "slug": "ultimate-youtube-video-player",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11355",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.5.3 - Unauthenticated Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47444",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OAuth Single Sign On – SSO (OAuth Client) \u003c= 6.26.3 - Authentication Bypass",
    "slug": "miniorange-login-with-eve-online-google-facebook",
    "type": "plugin",
    "affected_version": "* - 6.26.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.26.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10111",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RegistrationMagic \u003c= 5.0.2.1 - SQL Injection",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "[*, 5.0.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0420",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom List Table Example \u003c= 1.4.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "custom-list-table-example",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23808",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailChimp Subscribe Forms  \u003c= 4.0.9.7 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "mailchimp-subscribe-sm",
    "type": "plugin",
    "affected_version": "* - 4.0.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43211",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP TopBar \u003c= 5.36 - Cross Site Request Forgery",
    "slug": "wp-topbar",
    "type": "plugin",
    "affected_version": "* - 5.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.36",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23680",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Namaste! LMS \u003c= 2.5.9.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "namaste-lms",
    "type": "plugin",
    "affected_version": "[*, 2.5.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-24383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24383",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Autoptimize \u003c= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Rules",
    "slug": "autoptimize",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2113",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forums \u003c 1.4.4 - Directory Traversal",
    "slug": "zingiri-forum",
    "type": "plugin",
    "affected_version": "[*, 1.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-4920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4920",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Google Maps v3 Shortcode \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "google-maps-v3-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23827",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Official CleverReach Plugin for WooCommerce \u003c= 3.4.4 - Cross-Site Request Forgery to Settings Update",
    "slug": "cleverreach-wc",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32241",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simply Schedule Appointments \u003c= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.6.8.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4667",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Catalogue \u003c= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "wp-catalogue",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48780",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder Sandwich – Front-End Page Builder \u003c= 5.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "page-builder-sandwich",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37219",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue \u003c= 4.2.2 - Missing Authorization",
    "slug": "bellevuex",
    "type": "theme",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39398",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Hover Effects – Elementor Addon \u003c= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via eihe_link Parameter",
    "slug": "image-hover-effects-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4780",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Foton \u003c= 2.5.2 - Unauthenticated Local File Inclusion",
    "slug": "foton",
    "type": "theme",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39458",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Coupon Creator \u003c= 3.1 - Cross-Site Request Forgery Bypass",
    "slug": "coupon-creator",
    "type": "plugin",
    "affected_version": "[*, 3.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36751",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Click to Chat – HoliThemes \u003c= 3.35 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "click-to-chat-for-whatsapp",
    "type": "plugin",
    "affected_version": "* - 3.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.35",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3849",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Torod – The smart shipping and delivery portal for e-shops and retailers \u003c= 1.7 - Missing Authorization to Unauthenticated Plugin Settings Update",
    "slug": "torod",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55995",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "SERPed.net \u003c= 4.6 - Unauthenticated Local File Inclusion",
    "slug": "serped-net",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28998",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Doc Embedder \u003c 2.5.4 - Directory Traversal",
    "slug": "google-document-embedder",
    "type": "plugin",
    "affected_version": "[*, 2.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-4915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4915",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Contact Form builder with drag \u0026 drop - Kali Forms \u003c= 2.3.28 - Missing Authorization via get_log",
    "slug": "kali-forms",
    "type": "plugin",
    "affected_version": "* - 2.3.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45275",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Watu Quiz \u003c= 3.4.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46242",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "DX-auto-save-images \u003c= 1.4.0 - Cross-Site Request Forgery",
    "slug": "dx-auto-save-images",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40671",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RAphicon \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "raphicon",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46467",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team \u003c= 1.2.6 - Authenticated (Contibutor+) Stored Cross-Site Scripting",
    "slug": "adl-team",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-34853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34853",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c 3.2.55 - Missing Authorization to Cross-Site Scripting",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "[*, 3.2.55)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.55",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-2839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2839",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23996",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Abandoned Cart Lite for WooCommerce \u003c= 5.8.5 - Cross-Site Request Forgery Bypass",
    "slug": "woocommerce-abandoned-cart",
    "type": "plugin",
    "affected_version": "* - 5.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4414",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MyParcel \u003c= 4.24.1 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-myparcel",
    "type": "plugin",
    "affected_version": "* - 4.24.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9608",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7035",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support  \u003c= 6.1.6 - Insufficient Authorization via wpas_can_delete_attachments()",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24716",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Recip.ly \u003c= 1.1.7 - Unauthenticated Arbitrary File Upload in uploadImage.php",
    "slug": "reciply",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2011-10004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-10004",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEO Search Permalink \u003c= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "seo-search-permalink",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60184",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Regenerate \u0026 Select Crop \u003c= 7.3.0 - Sensitive Information Exposure",
    "slug": "image-regenerate-select-crop",
    "type": "plugin",
    "affected_version": "* - 7.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46820",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "My Shortcodes \u003c= 2.3 - Missing Authorization via Multiple AJAX Actions",
    "slug": "my-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46632",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "No-Bot Registration \u003c= 1.9.1 - Cross-Site Request Forgery",
    "slug": "no-bot-registration",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31372",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple File List \u003c= 6.1.14 - Unauthenticated Arbitrary File Download",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "* - 6.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54021",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Twitch Player \u003c= 2.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ttv-easy-embed-player",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25464",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiParcels Shipping For WooCommerce \u003c= 1.15.3 - Reflected Cross-Site Scripting",
    "slug": "multiparcels-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.15.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3671",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kraken.io Image Optimizer \u003c= 2.6.5 - Cross-Site Request Forgery",
    "slug": "kraken-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38454",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UserAgent-Spy \u003c= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "useragent-spy",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2490",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Payments Plugin | GetPaid \u003c= 2.3.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "invoicing",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24369",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Folders \u003c= 2.9.2 - Authenticated (Author+) Arbitrary File Upload in handle_folders_file_upload",
    "slug": "folders",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-40204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40204",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SureTriggers – Connect All Your Plugins, Apps, Tools \u0026 Automate Everything! \u003c= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode",
    "slug": "suretriggers",
    "type": "plugin",
    "affected_version": "* - 1.0.47",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.47",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5485",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Language Translate Widget for WordPress – ConveyThis \u003c= 223 - Unauthenticated Stored Cross-Site Scripting via api_key",
    "slug": "conveythis-translate",
    "type": "plugin",
    "affected_version": "* - 223",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "223",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6811",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Utech World Time \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "utech-world-time-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54441",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coupon Affiliates – Affiliate Plugin for WooCommerce \u003c= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting",
    "slug": "woo-coupon-usage",
    "type": "plugin",
    "affected_version": "* - 5.16.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.16.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12421",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "UserPro \u003c= 4.9.34 - Reflected Cross-Site Scripting",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 4.9.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14470",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popping Content Light \u003c= 2.4 - Reflected Cross-Site Scripting",
    "slug": "popping-content-light",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32115",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4783",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Blog Post Layouts \u003c= 1.1.3 - Authenticated (Contributor+) Local File Inlcusion",
    "slug": "wp-blog-post-layouts",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5503",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sp*tify Play Button for WordPress \u003c= 2.10 - Cross-Site Request Forgery",
    "slug": "spotify-play-button-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41131",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WCFM Membership – WooCommerce Memberships for Multivendor Marketplace \u003c= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change",
    "slug": "wc-multivendor-membership",
    "type": "plugin",
    "affected_version": "* - 2.10.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2276",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Products without featured images \u003c= 0.1 - Cross-Site Request Forgery",
    "slug": "woocommerce-products-without-featured-images",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32545",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hacklog DownloadManager \u003c= 2.1.4 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "hacklog-downloadmanager",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52401",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LinkWorth plugin \u003c= 3.3.3 - Cross-Site Request Forgery to Plugin Setting Update",
    "slug": "linkworth-wp-plugin",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2172",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Message Filter for Contact Form 7 \u003c= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation",
    "slug": "cf7-message-filter",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12026",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Eveeno \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "eveeno",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11752",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yahoo! WebPlayer \u003c= 2.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "yahoo-media-player",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53779",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zotpress \u003c= 7.3.3 - Reflected Cross-Site Scripting",
    "slug": "zotpress",
    "type": "plugin",
    "affected_version": "* - 7.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32961",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Definitive Addons for Elementor \u003c= 1.5.16 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "definitive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51587",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP HTML Mail \u003c= 3.0.9 - Missing Authorization on Rest Route",
    "slug": "wp-html-mail",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0218",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Export any WordPress data to XML/CSV \u003c 1.4.1 \u0026 WP ALL Export Pro \u003c 1.8.6 - Authenticated (Admin+) Remote Code Execution",
    "slug": "wp-all-export-pro",
    "type": "plugin",
    "affected_version": "[*, 1.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4724",
    "auth_type": "Privileged",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Export any WordPress data to XML/CSV \u003c 1.4.1 \u0026 WP ALL Export Pro \u003c 1.8.6 - Authenticated (Admin+) Remote Code Execution",
    "slug": "wp-all-export",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4724",
    "auth_type": "Privileged",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Related Posts \u003c 2.7.2 - Cross-Site Request Forgery",
    "slug": "wordpress-23-related-posts-plugin",
    "type": "plugin",
    "affected_version": "[*, 2.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-3476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3476",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post SMTP \u003c= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3082",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker \u003c= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 4.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27996",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web2application \u003c= 6.0 - Reflected Cross-Site Scripting",
    "slug": "web2application",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32590",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Coder – add custom html, css and js code \u003c= 2.5.3 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-coder",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0895",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Endless Posts Navigation \u003c= 2.2.7 - Cross-Site Request Forgery",
    "slug": "endless-posts-navigation",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49629",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DBargain \u003c= 3.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "d-bargain",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32591",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Gallery – Grid Gallery \u003c= 1.1.1 - Stored Cross-Site Scripting",
    "slug": "gallery-image-gallery-photo",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-1327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1327",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Wishlist \u003c= 2.1.0 - Authenticated (Subscriber+) Information Exposure",
    "slug": "wishlist",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31062",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Countdown, Coming Soon, Maintenance – Countdown \u0026 Clock \u003c= 2.8.9.1 - Unauthenticated Limited Local File Inclusion",
    "slug": "countdown-builder",
    "type": "plugin",
    "affected_version": "* - 2.8.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2270",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Blocks \u003c= 4.2.0 - Unauthenticated PHP Object Injection via products",
    "slug": "essential-blocks-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4402",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Blocks \u003c= 4.2.0 - Unauthenticated PHP Object Injection via products",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4402",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Icon Widget \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "icon-widget-with-links",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51929",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 5.13.3 - Insecure Direct Object Reference to Information Disclosure",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 5.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6226",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Unlock Addons for Elementor \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "unlock-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54230",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid  \u003c= 5.9.5.2 - Authenticated (Subscriber+) Full Path Disclosure",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "eZee Online Hotel Booking Engine \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "online-booking-engine",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58661",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder \u003c= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0871",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointmind \u003c= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "appointmind",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9851",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Fattureincloud \u003c= 2.6.7 - Reflected Cross-Site Scripting",
    "slug": "woo-fattureincloud",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slimstat Analytics \u003c= 5.0.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45373",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Role Editor \u003c= 4.64.3 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "user-role-editor",
    "type": "plugin",
    "affected_version": "* - 4.64.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.64.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12293",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AHAthat Plugin \u003c= 1.6 - Cross-Site Request Forgery to AHA Page Deletion",
    "slug": "ahathat",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4337",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Custom Admin Interface \u003c= 7.28 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "wp-custom-admin-interface",
    "type": "plugin",
    "affected_version": "* - 7.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4043",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Export any WordPress data to XML/CSV \u003c 1.4.1 \u0026 WP ALL Export Pro \u003c 1.8.6 - Cross-Site Request Forgery to PHAR Deserialization",
    "slug": "wp-all-export-pro",
    "type": "plugin",
    "affected_version": "[*, 1.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-5886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5886",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Export any WordPress data to XML/CSV \u003c 1.4.1 \u0026 WP ALL Export Pro \u003c 1.8.6 - Cross-Site Request Forgery to PHAR Deserialization",
    "slug": "wp-all-export",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-5886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5886",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update",
    "slug": "swatchly",
    "type": "plugin",
    "affected_version": "1.2.8 - 1.4.0",
    "from_version": "1.2.8",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2719",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "ShareThis \u003c= 7.0.5 - Cross-Site Request Forgery",
    "slug": "share-this",
    "type": "plugin",
    "affected_version": "* - 7.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-3479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3479",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Notification Bar \u003c= 2.2 - Cross-Site Request Forgery",
    "slug": "simple-bar",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9895",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blog2Social: Social Media Auto Post \u0026 Scheduler \u003c= 8.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "* - 8.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4133",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulletin Announcements \u003c= 3.11.7 - Reflected Cross-Site Scripting",
    "slug": "bulletin-announcements",
    "type": "plugin",
    "affected_version": "* - 3.11.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10682",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGraphQL WooCommerce \u003c= 0.11.0 - Information Disclosure",
    "slug": "wp-graphql-woocommerce",
    "type": "plugin",
    "affected_version": "* - 0.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1563",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "About Author Box \u003c 1.0.2 - Cross-Site Scripting",
    "slug": "about-author-box",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24745",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajax WP Query Search Filter \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ajax-wp-query-search-filter",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23926",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Scriptcase \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter",
    "slug": "wp-scriptcase",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8691",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "aapanel WP Toolkit 1.0 - 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via auto_login() Function",
    "slug": "aapanel-wp-toolkit",
    "type": "plugin",
    "affected_version": "1.0 - 1.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6813",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Links in Captions \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "links-in-captions",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25098",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MinimogWP – The High Converting eCommerce WordPress Theme \u003c= 3.9.0 - Unauthenticated Price Manipulation",
    "slug": "minimog",
    "type": "theme",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8198",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jarvis – Night Club, Concert, Festival WordPress \u003c= 1.8.11 - Unauthenticated PHP Object Injection",
    "slug": "jarvis",
    "type": "theme",
    "affected_version": "* - 1.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32292",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Funnel Builder by FunnelKit \u003c= 3.11.1 - Unauthenticated Local File Inclusion",
    "slug": "funnel-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54750",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Display Post Meta \u003c= 2.4.4 -Reflected Cross-Site Scripting",
    "slug": "display-post-meta",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26575",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Editor Wysiwyg Background Color \u003c= 1.0 - Missing Authorization",
    "slug": "editor-wysiwyg-background-color",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23958",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Service Finder Booking \u003c= 6.0 - Unauthenticated Privilege Escalation",
    "slug": "sf-booking",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-23970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23970",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "[GWA] AutoResponder \u003c= 2.3 - Unauthenticated SQL Injection",
    "slug": "autoresponder-gwa",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-44779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-44779",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Debug Log Manager \u003c= 2.3.1 - Missing Authorization",
    "slug": "debug-log-manager",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BadgeOS \u003c= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwrite",
    "slug": "badgeos",
    "type": "plugin",
    "affected_version": "* - 3.7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2172",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Summary and Print \u003c= 1.2.5 - Cross-Site Request Forgery",
    "slug": "cf7-summary-and-print",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38724",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShMapper by Teplitsa \u003c= 1.5.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "shmapper-by-teplitsa",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24674",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Setup Default Featured Image \u003c= 1.2 - Missing Authorization",
    "slug": "setup-default-feature-image",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24642",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Change From Email \u003c= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-from-email",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38738",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pit Login Welcome \u003c= 1.1.5 - Reflected Cross-Site Scripting",
    "slug": "pit-login-welcome",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin \u003c= 3.1.1 - Remote Code Execution",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "[*, 3.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-8603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8603",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Getwid – Gutenberg Blocks \u003c= 1.8.3 - Improper Authorization via get_remote_templates REST endpoint",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1910",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Real Estate Manager \u003c= 2.8 - Authentication Bypass via Account Takeover",
    "slug": "wp-realestate-manager",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1515",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Post Type to Map Store \u003c= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cpt-to-map-store",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53769",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wordpress Auto Spinner \u003c= 3.25.0 - Reflected Cross-Site Scripting",
    "slug": "wp-auto-spinner",
    "type": "plugin",
    "affected_version": "* - 3.25.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46500",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit Form Pro \u003c= 2.6.4 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "bitformpro",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43249",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Related Posts for WordPress \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "related-posts-for-wp",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24180",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Back To Top \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "backtotop",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28940",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Conferencing with Zoom \u003c= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "video-conferencing-with-zoom-api",
    "type": "plugin",
    "affected_version": "* - 4.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4578",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Znajdź Pracę z Praca.pl \u003c= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "znajdz-prace-z-pracapl",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53773",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coupon Affiliates \u003c= 6.4.0 - Cross-Site Request Forgery",
    "slug": "woo-coupon-usage",
    "type": "plugin",
    "affected_version": "* - 6.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54022",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Plugin for AdSense \u003c 6.10 - Cross-Site Request Forgery",
    "slug": "easy-adsense-lite",
    "type": "plugin",
    "affected_version": "[*, 6.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-2702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2702",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP 404 Auto Redirect to Similar Post \u003c= 1.0.4 - Reflected Cross-Site Scripting via Debug Mode URI",
    "slug": "wp-404-auto-redirect-to-similar-post",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP \u003c= 6.2.4 - Cross-Site Request Forgery",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "* - 6.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48255",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Purity Of Soul \u003c= 1.9 - Reflected Cross-Site Scripting",
    "slug": "purity-of-soul",
    "type": "theme",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43348",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARforms \u003c= 6.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32706",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0692",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.28",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.25",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.19",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.16",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.4",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.21",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.20",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.3",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.31",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.12",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.7",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.31",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.29",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.28",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.15",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.11",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16781",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Smarty for WordPress \u003c= 3.1.35 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "smarty-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 3.1.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41661",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Progress Planner \u003c= 0.9.1 - Missing Authorization",
    "slug": "progress-planner",
    "type": "plugin",
    "affected_version": "* - 0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37411",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43210",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cache control by Cacholong \u003c= 5.4.1 - Cross-Site Request Forgery",
    "slug": "cache-control-by-cacholong",
    "type": "plugin",
    "affected_version": "* - 5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31763",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Header \u0026 Footer Builder \u003c= 1.6.26 - Authenticated (Author+) HTML Injection",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2619",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Hive Support \u003c= 1.2.5 - Missing Authorization",
    "slug": "hive-support",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32208",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPBakery Visual Composer WHMCS Elements \u003c= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "void-visual-whmcs-element",
    "type": "plugin",
    "affected_version": "* - 1.0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47659",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapPress Maps for WordPress \u003c= 2.85.4 - Authenticated (Contributor+) SQL Injection via get_maps",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.85.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.85.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-26015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26015",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Taskbuilder \u003c= 4.0.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "taskbuilder",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39569",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 5.22.2 - Authenticated Stored Cross Site Scripting",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 5.22.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.22.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24716",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Masteriyo - LMS \u003c= 1.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "learning-management-system",
    "type": "plugin",
    "affected_version": "* - 1.18.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54699",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.9 - Reflected Cross-Site Scripting",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9347",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.9 - Reflected Cross-Site Scripting",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "2.0.12",
    "from_version": "2.0.12",
    "from_inclusive": true,
    "to_version": "2.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9347",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.9 - Reflected Cross-Site Scripting",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "3.0.11",
    "from_version": "3.0.11",
    "from_inclusive": true,
    "to_version": "3.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9347",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin \u003c= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 14.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3953",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Event Manager, Events Calendar, Tickets, Registrations – Eventin \u003c= 4.0.26 - Unauthenticated Arbitrary File Read",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3419",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP MAPS – Easiest \u0026 Most Advanced WordPress Plugin for Google Maps \u003c= 4.2.3 - Cross-Site Request Forgery",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "[*, 4.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-25600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25600",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WOOF - Products Filter for WooCommerce \u003c= 1.2.6.2 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "[*, 1.2.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25085",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Plus Plugin for YouTube \u003c= 11.8.1 - Cross-Site Request Forgery",
    "slug": "youtube-embed-plus",
    "type": "plugin",
    "affected_version": "* - 11.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-1000224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000224",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Graceful Email Obfuscation \u003c= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "graceful-email-obfuscation",
    "type": "plugin",
    "affected_version": "* - 0.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25076",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Load More Anything \u003c= 3.3.3 - Missing Authorization to Plugin Settings Modification",
    "slug": "ajax-load-more-anything",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24704",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Posts per Cat [Unmaintained] \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "posts-per-cat",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4169",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mediamatic – Media Library Folders \u003c= 2.8.0 - SQL Injection",
    "slug": "mediamatic",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24848",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Social Login \u003c= 2.6.3 - Unauthenticated PHP Object Injection",
    "slug": "woo-social-login",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37502",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Team Circle Image Slider With Lightbox \u003c= 1.0.4 - Authenticated (Admin+) SQL Injection",
    "slug": "circle-image-slider-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-25223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25223",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Image Uploader \u003c= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletion",
    "slug": "wp-image-uploader",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13707",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Docpro \u003c= 2.0.1 - Unauthenticated Local File Inclusion",
    "slug": "docpro",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-28916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28916",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 4.0.8 - SQL Injection",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 4.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10887",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Product Catalog \u003c= 5.2.5 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "ultimate-product-catalogue",
    "type": "plugin",
    "affected_version": "* - 5.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2711",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Role Based Pricing for WooCommerce \u003c= 1.6.2 - Missing Authorization to PHAR Deserialization",
    "slug": "role-based-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3536",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kopa Nictitate Toolkit \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kopa-nictitate-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23965",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Showbiz Pro Responsive Teaser WordPress Plugin \u003c= 1.7.1 - Arbitrary File Upload",
    "slug": "showbizpro",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9499",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Image Uploader \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "wp-image-uploader",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13706",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bet WC 2018 Russia \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "bet-wc-2018-russia",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49637",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prime Mover \u003c= 1.9.2 - Sensitive Information Exposure via Directory Listing",
    "slug": "prime-mover",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6505",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Lewe Bootstrap Visuals \u003c= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcode-bootstrap-visuals",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51810",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.4.6 - Sensitive Information Exposure via purchased_products",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6214",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Page Restriction WordPress (WP) – Protect WP Pages/Post \u003c= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "page-and-post-restriction",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11297",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Auto Save Remote Images (Drafts) \u003c= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "auto-save-remote-images-drafts",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7843",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bello - Directory \u0026 Listing  - \u003c 1.6.0 - Cross-Site Scripting",
    "slug": "bello",
    "type": "theme",
    "affected_version": "[*, 1.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24319",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Plugin \u003c= 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "contact-form-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26962",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iThemes Security \u003c= 7.0.2 - Authenticated SQL Injection",
    "slug": "better-wp-security",
    "type": "plugin",
    "affected_version": "[*, 7.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-12636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12636",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Card Elements for WPBakery \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "card-elements-for-wpbakery",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58220",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP PHP Widget \u003c= 1.0.2 - Full Path Disclosure",
    "slug": "wp-php-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-0721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-0721",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Pz-LinkCard \u003c= 2.5.6 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "pz-linkcard",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8594",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8068",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Button Generator – easily Button Builder \u003c= 3.1.1 - Cross-Site Request Forgery",
    "slug": "button-generation",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24713",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Gallery \u003c= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gallery-videos",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9769",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FastSpring \u003c= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fastspring",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4595",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Live Chat Support \u003c 4.1.0 - JavaScript Code Injection",
    "slug": "wp-live-chat-support",
    "type": "plugin",
    "affected_version": "[*, 4.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-10386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10386",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Weaver Xtreme Theme \u003c= 5.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name",
    "slug": "weaver-xtreme",
    "type": "theme",
    "affected_version": "* - 5.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1403",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sharespine Woocommerce Connector \u003c= 4.7.55 - Missing Authorization",
    "slug": "sharespine-woocommerce-connector",
    "type": "plugin",
    "affected_version": "* - 4.7.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.55",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48128",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Qi Blocks \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Counter Block",
    "slug": "qi-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1625",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Diplomat Theme \u003c= 1.0.1 - Sensitive Information Disclosure",
    "slug": "diplomat",
    "type": "theme",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9481",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BigBlueButton \u003c= 3.0.0-beta.4 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "bigbluebutton",
    "type": "plugin",
    "affected_version": "[*, 3.0.0-beta.4]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0-beta.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7296",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yoast SEO \u003c= 11.5 - Authenticated Stored Cross Site Scripting",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "* - 11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-13478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13478",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mapplic Lite \u003c= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "mapplic-lite",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9117",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPJobBoard \u003c 5.11.1 - Cross-Site Request Forgery",
    "slug": "wpjobboard",
    "type": "plugin",
    "affected_version": "[*, 5.11.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-30965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30965",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JS Help Desk – The Ultimate Help Desk \u0026 Support Plugin \u003c= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13606",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "* - 4.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49745",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Maintenance \u0026 Countdown \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "smart-maintenance-countdown",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27332",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modal Popup Box – Popup Builder, Show Offers And News in Popup \u003c= 1.5.2 - Authenticated (Contributor+) PHP Object Injection in awl_modal_popup_box_shortcode",
    "slug": "modal-popup-box",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2008",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wallet for WooCommerce \u003c= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric Types",
    "slug": "woo-wallet",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7747",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Quran Phrases About Most People Shortcodes \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quran-phrases-about-most-people-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54334",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventin \u003c= 4.0.31 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49869",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Prezi Embedder \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "prezi-embedder",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26538",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Security Audit \u003c= 1.0.0 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "titan-labs-security-audit",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24901",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2561",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Online Ordering and Delivery Platform \u003c= 2.0.0 - Unauthenticated Local File Inclusion",
    "slug": "advanced-online-ordering-and-delivery-platform",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50497",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Site Offline \u003c= 1.4.9 - Maintenance Mode Bypass",
    "slug": "site-offline",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1580",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple elFinder Plugins \u003c= (Various Versions) - Directory Traversal to Arbitrary File Deletion",
    "slug": "file-manager-advanced",
    "type": "plugin",
    "affected_version": "* - 5.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0818",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Multiple elFinder Plugins \u003c= (Various Versions) - Directory Traversal to Arbitrary File Deletion",
    "slug": "filester",
    "type": "plugin",
    "affected_version": "* - 1.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0818",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Multiple elFinder Plugins \u003c= (Various Versions) - Directory Traversal to Arbitrary File Deletion",
    "slug": "wp-file-manager-pro",
    "type": "plugin",
    "affected_version": "* - 8.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0818",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "SearchWP Live Ajax Search \u003c= 1.6.1 - Sensitive Information Disclosure",
    "slug": "searchwp-live-ajax-search",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2535",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Facebook for WooCommerce \u003c= 1.9.12 - Cross-Site Request Forgery",
    "slug": "facebook-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15840",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Croma Music \u003c= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic_ajax",
    "slug": "croma-music",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12202",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. \u003c= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletion and Cross-Site Scripting",
    "slug": "host-webfonts-local",
    "type": "plugin",
    "affected_version": "* - 5.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6600",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
  },
  {
    "title": "WordPress prettyPhoto \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter",
    "slug": "prettyphoto",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5162",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Telegram Widget and Join Link \u003c= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wptelegram-widget",
    "type": "plugin",
    "affected_version": "* - 2.1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43309",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BWD Elementor Addons \u003c= 4.3.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bwd-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 4.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32189",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPS Hide Login \u003c= 1.5.2.2 - Login Page Disclosure via Referer Header",
    "slug": "wps-hide-login",
    "type": "plugin",
    "affected_version": "* - 1.5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15826",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WebinarIgnition \u003c= 3.05.0 - Unauthenticated SQL Injection",
    "slug": "webinar-ignition",
    "type": "plugin",
    "affected_version": "* - 3.05.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.05.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51423",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Avatar \u003c= 0.1.4 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "avatar",
    "type": "plugin",
    "affected_version": "* - 0.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3520",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP Directory Kit \u003c= 1.3.6 - Authenticated (Admin+) HTML Injection",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-37253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37253",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hash Form - Drag \u0026 Drop Form Builder \u003c= 1.1.9 - Unauthenticated Limited File Upload",
    "slug": "hash-form",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9417",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon Page – Responsive Coming Soon \u0026 Maintenance Mode \u003c= 1.1.18 - Cross-Site Scripting via button_text_link parameter",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5663",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Passwords Manager \u003c= 1.4.8 - Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key",
    "slug": "passwords-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12614",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Startklar Elementor Addons \u003c= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletion",
    "slug": "startklar-elmentor-forms-extwidgets",
    "type": "plugin",
    "affected_version": "* - 1.7.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5153",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
  },
  {
    "title": "Custom Field For WP Job Manager \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "custom-field-for-wp-job-manager",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22294",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC \u003c= 1.1.15 - Arbitrary File Upload",
    "slug": "easync-booking",
    "type": "plugin",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1952",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SpiderCatalog \u003c= 1.7.3 - Authenticated (Admin+) SQL Injection",
    "slug": "catalog",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24625",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPBakery Visual Composer \u003c= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1842",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Quota \u003c= 1.0.8 - Reflected Cross-Site Scripting",
    "slug": "my-quota",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13880",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recall Products \u003c= 0.8 - Cross-Site Scripting",
    "slug": "recall-products",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25380",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Todo Custom Field \u003c= 3.0.4 - Reflected Cross-Site Scripting",
    "slug": "todo-custom-field",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49642",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial Slider Shortcode \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "testimonial-slider-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51925",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "English WordPress Admin \u003c= 1.5.1.1 - Unauthenticated Open Redirect",
    "slug": "english-wp-admin",
    "type": "plugin",
    "affected_version": "* - 1.5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25111",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MySliderGallery \u003c= 1.2.1 - Remote File Inclusion",
    "slug": "mygallery",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2007-2426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-2426",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cookie Warning \u003c= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cookie-warning",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49428",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Hide Login \u003c= 1.0.8 - Cross-Site Request Forgery",
    "slug": "easy-hide-login",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31075",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy!Appointments \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easyappointments",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0698",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdSense Privacy Policy \u003c= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "adsense-privacy-policy",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30578",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Uploads Addon for WooCommerce \u003c= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "woo-addon-uploads",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13622",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Bard \u003c= 2.210 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "bard",
    "type": "theme",
    "affected_version": "* - 2.210",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.210",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37490",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Chatbot Support AI \u003c= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "chatbot-support-ai",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6722",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Insurance – WordPress Insurance Service Plugin \u003c= 2.1.3 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation",
    "slug": "wp-insurance",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0501",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Auction Plugin \u003c= 3.7 - Unauthenticated SQL Injection",
    "slug": "wp-auctions",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-51615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51615",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Image Shadow \u003c= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "image-shadow",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24765",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "LTL Freight Quotes – Unishippers Edition \u003c= 2.5.8 - Missing Authorization",
    "slug": "ltl-freight-quotes-unishippers-edition",
    "type": "plugin",
    "affected_version": "* - 2.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22289",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Dashboard \u0026 Login Page \u003c 6.9.5 - Admin+ Stored Cross-Site Scripting",
    "slug": "ag-custom-admin",
    "type": "plugin",
    "affected_version": "* - 6.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24944",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Make Email Customizer for WooCommerce \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "make-email-customizer-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32511",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Connect Contact Form 7, WooCommerce To Google Sheets \u0026 Other Platforms – Advanced Form Integration \u003c= 1.62.0 - Authenticated (Admin+) Cross Site Scripting",
    "slug": "advanced-form-integration",
    "type": "plugin",
    "affected_version": "* - 1.62.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.62.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47173",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 5.8.11 - Cross-Site Scripting",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "[*, 5.8.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36172",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon Page \u0026 Maintenance Mode \u003c= 1.8.1 - Stored Cross Site Scripting",
    "slug": "responsive-coming-soon",
    "type": "plugin",
    "affected_version": "[*, 1.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-25140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25140",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.4 - Authenticated (Author+) PHAR Deserialization",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1381",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Ship to Multiple Addresses \u003c= 3.8.5 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-shipping-multiple-addresses",
    "type": "plugin",
    "affected_version": "* - 3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37873",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Cleanup \u003c= 1.9.2 - Cross-Site Request Forgery",
    "slug": "image-cleanup",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53272",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Duplicate Title Validate \u003c= 1.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "duplicate-title-validate",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49623",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Japanized For WooCommerce \u003c= 2.6.4 - Missing Authorization",
    "slug": "woocommerce-for-japan",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47698",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Paytm Payment Donation \u003c= 2.2.0 - Reflected Cross-Site Scripting",
    "slug": "paytm-donation",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28535",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Elementor Addons \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26912",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.27",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.10",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.26",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.23",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.13",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.9",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.18",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.17",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.12",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.5",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.29",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.29",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.29",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.29",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.26",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.19",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.1",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.2",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-16218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16218",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Mega Menu \u003c= 2.0.6 - Arbitrary File Creation",
    "slug": "quadmenu",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-4443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4443",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fable Extra \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fable-extra",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46447",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Related Products \u003c= 2.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ai-related-products",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60160",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Affiliate Links \u003c= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Settings",
    "slug": "easy-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0375",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Product Input Fields for WooCommerce \u003c= 1.2.6 - Missing Authorization",
    "slug": "product-input-fields-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36696",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "All in One SEO Pack  \u003c= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "* - 4.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0586",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Download Manager \u003c 2.9.51 - Open Redirect",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "[*, 2.9.51)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.51",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-2217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2217",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by WPForms (Free and Premium) \u003c= 1.8.1.2 - Reflected Cross-Site Scripting",
    "slug": "wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 1.8.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30500",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by WPForms (Free and Premium) \u003c= 1.8.1.2 - Reflected Cross-Site Scripting",
    "slug": "wpforms",
    "type": "plugin",
    "affected_version": "* - 1.8.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30500",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Dynamic Text Extension \u003c= 5.0.1 - Cross-Site Request Forgery",
    "slug": "contact-form-7-dynamic-text-extension",
    "type": "plugin",
    "affected_version": "* - 5.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56218",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rank Math SEO \u003c= 1.0.95 - Server-Side Request Forgery",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.95",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.95",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36376",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Plethora Plugins Tabs + Accordions \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "plethora-tabs-accordions",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24709",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LWSCache \u003c= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin Function",
    "slug": "lwscache",
    "type": "plugin",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8147",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Restrict \u003c= 2.2.4 - Reflected Cross-Site Scripting",
    "slug": "restricted-content",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41861",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Scalable Vector Graphics (SVG) \u003c= 3.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "scalable-vector-graphics-svg",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7085",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flexible Wishlist for WooCommerce \u003c= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter",
    "slug": "flexible-wishlist",
    "type": "plugin",
    "affected_version": "* - 1.2.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13696",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Tribal \u003c= 1.3.3 - Unauthenticated Sensitive Information Exposure",
    "slug": "the-tech-tribe",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60140",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Solace Extra \u003c= 1.3.2 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "solace-extra",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58203",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Popup \u003c= 1.48.0 - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-popup",
    "type": "plugin",
    "affected_version": "* - 1.48.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.48.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54675",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CM Download Manager \u003c 2.9.0 - Cross-Site Request Forgery via delHeader",
    "slug": "cm-download-manager",
    "type": "plugin",
    "affected_version": "[*, 2.9.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-1232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1232",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Link Whisper Free \u003c= 0.6.3 - Missing Authorization via init()",
    "slug": "link-whisper",
    "type": "plugin",
    "affected_version": "* - 0.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32506",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Real3D Flipbook \u003c= 1.0.0 - File Upload to User Controlled Location",
    "slug": "real3d-flipbook",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10966",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 5.12.2 - File Upload",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 5.12.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2594",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Code Highlight.js \u003c= 0.6.2 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "wp-code-highlightjs",
    "type": "plugin",
    "affected_version": "[*, 0.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-12934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12934",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Generate Post Thumbnails \u003c= 0.8 - Cross-Site Request Forgery",
    "slug": "generate-post-thumbnails",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30585",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Widget \u003c= 4.4.10 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "image-widget",
    "type": "plugin",
    "affected_version": "* - 4.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10939",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Herd Effects – fake notifications and social proof plugin \u003c= 5.2.6 - Cross-Site Request Forgery",
    "slug": "mwp-herd-effect",
    "type": "plugin",
    "affected_version": "* - 5.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3478",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Glance That \u003c= 4.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "glance-that",
    "type": "plugin",
    "affected_version": "* - 4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26570",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Wp Brand \u003c= 1.1.3 - Cross-Site Request Forgery",
    "slug": "my-wp-brand",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53269",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10498",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Metadata SEO \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "metadata-seo",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22516",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amazonify \u003c= 0.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "amazonify",
    "type": "plugin",
    "affected_version": "* - 0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5819",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7548",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zigaform – Form Builder Lite \u003c= 7.4.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "zigaform-form-builder-lite",
    "type": "plugin",
    "affected_version": "* - 7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26989",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 1.7.12 - Missing Authorization",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 1.7.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-18596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18596",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "List Child Pages Shortcode \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "list-child-pages-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58021",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podcast Channels \u003c= 0.20 - Cross-Site Scripting",
    "slug": "podcast-channels",
    "type": "plugin",
    "affected_version": "[*, 0.21)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.21",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4544",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clockwork SMS Notfications \u003c= 3.0.4 - Authenticated(Administrator+) SQL Injection",
    "slug": "mediaburst-email-to-sms",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50843",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Font Uploader \u003c= 1.3 - Arbitrary File Upload",
    "slug": "font-uploader",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-3814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3814",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JobBoard Job listing \u003c= 1.2.6 - Unauthenticated Arbitrary File Upload",
    "slug": "job-board-light",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43243",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Meta Tags \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-meta-tags",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60142",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Planner \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "content-planner",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23631",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3D FlipBook \u003c= 1.15.4 - Authenticated (Author+) Stored Cross-Site Scritping via Bookmark URL",
    "slug": "interactive-3d-flipbook-powered-physics-engine",
    "type": "plugin",
    "affected_version": "* - 1.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3883",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 4.10.7 - Unauthorized Account Access and Privilege Escalation",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.10.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-3277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3277",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Business Directory Plugin \u003c= 5.11.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "business-directory-plugin",
    "type": "plugin",
    "affected_version": "* - 5.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24250",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.5.3 - Reflected Cross-Site Scripting via add_internal_scripts_to_head",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "[*, 4.2.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5558",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uber Menu \u003c= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes",
    "slug": "ubermenu",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4710",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Tracking \u003c= 1.6 - Stored Cross-Site Scripting",
    "slug": "simple-theme-options",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0700",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPDBSpringClean \u003c= 1.6 - Reflected Cross-Site Scripting",
    "slug": "wpdbspringclean",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47510",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZD YouTube FLV Player \u003c= 1.2.6 - Server-Side Request Forgery",
    "slug": "zd-youtube-flv-player",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2663",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Vikinger \u003c= 1.9.32 - Authenticated (Subscriber+) Arbitrary File Deletion via vikinger_delete_activity_media_ajax Function",
    "slug": "vikinger",
    "type": "theme",
    "affected_version": "* - 1.9.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.32",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4946",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Activity Plus Reloaded for BuddyPress \u003c= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery",
    "slug": "bp-activity-plus-reloaded",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11913",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "HD Quiz – Save Results Light \u003c= 0.5 - Missing Authorization",
    "slug": "hd-quiz-save-results-light",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49689",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GD Rating System \u003c= 2.3 - Directory Traversal",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-5291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5291",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Upload Files \u003c= 84.3 - Unauthenticated Arbitrary File Upload",
    "slug": "woocommerce-upload-files",
    "type": "plugin",
    "affected_version": "* - 84.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "84.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10820",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 7.5 - Missing Authorization",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22304",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ExactMetrics \u003c= 7.12.0 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "google-analytics-dashboard-for-wp",
    "type": "plugin",
    "affected_version": "* - 7.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0082",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyStyle Custom Product Designer \u003c= 3.21.1 - Unauthenticated SQL Injection",
    "slug": "mystyle-custom-product-designer",
    "type": "plugin",
    "affected_version": "* - 3.21.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.21.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48281",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Smart Slider 3 \u003c= 3.5.1.9 - PHP Object Injection",
    "slug": "smart-slider-3",
    "type": "plugin",
    "affected_version": "* - 3.5.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3357",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ask Me Anything (Anonymously) \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ask-me-anything-anonymously",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12512",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tantyyellow \u003c= 1.0.0.5 - Reflected Cross-Site Scripting",
    "slug": "tantyyellow",
    "type": "theme",
    "affected_version": "* - 1.0.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23995",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form With Shortcode \u003c= 4.2.5 - Reflected Cross-Site Scripting",
    "slug": "contact-form-with-shortcode",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24564",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bbPress Voting \u003c= 2.1.11.0  - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bbp-voting",
    "type": "plugin",
    "affected_version": "[*, 2.1.11.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.11.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-24403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24403",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Five Star Restaurant Reservations \u003c= 2.6.7 - Reflected Cross-Site Scripting",
    "slug": "restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34017",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modern Events Calendar \u003c= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "modern-events-calendar",
    "type": "plugin",
    "affected_version": "* - 7.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5441",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modern Events Calendar \u003c= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 7.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5441",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OnePress Social Locker \u003c= 5.6.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "social-locker",
    "type": "plugin",
    "affected_version": "* - 5.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1608",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update",
    "slug": "wpc-admin-columns",
    "type": "plugin",
    "affected_version": "2.0.6 - 2.1.0",
    "from_version": "2.0.6",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3418",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wishlist for WooCommerce \u003c= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wt-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24657",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Original Media Path \u003c= 2.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "wp-original-media-path",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23674",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Just Variables \u003c= 1.2.3 - Cross-Site Request Forgery",
    "slug": "just-wp-variables",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27336",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import YouTube videos as WP Posts \u003c= 2.1 - Missing Authorization",
    "slug": "import-youtube-videos-as-wp-post",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52802",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PPWP – WordPress Password Protect Page \u003c= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "password-protect-page",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4626",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WS Contact Form \u003c= 1.3.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ws-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37537",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Memory Usage \u003c= 2.45 - Missing Authorization to Arbitrary Plugin Installation",
    "slug": "wp-memory",
    "type": "plugin",
    "affected_version": "* - 2.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3882",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Compare Ninja \u003c= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "compare-ninja-comparison-tables",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23909",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ADFO – Custom data in admin dashboard \u003c= 1.9.0 - Cross-Site Request Forgery",
    "slug": "admin-form",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4103",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_html_tag",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24204",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetSmartFilters \u003c= 3.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-smart-filters",
    "type": "plugin",
    "affected_version": "* - 3.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54009",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Invite Anyone \u003c= 1.3.14 - Change of Email Invitation Content",
    "slug": "invite-anyone",
    "type": "plugin",
    "affected_version": "[*, 1.3.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-6955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6955",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2785",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tweaker5 \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode",
    "slug": "tweaker5",
    "type": "theme",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5870",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qyrr – simply and modern QR-Code creation \u003c= 2.0.7 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "qyrr-code",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10000",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Checkout Manager \u003c= 7.3.0 - Missing Authorization",
    "slug": "woocommerce-checkout-manager",
    "type": "plugin",
    "affected_version": "* - 7.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47681",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_mode",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6882",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "First Comment Redirect \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "first-comment-redirect",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23852",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP 2FA \u003c= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending",
    "slug": "wp-2fa",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6506",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Live Chat Support \u003c= 8.0.17 - Cross-Site Scripting",
    "slug": "wp-live-chat-support",
    "type": "plugin",
    "affected_version": "[*, 8.0.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-9913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9913",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wholesale Suite \u003c= 2.1.12 - Missing Authorization",
    "slug": "woocommerce-wholesale-prices",
    "type": "plugin",
    "affected_version": "* - 2.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38745",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LIVE TV \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "live-tv",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23608",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ValidateCertify \u003c= 1.6.1 - Cross-Site Request Forgery",
    "slug": "validar-certificados-de-cursos",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30811",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-DownloadManager \u003c= 1.68.10 - Authenticated (Administrator+) Arbitrary File Deletion",
    "slug": "wp-downloadmanager",
    "type": "plugin",
    "affected_version": "* - 1.68.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.68.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4799",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MStore API – Create Native Android \u0026 iOS Apps On The Cloud \u003c= 4.14.7 - Authentication Bypass",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.14.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6328",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "File Manager Plugin For Wordpress \u003c= 7.5 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "file-manager-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53260",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social2Blog \u003c= 0.2.990 - Reflected Cross-Site Scripting",
    "slug": "social2blog",
    "type": "plugin",
    "affected_version": "* - 0.2.990",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.990",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23461",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Spam Remover \u003c= 1.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "user-spam-remover",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31298",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Super Block Slider \u003c= 2.7.9 - Missing Authorization",
    "slug": "super-block-slider",
    "type": "plugin",
    "affected_version": "* - 2.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24682",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Grand Restaurant WordPress \u003c= 7.0 - Unauthenticated PHP Object Injection",
    "slug": "grandrestaurant",
    "type": "theme",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39348",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Qubely \u003c= 1.8.14 - Missing Authorization",
    "slug": "qubely",
    "type": "plugin",
    "affected_version": "* - 1.8.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58663",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.27",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.19",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.27",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.18",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.14",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.10",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.3",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.30",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.20",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.15",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.6",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.24",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.2",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.11",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.30",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.28",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17671",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Event Manager, Events Calendar, Tickets, Registrations – Eventin \u003c= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1766",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0448",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WoodMart \u003c= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 8.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12333",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Google Places Reviews \u003c 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "google-places-reviews",
    "type": "plugin",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1772",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flickr set slideshows \u003c= 0.9 - Authenticated (Contributor+) SQL Injection",
    "slug": "flickr-set-slideshows",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30590",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Voting Contest \u003c= 5.8 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-voting-contest",
    "type": "plugin",
    "affected_version": "* - 5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50017",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP GPX Map \u003c= 1.7.05 - Missing Authorization",
    "slug": "wp-gpx-maps",
    "type": "plugin",
    "affected_version": "* - 1.7.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44234",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flynax Bridge \u003c= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover",
    "slug": "flynax-bridge",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3604",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Better Anchor Links \u003c= 1.7.5 - Cross-Site Request Forgery via admin/options.php",
    "slug": "better-anchor-links",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22287",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Process Steps Template Designer \u003c= 1.2.1 - Cross-Site Request Forgery Bypass",
    "slug": "process-steps-template-designer",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4413",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 2.11.5 - Cross-Site Request Forgery",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "[*, 2.11.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0707",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Schedule Posts \u003c= 2.1.8 - Reflected Cross-Site Scripting",
    "slug": "advanced-schedule-posts",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0249",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Masterstudy Elementor Widgets \u003c= 1.2.2 - Missing Authorization",
    "slug": "masterstudy-elementor-widgets",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37269",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Universal Video Player - Addon for WPBakery Page Builder \u003c= 3.2.1 - Reflected Cross-Site Scripting",
    "slug": "lbg-universal-video-player-addon-visual-composer",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Availability Calendar \u003c= 0.2.4 - Cross-Site Request Forgery",
    "slug": "availability",
    "type": "plugin",
    "affected_version": "* - 0.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46528",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Append Content \u003c= 2.1.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "append-content",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31780",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Easy Gallery \u003c= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter",
    "slug": "wp-easy-gallery",
    "type": "plugin",
    "affected_version": "* - 4.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9018",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue \u003c= 3.1.24 - Reflected Cross-Site Scripting",
    "slug": "mailin",
    "type": "plugin",
    "affected_version": "[*, 3.1.25)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.25",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24923",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "weForms \u003c= 1.6.20 - Missing Authorization",
    "slug": "weforms",
    "type": "plugin",
    "affected_version": "* - 1.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30512",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Responsive Thumbnail Slider  \u003c 1.0.1 -  Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-responsive-thumbnail-slider",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-10144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10144",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 2.8.4 - Denial of Service",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-3622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-3622",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Indutri \u003c 1.3.0 - Unauthenticated Local File Inclusion",
    "slug": "indutri",
    "type": "theme",
    "affected_version": "[*, 1.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-58214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58214",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AMP for WP – Accelerated Mobile Pages \u003c= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "accelerated-mobile-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.96.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.96.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6896",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ColibriWP Theme framework \u003c= (Various Versions) - Missing Authorization",
    "slug": "colibri-wp",
    "type": "theme",
    "affected_version": "* - 1.0.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.94",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ColibriWP Theme framework \u003c= (Various Versions) - Missing Authorization",
    "slug": "elevate-wp",
    "type": "theme",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ColibriWP Theme framework \u003c= (Various Versions) - Missing Authorization",
    "slug": "calliope",
    "type": "theme",
    "affected_version": "* - 1.0.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ColibriWP Theme framework \u003c= (Various Versions) - Missing Authorization",
    "slug": "teluro",
    "type": "theme",
    "affected_version": "* - 1.0.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ColibriWP Theme framework \u003c= (Various Versions) - Missing Authorization",
    "slug": "althea-wp",
    "type": "theme",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ColibriWP Theme framework \u003c= (Various Versions) - Missing Authorization",
    "slug": "hugo-wp",
    "type": "theme",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ColibriWP Theme framework \u003c= (Various Versions) - Missing Authorization",
    "slug": "pathway",
    "type": "theme",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ColibriWP Theme framework \u003c= (Various Versions) - Missing Authorization",
    "slug": "brite",
    "type": "theme",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ColibriWP Theme framework \u003c= (Various Versions) - Missing Authorization",
    "slug": "vertice",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CraftXtore \u003c= 1.7 - Unauthenticated Local File Inclusion",
    "slug": "bw-craftxtore",
    "type": "theme",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-24770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24770",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pocket News Generator \u003c= 0.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pocket-news-generator",
    "type": "plugin",
    "affected_version": "* - 0.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2963",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goza - Nonprofit Charity WordPress Theme \u003c= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation",
    "slug": "goza-theme",
    "type": "theme",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-10690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10690",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "zM Ajax Login \u0026 Register \u003c= 1.0.9 - Cross-Site Scripting",
    "slug": "zm-ajax-login-register",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-4465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4465",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ultimate Email Marketer \u003c= 1.2.0 - Cross-Site Scripting",
    "slug": "wp-ultimate-email-marketer",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-3263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3263",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hide Post \u003c= 2.0.10 - Cross-Site Request Forgery via save_bulk_edit_data",
    "slug": "wp-hide-post",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34378",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery \u003c 2.0.77.3 - Arbitrary File Upload",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "[*, 2.0.77.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.77.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-1785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1785",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CodeBard's Patron Button and Widgets for Patreon \u003c= 2.1.8 - Reflected Cross-Site Scripting via 'site_account'",
    "slug": "patron-button-and-widgets-by-codebard",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30491",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Slider For Elementor \u003c= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ht-slider-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53199",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WOOCS \u003c= 1.3.7.4 - Reflected Cross-Site Scripting via AJAX action",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.3.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0234",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Namaste! LMS \u003c= 2.6.1.1 - Reflected Cross-Site Scripting",
    "slug": "namaste-lms",
    "type": "plugin",
    "affected_version": "* - 2.6.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4602",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stepbyteservice-openstreetmap",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6572",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eCards \u003c= 1.3.904 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-ecards-invites",
    "type": "plugin",
    "affected_version": "* - 1.3.904",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.904",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11903",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Page/Post Redirect Plugin \u003c 5.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "quick-pagepost-redirect-plugin",
    "type": "plugin",
    "affected_version": "[*, 5.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-2598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2598",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Recent Posts Slider Responsive \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "recent-posts-slider-responsive",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28966",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Read more By Adam \u003c= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion",
    "slug": "read-more",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9187",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Silvasoft boekhouden \u003c= 3.0.5 - Reflected Cross-Site Scripting",
    "slug": "silvasoft-boekhouden",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32504",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BP Disable Activation Reloaded \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "bp-disable-activation-reloaded",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57983",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5555",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy PayPal Shopping Cart \u003c= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47239",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CWD – Stealth Links \u003c= 1.3 - Unauthenticated SQL Injection",
    "slug": "cwd-stealth-links",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22655",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Magic Slider \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magic-slider",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51896",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.27",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.24",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.8",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.25",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.17",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.15",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.11",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.27",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.24",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.21",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.16",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.12",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.7",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20151",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "User Shortcodes Plus \u003c= 2.0.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via user_meta Shortcode",
    "slug": "user-shortcodes-plus",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6969",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Forminator \u003c= 1.15.2 - Reflected Cross-Site Scripting",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.15.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31857",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Giveaways and Contests by RafflePress \u003c= 1.12.4 - Missing Authorization",
    "slug": "rafflepress",
    "type": "plugin",
    "affected_version": "* - 1.12.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4745",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multilevel Referral Affiliate Plugin for WooCommerce \u003c= 2.27 - Authenticated (Subscriber+) SQL Injection",
    "slug": "multilevel-referral-plugin-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13750",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Float Block \u003c= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "float-block",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11645",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.0.0 - Unauthenticated PHP Object Injection",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-37390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37390",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UNIVERSAM \u003c 8.59 - Reflected Cross-Site Scripting",
    "slug": "universam-demo",
    "type": "plugin",
    "affected_version": "[*, 8.59)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.59",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-54327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54327",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Skysa App Bar Integration \u003c 1.04 - Cross-Site Scripting",
    "slug": "skysa-official",
    "type": "plugin",
    "affected_version": "* - 1.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.03",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2011-5179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5179",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Insert Pages \u003c 3.2.4 - Authenticated Directory Traversal",
    "slug": "insert-pages",
    "type": "plugin",
    "affected_version": "[*, 3.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18586",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widget",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2028",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sina Extension for Elementor \u003c= 3.5.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-34384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34384",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Fusion Lite – Marketing Automation and CRM Integration for WordPress \u003c= 3.42.10 - Information Exposure",
    "slug": "wp-fusion-lite",
    "type": "plugin",
    "affected_version": "* - 3.42.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.42.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32796",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Booster (\u003c= 5.6.6), Booster Plus (\u003c= 5.6.5), and Booster Elite (\u003c= 1.1.7) for WooCommerce - Cross-Site Request Forgery leading to Arbitrary Custom Role Creation/Deletion",
    "slug": "booster-plus-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4016",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Booster (\u003c= 5.6.6), Booster Plus (\u003c= 5.6.5), and Booster Elite (\u003c= 1.1.7) for WooCommerce - Cross-Site Request Forgery leading to Arbitrary Custom Role Creation/Deletion",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 5.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4016",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Booster (\u003c= 5.6.6), Booster Plus (\u003c= 5.6.5), and Booster Elite (\u003c= 1.1.7) for WooCommerce - Cross-Site Request Forgery leading to Arbitrary Custom Role Creation/Deletion",
    "slug": "booster-elite-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4016",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "DesignO \u003c= 2.2.0 - Cross-Site Request Forgery",
    "slug": "designo",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31600",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PeepSo Core: Groups \u003c= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Description",
    "slug": "peepso-groups",
    "type": "plugin",
    "affected_version": "* - 6.4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9017",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gmedia Photo Gallery \u003c= 1.6.4 - Open Proxy",
    "slug": "grand-media",
    "type": "plugin",
    "affected_version": "[*, 1.6.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-4339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4339",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "Magic Post Thumbnail \u003c= 5.2.9 - Reflected Cross-Site Scripting",
    "slug": "magic-post-thumbnail",
    "type": "plugin",
    "affected_version": "* - 5.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43921",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "10WebAnalytics \u003c= 1.2.8 - Cross-Site Request Forgery Bypass",
    "slug": "wd-google-analytics",
    "type": "plugin",
    "affected_version": "[*, 1.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36756",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cost Calculator Builder \u003c= 3.2.28 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "* - 3.2.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8379",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Smart Post Show \u003c= 3.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Pagination Color",
    "slug": "post-carousel",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8187",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Related Posts \u003c= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Private Post Search and Relation Updates",
    "slug": "custom-related-posts",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12825",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Page-list \u003c= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "page-list",
    "type": "plugin",
    "affected_version": "* - 5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47382",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wProject \u003c 5.8.0 - Missing Authorization to Unauthenticated Content Modification and Deletion",
    "slug": "wproject",
    "type": "theme",
    "affected_version": "[*, 5.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-39350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39350",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spare \u003c= 1.7 - Reflected Cross-Site Scripting",
    "slug": "spare",
    "type": "theme",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31638",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management System – WPSchoolPress \u003c= 2.2.16 - Missing Authorization to Arbitrary User Deletion",
    "slug": "wpschoolpress",
    "type": "plugin",
    "affected_version": "* - 2.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1668",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MAS Elementor \u003c= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "mas-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12328",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Doppler Forms \u003c= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "doppler-form",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32165",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XStore \u003c= 9.3.8 - Missing Authorization",
    "slug": "xstore",
    "type": "theme",
    "affected_version": "* - 9.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33563",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rank Math SEO \u003c= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.235",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.235",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13229",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Maintenance Switch \u003c= 1.6.2 - Reflected Cross-Site Scripting",
    "slug": "maintenance-switch",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47590",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wp-pano \u003c= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-pano",
    "type": "plugin",
    "affected_version": "* - 1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22780",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import external attachments \u003c= 1.5.12 - Cross-Site Request Forgery",
    "slug": "import-external-attachments",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53268",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Attachments \u003c= 5.0.12 - Reflected Cross-Site Scripting via attachment_id Parameter",
    "slug": "wp-attachments",
    "type": "plugin",
    "affected_version": "* - 5.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5082",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Featured Image (Auto Post Thumbnail) \u003c= 3.9.15 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "auto-post-thumbnail",
    "type": "plugin",
    "affected_version": "* - 3.9.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0477",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FormCraft \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "formcraft-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-5920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5920",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-GeSHi-Highlight \u003c= 1.4.3 Authenticated (Author+) ReDoS",
    "slug": "wp-geshi-highlight",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13896",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Scroll Top – WordPress Scroll to Top \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "scroll-to-top-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23651",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP BlipBot \u003c= 3.0.9 - Cross-Site Scripting",
    "slug": "wp-blipbot",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4580",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin \u003c 1.5.63 - Cross-Site Scripting via p_name parameter",
    "slug": "users-ultra",
    "type": "plugin",
    "affected_version": "[*, 1.5.63)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.63",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9392",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Widget",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5347",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widgets Controller \u003c= 1.1 - Unauthenticated Cross-Site Scripting",
    "slug": "widgets-controller",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25926",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One \u003c= 2.2.6 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "ai-auto-tool",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58829",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.2.3 - Restriction Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-2146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-2146",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Server Health Stats \u003c= 1.6.10 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-server-stats",
    "type": "plugin",
    "affected_version": "* - 1.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2887",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Whydonate – FREE Donate button \u003c= 3.12.14 - Cross-Site Request Forgery",
    "slug": "wp-whydonate",
    "type": "plugin",
    "affected_version": "* - 3.12.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29238",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPC Smart Wishlist for WooCommerce \u003c= 2.9.8 - Reflected Cross-Site Scripting",
    "slug": "woo-smart-wishlist",
    "type": "plugin",
    "affected_version": "[*, 2.9.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1465",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recent Posts Widget Extended \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via rpwe Shortcode",
    "slug": "recent-posts-widget-extended",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6757",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Parallax Image \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter",
    "slug": "parallax-image",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11224",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Civi Framework \u003c= 2.1.6.3 - Cross-Site Request Forgery",
    "slug": "civi-framework",
    "type": "plugin",
    "affected_version": "* - 2.1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49511",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "File Manager And File Manager Pro (Multiple Versions) - Directory Traversal",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "* - 7.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6825",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "File Manager And File Manager Pro (Multiple Versions) - Directory Traversal",
    "slug": "wp-file-manager-pro",
    "type": "plugin",
    "affected_version": "* - 8.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6825",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Sensei LMS \u003c= 4.4.3 - Information Disclosure",
    "slug": "sensei-lms",
    "type": "plugin",
    "affected_version": "* - 4.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2034",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce - Social Login \u003c= 2.6.2 - Unauthenticated PHP Object Injection",
    "slug": "woo-social-login",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5871",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sell Downloads \u003c= 1.0.1 - Arbitrary File Read",
    "slug": "sell-downloads",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9511",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.2.8 - Cross-Site Request Forgery via logout()",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47870",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Custom Widget area \u003c= 1.2.5 - Missing Authorization",
    "slug": "wp-custom-widget-area",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45045",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Customize Login Page \u003c= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-customize-login-page",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46477",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Slider Feed \u003c= 2.2.2 - Missing Authorization",
    "slug": "instagram-slider-widget",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43215",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Guppy \u003c 1.3 - Information Disclosure",
    "slug": "wp-guppy",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24997",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Essential Doo Components for Visual Composer \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "animated-icon-banner-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49424",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKU Generator for WooCommerce \u003c= 1.6.2 - Reflected Cross-Site Scripting",
    "slug": "sku-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30917",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload for Contact Form 7 \u003c= 1.3.8.7 - Unauthenticated Arbitrary File Deletion",
    "slug": "drag-and-drop-multiple-file-upload-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.3.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2328",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Patreon WordPress \u003c= 1.8.7 - Cross-Site Request Forgery",
    "slug": "patreon-connect",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41129",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SEO Tools \u003c= 4.0.7 - Reflected Cross-Site Scripting",
    "slug": "seo-automatic-seo-tools",
    "type": "plugin",
    "affected_version": "* - 4.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30984",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.87 - Cross-Site Request Forgery via add_to_compare",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0514",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Map My Locations \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "map-my-locations",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7660",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Transposh WordPress Translation \u003c= 1.0.7 - Reflected Cross-Site Scripting via tp_tp",
    "slug": "transposh-translation-filter-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24910",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Custom Author URL \u003c= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-custom-author-url",
    "type": "plugin",
    "affected_version": "[*, 1.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-1614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1614",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Generic Elements \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "generic-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9080",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShortCodes UI \u003c= 1.9.8 - Cross-Site Request Forgery",
    "slug": "shortcodes-ui",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44994",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HTML Forms \u003c= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "html-forms",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46236",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Map Shortcode \u003c= 3.1.2 - Cross-Site Request Forgery to Plugin Setting Update",
    "slug": "google-map-shortcode",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38396",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WDesignKit – Elementor \u0026 Gutenberg Starter Templates, Patterns, Cloud Workspace \u0026 Widget Builder \u003c= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function",
    "slug": "wdesignkit",
    "type": "plugin",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9029",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Team Builder For WPBakery Page Builder(Formerly Visual Composer) \u003c= 1.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "team-builder-for-wpbakery-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13592",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Compute Links \u003c= 1.2.1 - Unauthenticated Remote File Inclusion",
    "slug": "compute-links",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43261",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Unique Article Header Image \u003c= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "wp-unique-article-header-image",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9400",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form \u0026 SMTP Plugin for WordPress by PirateForms \u003c= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pirate-forms",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11273",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "add2fav \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "add2fav",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37404",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy 301 Redirects \u003c= 1.33 - Cross-Site Request Forgery",
    "slug": "odihost-easy-redirect-301",
    "type": "plugin",
    "affected_version": "* - 1.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30557",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LeadQuizzes \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "leadquizzes",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31738",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles \u0026 User Role Editor \u003c= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.13.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2314",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carousel Slider \u003c= 1.10.2 - Cross-Site Request Forgery",
    "slug": "carousel-slider",
    "type": "plugin",
    "affected_version": "* - 1.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45269",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unsafe Mimetypes \u003c= 0.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "unsafe-mimetypes",
    "type": "plugin",
    "affected_version": "* - 0.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46507",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CookieHint WP \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cookiehint-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31608",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez CRM \u003c= 1.4.7 - Missing Authorization",
    "slug": "houzez-crm",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49402",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Registration \u0026 Membership \u003c= 4.3.0 - Authenticated (Admin+) SQL Injection",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9085",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "EventPrime – Modern Events Calendar, Bookings and Tickets \u003c= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 4.0.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9864",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page-list \u003c= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "page-list",
    "type": "plugin",
    "affected_version": "* - 5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Event calendar \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-event-calendar",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28169",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReDi Restaurant Reservation \u003c= 24.0128 - Reflected Cross-Site Scripting",
    "slug": "redi-restaurant-reservation",
    "type": "plugin",
    "affected_version": "* - 24.0128",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.0128",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29806",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c 2.2.8 - Missing Capabilities Check to Information Disclosure",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 2.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4355",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 1.2.28 - Authenticated (Contributor+) Open Redirect via Shortcode",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 1.2.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51517",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All Currencies for WooCommerce \u003c= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woocommerce-all-currencies",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30950",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProcessingJS for WordPress \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "processingjs-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6039",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ContentLock \u003c= 1.0.3 - Cross-Site Request Forgery to Group/Email Deletion",
    "slug": "contentlock",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6024",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Product Catalog \u003c= 4.2.22 - SQL Injection",
    "slug": "ultimate-product-catalogue",
    "type": "plugin",
    "affected_version": "* - 4.2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.22",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-12199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-12199",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GetShop ecommerce \u003c= 1.3 - Unauthenticated Local File Inclusion",
    "slug": "getshop-ecommerce",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54362",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Google Feed Manager \u003c= 2.4.2 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting",
    "slug": "wp-product-feed-manager",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3067",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JobSearch WP Job Board \u003c= 1.8.1 - Missing Authorization to Settings Change",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4352",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Email Templates \u003c= 1.4.2 - Cross-Site Request Forgery via send_test_email",
    "slug": "email-templates",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47181",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.8 - Reflected Cross-Site Scripting",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47386",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Firelight Lightbox \u003c= 2.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-fancybox",
    "type": "plugin",
    "affected_version": "* - 2.3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52707",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1424",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.21",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.18",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.18",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.15",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.10",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.5",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.1",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.21",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.19",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.11",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Template Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.9",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Design Maps \u0026 Places \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "wp-design-maps-places",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GMap Shortcode \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gmap-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23893",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada | Website Builder For WordPress \u0026 eCommerce \u003c= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode",
    "slug": "fusion-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5628",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TrustedLogin Vendor \u003c 1.1.1 - Unauthenticated Information Disclosure",
    "slug": "vendor",
    "type": "plugin",
    "affected_version": "[*, 1.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-37270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37270",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Plugin Central \u003c= 2.5.1 - Cross-Site Request Forgery to Arbitrary File Deletion",
    "slug": "plugin-central",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-46439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46439",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "SMSA Shipping for WooCommerce \u003c= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "smsa-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4107",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Missing Authorization via ajax_unassign_folders",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0684",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "TailPress \u003c= 0.4.4 - Unauthenticated Sensitive Information Exposure",
    "slug": "tailpress",
    "type": "plugin",
    "affected_version": "* - 0.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31558",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Anything Popup \u003c= 7.3 - Reflected Cross-Site Scripting",
    "slug": "anything-popup",
    "type": "plugin",
    "affected_version": "* - 7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39397",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Stylesheet Switcher \u003c= v2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-user-stylesheet-switcher",
    "type": "plugin",
    "affected_version": "* - v2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "v2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52792",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-4956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4956",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accommodation System \u003c= 1.0.1 - Missing Authorization",
    "slug": "accommodation-system",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-37344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37344",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Timetable and Event Schedule by MotoPress \u003c= 2.4.11 - Authenticated (Contributor+) SQL Injection",
    "slug": "mp-timetable",
    "type": "plugin",
    "affected_version": "* - 2.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3342",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Just Custom Fields \u003c= 3.3.2 - Missing Authorization via AJAX actions",
    "slug": "just-custom-fields",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6167",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Instabot \u003c= 1.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "instabot",
    "type": "plugin",
    "affected_version": "* - 1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22571",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web-Stat \u003c= 1.4.0 - API Key Disclosure",
    "slug": "web-stat",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24167",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Easy Testimonial Slider and Form \u003c= 1.0.15 - Unauthenticated Reflected Cross-Site Scripting via search_term",
    "slug": "easy-testimonial-rotator",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46799",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CformsII \u003c= 15.0.1 - Unauthenticated HTML Injection \u0026 Cross-Site Request Forgery",
    "slug": "cforms2",
    "type": "plugin",
    "affected_version": "[*, 15.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.0.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15238",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WWM Social Share On Image Hover \u003c= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wwm-social-share-on-image-hover",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44239",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salient Shortcodes \u003c= 1.5.3 - Authenticated (Contributor+) Local File Inclusion via Shortcode",
    "slug": "salient-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3810",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-bulk-product-editing",
    "type": "plugin",
    "affected_version": "* - 1.2.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-zoom-magnifier",
    "type": "plugin",
    "affected_version": "* - 2.14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-popup",
    "type": "plugin",
    "affected_version": "* - 1.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-badges-management",
    "type": "plugin",
    "affected_version": "* - 2.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-product-add-ons",
    "type": "plugin",
    "affected_version": "* - 2.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-tab-manager",
    "type": "plugin",
    "affected_version": "* - 1.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-questions-and-answers",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-authorizenet-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-name-your-price",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-order-tracking",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-cart-messages",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-subscription",
    "type": "plugin",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-paypal-express-checkout-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-ajax-navigation",
    "type": "plugin",
    "affected_version": "* - 4.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 3.14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-stripe",
    "type": "plugin",
    "affected_version": "* - 2.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-custom-thank-you-page-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-donations-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-compare",
    "type": "plugin",
    "affected_version": "* - 2.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-color-and-label-variations-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.25.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-ajax-search",
    "type": "plugin",
    "affected_version": "* - 1.25.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-essential-kit-for-woocommerce-1",
    "type": "plugin",
    "affected_version": "* - 2.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-mailchimp",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-infinite-scrolling",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-product-vendors",
    "type": "plugin",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-pre-order-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-product-bundles",
    "type": "plugin",
    "affected_version": "* - 1.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-request-a-quote",
    "type": "plugin",
    "affected_version": "* - 2.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-waiting-list",
    "type": "plugin",
    "affected_version": "* - 1.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-pdf-invoice",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-category-accordion",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-brands-add-on",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-gift-cards",
    "type": "plugin",
    "affected_version": "* - 2.14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-paypal-payments-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-points-and-rewards",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-multi-step-checkout",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-added-to-cart-popup",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-product-slider-carousel",
    "type": "plugin",
    "affected_version": "* - 1.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-catalog-mode",
    "type": "plugin",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-affiliates",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-quick-view",
    "type": "plugin",
    "affected_version": "* - 1.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-advanced-reviews",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-frequently-bought-together",
    "type": "plugin",
    "affected_version": "* - 1.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-featured-video",
    "type": "plugin",
    "affected_version": "* - 1.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH plugins by YITHEMES \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "yith-woocommerce-social-login",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Search Analytics \u003c= 1.4.9 - Missing Authorization",
    "slug": "search-analytics",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43229",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GridKit Portfolio \u003c= 2.0.0 - Subscriber+ Stored Cross-Site Scripting",
    "slug": "portfolio-wp",
    "type": "plugin",
    "affected_version": "[*, 2.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25090",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hermit 音乐播放器 \u003c= 3.1.6 - Multiple Cross-Site Request Forgery",
    "slug": "hermit",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29412",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Activity Log \u003c= 4.5.0 - Missing Capabilities Check to User Enumeration",
    "slug": "wp-security-audit-log",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2261",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Activity Log \u003c= 4.5.0 - Missing Capabilities Check to User Enumeration",
    "slug": "wp-security-audit-log-premium",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2261",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SEO SIMPLE PACK \u003c= 3.2.1 - Information Exposure",
    "slug": "seo-simple-pack",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2795",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "VR Views \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "vr-views",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22820",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.0.4 - Full Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2006-3390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-3390",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Podamibe Twilio Private Call \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "podamibe-twilio-private-call",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23742",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Rocket \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "social-rocket",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37258",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate FAQ \u003c= 1.8.29 - Reflected Cross-Site Scripting",
    "slug": "ultimate-faqs",
    "type": "plugin",
    "affected_version": "* - 1.8.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-7107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7107",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.5.1 - Unauthenticated SQL Injection via userToken",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-52215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52215",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Blocks – Page Builder Gutenberg Blocks, Patterns \u0026 Templates \u003c= 5.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13803",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Otter - Gutenberg Blocks \u003c= 2.2.5 - Authenticated (Author+) PHAR Deserialization",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2288",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Старт \u003c= 3.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "iksweb",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25972",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TH Side Cart and Menu Cart for Woocommerce \u003c= 1.1.1 - Missing Authorization",
    "slug": "th-all-in-one-woo-cart",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25969",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mega Addons For WPBakery Page Builder \u003c= 4.2.7 - Cross-Site Request Forgery to Settings Update",
    "slug": "mega-addons-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 4.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36798",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Forminator \u003c= 1.24.6 - Unauthenticated Arbitrary File Upload",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.24.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-4596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4596",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Activity Log \u003c= 4.0.1 - Missing Authorization",
    "slug": "wp-security-audit-log",
    "type": "plugin",
    "affected_version": "[*, 4.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36716",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "MainWP WordPress SEO Extension \u003c= 4.0.1 - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "mainwp-seo-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23746",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP-Pro-Quiz \u003c= 0.37 - Arbitrary Quiz Deletion via Cross-Site Request Forgery",
    "slug": "wp-pro-quiz",
    "type": "plugin",
    "affected_version": "* - 0.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36504",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Ziggeo \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ziggeo",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12452",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPDB to Sql \u003c= 1.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "wpdb-to-sql",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23774",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JobBoardWP – Job Board Listings and Submissions \u003c= 1.0.7 - Stored Cross-Site Scripting",
    "slug": "jobboardwp",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39329",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 1.8.2 - SQL Injection via tutor_quiz_builder_get_question_form",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24183",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "LiquidPoll – Polls, Surveys, NPS and Feedback Reviews \u003c= 3.3.76 - Information Exposure",
    "slug": "wp-poll",
    "type": "plugin",
    "affected_version": "* - 3.3.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.76",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2080",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Open Social \u003c= 5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "open-social",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25792",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Order Search \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-order-searching",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23495",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mega Elements \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mega-elements-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49693",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebP Express \u003c 0.14.11 - Arbitrary File Read",
    "slug": "webp-express",
    "type": "plugin",
    "affected_version": "[*, 0.14.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.14.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15330",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Team Manager \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-team-manager",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29406",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cardealer \u003c= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profile",
    "slug": "cardealer",
    "type": "theme",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1687",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multi Rating \u003c= 5.0.6 - Cross-Site Request Forgery to Arbitrary Ratings Value Change",
    "slug": "multi-rating",
    "type": "plugin",
    "affected_version": "* - 5.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32125",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BP Email Assign Templates \u003c= 1.7 - Authenticated (Admin+) Arbitrary Option Deletion",
    "slug": "bp-email-assign-templates",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28874",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "iThemes Security \u003c= 6.9.0 - Cross-Site Scripting",
    "slug": "better-wp-security",
    "type": "plugin",
    "affected_version": "* - 6.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-7433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-7433",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Easy Appointments \u003c= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-appointments",
    "type": "plugin",
    "affected_version": "* - 3.10.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4668",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elizaibots \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elizaibot-chatbots",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49893",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit File Manager – 100% Free \u0026 Open Source File Manager and Code Editor for WordPress \u003c= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "file-manager",
    "type": "plugin",
    "affected_version": "* - 6.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7770",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quick Chat \u003c= 4.14 - SQL Injection",
    "slug": "quick-chat",
    "type": "plugin",
    "affected_version": "* - 4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-1010104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1010104",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Local Business Addons For Elementor \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "map-addons-for-elementor-waze-map",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49667",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photography \u003c= 7.5.2 - Missing Authorization",
    "slug": "photography",
    "type": "theme",
    "affected_version": "* - 7.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22702",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery - GT3 Image Gallery \u0026 Gutenberg Block Gallery \u003c= 2.7.7.25 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gt3-photo-video-gallery",
    "type": "plugin",
    "affected_version": "* - 2.7.7.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47677",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Attachment Export \u003c 0.2.4 - Arbitrary File Download",
    "slug": "wp-attachment-export",
    "type": "plugin",
    "affected_version": "[*, 0.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-20067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-20067",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "vSlider Multi Image Slider \u003c= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "vslider",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25797",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Football Pool \u003c= 2.12.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "football-pool",
    "type": "plugin",
    "affected_version": "* - 2.12.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58987",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "jQuery Dropdown Menu \u003c= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "jquery-drop-down-menu-plugin",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30560",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPvivid Backup for MainWP \u003c= 0.9.32 - Reflected Cross-Site Scripting",
    "slug": "wpvivid-backup-mainwp",
    "type": "plugin",
    "affected_version": "* - 0.9.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1383",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Invoice – Web Invoice and Billing \u003c= 4.1.0 - Insecure Direct Object Reference",
    "slug": "wp-invoice",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-11007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11007",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Awesome Support \u003c= 6.1.1 - Insecure Direct Object Reference to (Subscriber+) Ticket Export",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3511",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CountDown Pro WP Plugin \u003c= 2.7 - Authenticated (Contributor+) SQL Injection",
    "slug": "circular_countdown",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32301",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Wholesale For WooCommerce \u003c= 2.3.0 - Unauthenticated Arbitrary Post Deletion",
    "slug": "woocommerce-wholesale-pricing",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31297",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L"
  },
  {
    "title": "Icegram Engage \u003c= 3.1.11 - Reflected Cross-Site Scripting",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 3.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2398",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Continuous Image Carousel With Lightbox \u003c= 1.0.15 - Reflected Cross-Site Scripting via search_term, order_by and order_pos",
    "slug": "continuous-image-carousel-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28792",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1005",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Page Generator Plugin \u003c= 3.3.9 - Cross-Site Request Forgery",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 3.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47143",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "DevBuddy Twitter Feed \u003c= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "devbuddy-twitter-feed",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32577",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Semantic Shortcode \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "semantic-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51898",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Editor \u003c 1.2.6 - Cross-Site Request Forgery",
    "slug": "wp-editor",
    "type": "plugin",
    "affected_version": "[*, 1.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10885",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.59 - Insufficient Access Control to Template Conditions Modification",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4708",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Silencesoft RSS Reader \u003c= 0.6 - Unauthenticated Server-Side Request Forgery",
    "slug": "external-rss-reader",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-60181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60181",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.15.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1348",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chatbot with ChatGPT  \u003c= 2.4.5 - Missing Authorization to Unauthenticated OpenAI API Key Exposure",
    "slug": "smartsearchwp",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6845",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "Tabs Shortcode \u003c= 2.0.2 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode",
    "slug": "tabs-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11606",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Friendly Functions for Welcart \u003c= 1.2.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "friendly-functions-for-welcart",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10726",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Companion Auto Update \u003c= 3.2.0 - Cross-Site Request Forgery",
    "slug": "companion-auto-update",
    "type": "plugin",
    "affected_version": "[*, 3.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-20972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20972",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ScrollReveal.js Effects \u003c= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "scrollrevealjs-effects",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1512",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 3.8.4 - Cross-Site Request Forgery",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "[*, 3.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-14328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14328",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Users Ultra \u003c= 1.5.15 - Multiple SQL Injection",
    "slug": "users-ultra",
    "type": "plugin",
    "affected_version": "* - 1.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-4109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4109",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventON \u003c= 2.1.7 - Authenticated (Admin+) HTML Injection",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-6046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6046",
    "auth_type": "Privileged",
    "cvss_score": 3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1802",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stripe Add-on for iThemes Exchange \u003c 1.2.0 - Reflected Cross-Site Scripting",
    "slug": "exchange-addon-stripe",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9374",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-DownloadManager plugin \u003c= 1.68.6 - Reflected Cross-Site Scripting",
    "slug": "wp-downloadmanager",
    "type": "plugin",
    "affected_version": "* - 1.68.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.68.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-44760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-44760",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Symposium \u003c= 14.10 - Cross-Site Scripting",
    "slug": "wp-symposium",
    "type": "plugin",
    "affected_version": "* - 14.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-8809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8809",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PPOM for WooCommerce \u003c= 32.0.6 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-product-addon",
    "type": "plugin",
    "affected_version": "* - 32.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "32.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2256",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accessibility by AllAccessible \u003c= 1.3.4 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "allaccessible",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49644",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Next Post Navi \u003c= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-next-post-navi",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34793",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Able Player \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-able-player",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22577",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendy",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2789",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Primary Addon for Elementor \u003c= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget",
    "slug": "primary-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5229",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Admin by DynamiApps \u003c= 3.24.5 - Unauthenticated Privilege Escalation",
    "slug": "acf-frontend-form-element",
    "type": "plugin",
    "affected_version": "* - 3.24.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.24.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11721",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Website Toolbox Community \u003c= 2.0.1 - Reflected Cross-Site Scripting via websitetoolbox_username",
    "slug": "website-toolbox-forums",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12338",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FluentSMTP \u003c= 2.2.80 - Cross-Site Request Forgery",
    "slug": "fluent-smtp",
    "type": "plugin",
    "affected_version": "* - 2.2.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.80",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24739",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form 7 \u003c= 6.0.5 - Order Replay Vulnerability",
    "slug": "contact-form-7",
    "type": "plugin",
    "affected_version": "* - 6.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3247",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iMember360 3.8.0.12 - 3.9.001 - Cross-Site Request Forgery",
    "slug": "imember360",
    "type": "plugin",
    "affected_version": "[3.8.012, 3.9.001)",
    "from_version": "3.8.012",
    "from_inclusive": true,
    "to_version": "3.9.001",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-8948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8948",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Editorial Calendar \u003c= 3.8.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via edcal_saveoptions AJAX action",
    "slug": "editorial-calendar",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4115",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup Migration \u003c= 1.3.5 - Unauthenticated Sensitive Information Exposure",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6271",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Jannah \u003c= 5.4.4 - Reflected Cross-Site Scripting",
    "slug": "jannah",
    "type": "theme",
    "affected_version": "[*, 5.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24407",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form and Calls To Action by vcita \u003c= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lead-capturing-call-to-actions-by-vcita",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2302",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Sharing Plugin - Social Warfare \u003c= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "social-warfare",
    "type": "plugin",
    "affected_version": "* - 4.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4842",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Constructor \u003c= 1.6.5 - Missing Authorization",
    "slug": "constructor",
    "type": "theme",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53302",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Piotnet Addons For Elementor \u003c= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "piotnet-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22333",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HyperComments \u003c= 0.9.6 - Reflected Cross-Site Scripting",
    "slug": "comments-with-hypercommentscom",
    "type": "plugin",
    "affected_version": "* - 0.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23509",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder by SiteOrigin \u003c= 2.31.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "siteorigin-panels",
    "type": "plugin",
    "affected_version": "* - 2.31.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.31.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1459",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Manage Notification E-mails \u003c= 1.8.5 - Missing Authorization",
    "slug": "manage-notification-emails",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6496",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "User Meta \u003c= 3.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "user-meta",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33575",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "LMS by LifterLMS – Online Course, Membership \u0026 Learning Management System Plugin \u003c= 4.21.0 - Stored Cross-Site Scripting",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "[*, 4.21.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24308",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Slider WordPress \u003c= 1.4.6 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "slider-video",
    "type": "plugin",
    "affected_version": "[*, 1.4.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1541",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IMPress for IDX Broker \u003c= 2.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "idx-broker-platinum",
    "type": "plugin",
    "affected_version": "[*, 2.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-11512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11512",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Composer Website Builder \u003c= 45.6.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "visualcomposer",
    "type": "plugin",
    "affected_version": "* - 45.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "45.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27997",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Textmetrics \u003c= 3.6.1 - Missing Authorization",
    "slug": "webtexttool",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30824",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elfsight Telegram Chat CC \u003c= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "elfsight-telegram-chat-cc",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10390",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress \u0026 WooCommerce \u003c= 5.7.25 - Unauthenticated SQL Injection via unsubscribe",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.25",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6172",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP jQuery DataTable \u003c= 4.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-jquery-datatable",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47605",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AtomChat \u003c= 1.1.4 - Missing Authorization via credits REST API Endpoint",
    "slug": "atomchat",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46606",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Multislider Widget",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1466",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementary Addons \u003c= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementary-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51586",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Carousel Slider \u003c= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "logo-carousel-slider",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39525",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SimpleForm Contact Form Submissions \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "simpleform-contact-form-submissions",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10884",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CB (legacy) \u003c= 0.9.4.18 - Cross-Site Request Forgery to Code/Timeframe/Booking Deletion",
    "slug": "commons-booking",
    "type": "plugin",
    "affected_version": "* - 0.9.4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4382",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.13 - Missing Authorization to Settings Update in enableOptimization",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0983",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Security \u0026 Malware scan by CleanTalk \u003c= 2.145 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated SQL Injection",
    "slug": "security-malware-firewall",
    "type": "plugin",
    "affected_version": "* - 2.145",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.145",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10570",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Woodmart Core \u003c= 1.0.36 - Authentication Bypass to Privilege Escalation",
    "slug": "woodmart-core",
    "type": "plugin",
    "affected_version": "* - 1.0.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.36",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-32244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32244",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP VR \u003c= 8.5.4 - Missing Authorization",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49293",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SSV Events \u003c= 3.2.7 - Unauthenticated Local File Inclusion",
    "slug": "ssv-events",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49286",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Job Board Vanila Plugin \u003c= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "job-board-vanilla",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39334",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Education LMS \u003c= 0.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "education-lms",
    "type": "theme",
    "affected_version": "* - 0.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22334",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Gift Cards Premium \u003c= 3.3.0 - Arbitrary File Upload",
    "slug": "yith-woocommerce-gift-cards-premium",
    "type": "plugin",
    "affected_version": "[*, 3.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-3120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-3120",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "404 Solution \u003c= 2.34.0 - Authenticated(Administrator+) SQL Injection",
    "slug": "404-solution",
    "type": "plugin",
    "affected_version": "[*, 2.35.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.35.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50848",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Photo Album Plus \u003c 5.0.3 - Cross-Site Scripting",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "[*, 5.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-3254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3254",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Made Easy \u003c= 2.2.80 - SQL Injection",
    "slug": "events-made-easy",
    "type": "plugin",
    "affected_version": "* - 2.2.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.80",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1905",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder \u003c 4.6.1 - SQL Injection",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "[*, 4.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9452",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ocean Extra \u003c= 2.0.4 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3374",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EKC Tournament Manager \u003c= 2.2.1 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "ekc-tournament-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49674",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "occupancyplan \u003c= 1.0.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "occupancyplan",
    "type": "plugin",
    "affected_version": "* - 1.0.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46450",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 2.0.6 - Unauthenticated SQL Injection",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-2034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-2034",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Active Products Tables for WooCommerce. Use constructor to create tables \u003c= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10168",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Lightbox \u003c= 2.4.8 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49282",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.5.22 - Authenticated Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14797",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inline Related Posts \u003c= 3.6.0 - Reflected Cross-Site Scripting",
    "slug": "intelly-related-posts",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5626",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yotpo: Product \u0026 Photo Reviews for WooCommerce \u003c= 1.7.9 - Reflected Cross-Site Scripting",
    "slug": "yotpo-social-reviews-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9356",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radio Station \u003c= 2.4.0.9 - Reflected Cross-Site Scripting",
    "slug": "radio-station",
    "type": "plugin",
    "affected_version": "* - 2.4.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32499",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Find Duplicates \u003c= 1.4.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "find-duplicates",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32127",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Job Board and Recruitment Plugin – JobWP \u003c= 2.0 - Arbitrary File Upload via 'jobwp_upload_resume'",
    "slug": "jobwp",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-29384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29384",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Home Villas | Real Estate WordPress Theme \u003c= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "homevillas-real-estate",
    "type": "theme",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5014",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Convert Post Types \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "convert-post-types",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31112",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.25",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.21",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.12",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.11",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.7",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.8",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.24",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.24",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.16",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.27",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.27",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.17",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.15",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OceanWP \u003c= 3.4.1 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "oceanwp",
    "type": "theme",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23700",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Scrollsequence \u003c= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "scrollsequence",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29118",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed documents shortcode \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embed-documents-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51904",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCS – WordPress Currency Switcher Professional \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51506",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting via Widget Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.9",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5732",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting via Widget Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.9",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5732",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting via Widget Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.7",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5732",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting via Widget Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.6",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5732",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting via Widget Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.6",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5732",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting via Widget Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.3",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5732",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting via Widget Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5732",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPFactory Helper \u003c= 1.7.0 -  Reflected Cross-Site Scripting",
    "slug": "wpcodefactory-helper",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8656",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS WordPress Plugin – for Online Courses and Education \u003c= 3.2.5 - Unauthenticated SQL Injection",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-1512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1512",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid Backup \u0026 Migration \u003c= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.116",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.116",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5961",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Patreon WordPress \u003c 1.7.0 - Local File Disclosure",
    "slug": "patreon-connect",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24227",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "vSlider Multi Image Slider \u003c= 4.1.2 - Cross-Site Request Forgery",
    "slug": "vslider",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22672",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "weebotLite \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "weebotlite",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32596",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Translator \u003c= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "translator",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30621",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Author Avatars List/Block \u003c= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "author-avatars",
    "type": "plugin",
    "affected_version": "* - 2.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49846",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder \u003c= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6504",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Login rebuilder \u003c 1.2.0 - Cross-Site Request Forgery",
    "slug": "login-rebuilder",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-3882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3882",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARForms Form Builder \u003c= 1.5.6 - Unauthenticated Cross-Site Scripting",
    "slug": "arforms-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45838",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Contact Forms by Cimatti \u003c= 1.9.4 - Missing Authorization to Unauthenticated Form Submission Download",
    "slug": "contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12184",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Tito \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tito",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49241",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SeoSamba for WordPress Webmasters \u003c= 1.0.5 - Cross-Site Request Forgery",
    "slug": "seosamba-webmasters",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41620",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Backup and Staging by WP Time Capsule \u003c= 1.22.21 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-time-capsule",
    "type": "plugin",
    "affected_version": "* - 1.22.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48020",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Semalt Blocker \u003c= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "semalt",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23794",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GamiPress \u003c= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 7.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13499",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Better Search Replace \u003c= 1.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "better-search-replace",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2593",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0438",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "themedropbox Themes \u003c= Various Versions - Missing Authorization to Notice Dismissal",
    "slug": "construction-landing-page",
    "type": "theme",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37496",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "themedropbox Themes \u003c= Various Versions - Missing Authorization to Notice Dismissal",
    "slug": "metro-magazine",
    "type": "theme",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37496",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "themedropbox Themes \u003c= Various Versions - Missing Authorization to Notice Dismissal",
    "slug": "bakes-and-cakes",
    "type": "theme",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37496",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms \u003c= 2.2.7 - SQL Injection",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-21003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-21003",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 \u003c= 4.2.5 - Cross-Site Request Forgery",
    "slug": "baidu-submit-link",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26531",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All In Menu \u003c= 1.1.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "all-in-menu",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27281",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.8.8 - SQL Injection",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "* - 3.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-5651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5651",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WatuPRO \u003c 5.5.3.7 - SQL Injection",
    "slug": "watupro",
    "type": "plugin",
    "affected_version": "[*, 5.5.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-9834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9834",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Passster – Password Protect Pages and Content \u003c= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "content-protector",
    "type": "plugin",
    "affected_version": "* - 4.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11282",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SVG Shortcode \u003c= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "svg-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12574",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Store Finder \u003c= 7.5 - Unauthenticated SQL Injection",
    "slug": "superstorefinder-wp",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52720",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "wpForo \u003c = 1.5.1 - Privilege Escalation",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-16613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16613",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Surbma | GDPR Proof Cookie Consent \u0026 Notice Bar \u003c= 17.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "surbma-gdpr-proof-google-analytics",
    "type": "plugin",
    "affected_version": "* - 17.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23894",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Sharing Plugin – Sassy Social Share \u003c= 3.3.75 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter",
    "slug": "sassy-social-share",
    "type": "plugin",
    "affected_version": "* - 3.3.75",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.75",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5528",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Media Widget by Acurax \u003c= 3.2.5 - Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter",
    "slug": "acurax-social-media-widget",
    "type": "plugin",
    "affected_version": "[*, 3.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-6357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6357",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Logo Showcase with Slick Slider – Logo Carousel, Logo Slider \u0026 Logo Grid \u003c= 1.2.3 - Stored Cross-Site Scripting",
    "slug": "logo-showcase-with-slick-slider",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24729",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Pipes \u003c= 1.4.2 - Unauthenticated Arbitrary File Deletion",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48267",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Backup Bolt \u003c= 1.4.1 - Cross-Site Request Forgery",
    "slug": "backup-bolt",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GS Variation Swatches for WooCommerce \u003c= 3.0.4 - Missing Authorization",
    "slug": "gs-woo-variation-swatches",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47526",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Folders \u003c= 8.3.0 - Missing Authorization to Plugin Settings Change",
    "slug": "media-library-plus",
    "type": "plugin",
    "affected_version": "* - 8.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0935",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Testimonial Slider \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "testimonial-slider",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4193",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Backgrounds Lite \u003c= 2.3 - Cross-Site Request Forgery Bypass",
    "slug": "wp-backgrounds-lite",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4419",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "pCloud Backup \u003c= 1.0.1 - Missing Authorization",
    "slug": "pcloud-backup",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31755",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.21",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.20",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.17",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.13",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.11",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.3",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.23",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.23",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.20",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.12",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.8",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-17094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VForm \u003c= 3.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "v-form",
    "type": "plugin",
    "affected_version": "* - 3.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46250",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beautiful Cookie Consent Banner \u003c= 2.10.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "beautiful-and-responsive-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 2.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3388",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Anything",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0824",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfect Font Awesome Integration \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "perfect-font-awesome-integration",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31861",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soumettre.fr \u003c= 2.1.3 - Missing Authorization",
    "slug": "soumettre-fr",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8675",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Breaking News Ticker \u003c= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "breaking-news-ticker",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25094",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kikx Simple Post Author Filter \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "sa-post-author-filter",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22355",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process_handler Function",
    "slug": "import-export-with-custom-rest-api",
    "type": "plugin",
    "affected_version": "1.0.0 - 2.0.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5288",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Constant Contact Forms \u003c= 2.4.2 - Information Disclosure via Log Files",
    "slug": "constant-contact-forms",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52208",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "TranslatePress \u003c= 2.3.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "translatepress-multilingual",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3141",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Responsive Slider \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addi-simple-slider",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8690",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DeMomentSomTres WordPress Export Posts With Images \u003c= 20220825 - Missing Authorization to Blog Data Export",
    "slug": "demomentsomtres-wp-export",
    "type": "plugin",
    "affected_version": "* - 20220825",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20220825",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5905",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Symposium \u003c 14.11 - Authenticated SQL Injection",
    "slug": "wp-symposium",
    "type": "plugin",
    "affected_version": "[*, 14.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.11",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-8810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8810",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.12 - Cross-Site Request Forgery in savetranslationstay function",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25707",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Super Progressive Web Apps \u003c= 2.2.21 - Missing Authorization",
    "slug": "super-progressive-web-apps",
    "type": "plugin",
    "affected_version": "* - 2.2.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48277",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP 2FA – Two-factor authentication for WordPress \u003c= 2.5.0 - Cross-Site Request Forgery",
    "slug": "wp-2fa",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6520",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar \u003c= 1.6.7.53 - Authenticated (Admin+) Stored Cross-Site Scripting via Appointment Settings",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.6.7.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7876",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog Designer PRO \u003c= 3.4.7 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "blog-designer-pro",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47695",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shield Security – Smart Bot Blocking \u0026 Intrusion Prevention Security \u003c= 19.1.13 - Cross-Site Request Forgery",
    "slug": "wp-simple-firewall",
    "type": "plugin",
    "affected_version": "* - 19.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4344",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AppPresser – Mobile App Framework \u003c= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP",
    "slug": "apppresser",
    "type": "plugin",
    "affected_version": "* - 4.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9305",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Fluent Forms \u003c 3.6.67 - Stored Cross-Site Scripting",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "[*, 3.6.67)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.67",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-34620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34620",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5173",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7122",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Find and Replace \u003c= 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "real-time-auto-find-and-replace",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24676",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "S3 Bubble Amazon S3 HTML5 Video with Adverts \u003c= 0.7 - Directory Traversal to Arbitrary File Access",
    "slug": "s3bubble-amazon-s3-html-5-video-with-adverts",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9464",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Abbie Expander \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "abbie-expander",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49427",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crypto Converter Widget \u003c= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "crypto-converter-widget",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49150",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "우커머스 네이버페이 \u003c= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase Shortcode",
    "slug": "mshop-npay",
    "type": "plugin",
    "affected_version": "* - 3.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11231",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SSL Wireless SMS Notification \u003c= 3.6.0 - Unauthenticated Privilege Escalation",
    "slug": "ssl-wireless-sms-notification",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56220",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Genesis Blocks \u003c= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via postTitleTag",
    "slug": "genesis-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2761",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.13 - Cross-Site Request Forgery to Settings Update in enableOptimization",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1334",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AcyMailing \u003c= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function",
    "slug": "acymailing",
    "type": "plugin",
    "affected_version": "* - 9.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7384",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JupiterX Theme \u003c= 2.0.6 and JupiterX Core \u003c= 2.0.6 - Authenticated Arbitrary Plugin Deactivation and Settings Modification",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1656",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "JupiterX Theme \u003c= 2.0.6 and JupiterX Core \u003c= 2.0.6 - Authenticated Arbitrary Plugin Deactivation and Settings Modification",
    "slug": "jupiterx",
    "type": "theme",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1656",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "BookingPress \u003c= 1.0.82 - Missing Authorization to Appointment Time Alteration",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.82",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.82",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34799",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 4.0.4 - Cross-Site Scripting",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 4.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10868",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Atarim \u003c= 4.1.0 - Reflected Cross-Site Scripting",
    "slug": "atarim-visual-collaboration",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26993",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooPayments – Fully Integrated Solution Built and Supported by Woo \u003c= 6.6.2 - Unauthenticated Insecure Direct Object Reference",
    "slug": "woocommerce-payments",
    "type": "plugin",
    "affected_version": "* - 6.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51503",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode \u003c= 6.15.21 - Missing Authorization via seedprod_lite_new_lpage",
    "slug": "coming-soon",
    "type": "plugin",
    "affected_version": "* - 6.15.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.15.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1072",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "WP-Force Images Download \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-force-images-download",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11809",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crafts \u0026 Arts \u003c= 2.5 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "crafts-and-arts",
    "type": "theme",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31924",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WCFM - Frontend Manager for WooCommerce \u003c= 6.5.11 - Customer/Subscriber+ SQL Injection",
    "slug": "wc-frontend-manager",
    "type": "plugin",
    "affected_version": "* - 6.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24835",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "10to8 Online Appointment Booking System \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "10to8-online-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49173",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GMAce \u003c= 1.5.2 - Authenticated(Admin+) Directory Traversal",
    "slug": "gmace",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23872",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 6.2.1 - Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 6.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-9575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9575",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Starter Templates \u003c= 3.2.5 - Incorrect Authorization",
    "slug": "astra-sites",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41805",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Starter Templates \u003c= 3.2.5 - Incorrect Authorization",
    "slug": "astra-pro-sites",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41805",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Expirator \u003c= 2.5.1 - Contributor+ Arbitrary Post Schedule Deletion",
    "slug": "post-expirator",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24783",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 5.3.4 - Missing Authorization via openai_file_list_callback",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 5.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0451",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "Events Addon for Elementor \u003c= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "events-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54315",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "A2 Optimized WP \u003c= 3.0.4 - Cross Site Request Forgery",
    "slug": "a2-optimized-wp",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23711",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.89 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "0.9.89",
    "from_version": "0.9.89",
    "from_inclusive": true,
    "to_version": "0.9.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4274",
    "auth_type": "Privileged",
    "cvss_score": 8.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H"
  },
  {
    "title": "CF7 Reply Manager \u003c= 1.2.3 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "cf7-reply-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52404",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Time Slots Booking Form \u003c= 1.1.76 - Missing Authorization to Feedback Submission",
    "slug": "wp-time-slots-booking-form",
    "type": "plugin",
    "affected_version": "* - 1.1.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.76",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41790",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AdRotate – Ad manager \u0026 AdSense Ads \u003c 3.6.8 - SQL Injection",
    "slug": "adrotate",
    "type": "plugin",
    "affected_version": "[*, 3.6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2011-4671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4671",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.5.2 - Missing Authorization to Options Update",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4875",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Element Pack Pro \u003c= 7.21.0 - Cross-Site Request Forgery",
    "slug": "bdthemes-element-pack",
    "type": "plugin",
    "affected_version": "* - 7.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.21.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46257",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Glossary \u003c= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "glossary-by-codeat",
    "type": "plugin",
    "affected_version": "* - 2.1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24378",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Slider for WooCommerce \u003c= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "woo-product-slider",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4629",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hubbub Lite – Fast, Reliable Social Network Sharing Buttons \u003c= 1.33.1 - PHP Object Injection",
    "slug": "social-pug",
    "type": "plugin",
    "affected_version": "* - 1.33.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2501",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPS Hide Login \u003c= 1.5.2.2 - Login Page Disclosure via 'action=confirmaction'",
    "slug": "wps-hide-login",
    "type": "plugin",
    "affected_version": "[*, 1.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15823",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ThePerfectWedding.nl Widget \u003c= 2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "theperfectweddingnl-widget",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12322",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPPizza \u003c= 3.18.10 - Missing Authorization",
    "slug": "wppizza",
    "type": "plugin",
    "affected_version": "* - 3.18.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33576",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 5.8.1.3 - Stored Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "[*, 5.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-0576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0576",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "xili-language \u003c= 2.21.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xili-language",
    "type": "plugin",
    "affected_version": "* - 2.21.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.21.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58654",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Members \u003c= 3.2.7 - Cross-Site Request Forgery",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15660",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Vertical scroll recent post \u003c= 14.0 - Cross-Site Request Forgery via vsrp_admin_options",
    "slug": "vertical-scroll-recent-post",
    "type": "plugin",
    "affected_version": "* - 14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47671",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BestWebSoft's LinkedIn \u003c 1.0.5 - Cross-Site Scripting",
    "slug": "bws-linkedin",
    "type": "plugin",
    "affected_version": "[*, 1.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18516",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elegant Blocks \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elegant-blocks",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34769",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy WP SMTP \u003c= 1.5.1 - Authenticated (Admin+) Directory Traversal",
    "slug": "easy-wp-smtp",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-45833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45833",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Appointment Booking and Online Scheduling \u003c= 4.4.2 - Reflected Cross-Site Scripting",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5859",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.19.3 - Unauthenticated PHP Object Injection",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.19.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-22777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22777",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Popup Plugin \u003c= 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-popup-plugin",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8547",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Minical Hotel Booking Plugin \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "minical",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51895",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nota Fiscal Eletrônica WooCommerce \u003c= 3.4.0.6 - Missing Authorization",
    "slug": "nota-fiscal-eletronica-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60159",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better Search Replace \u003c= 1.4.4 - Unauthenticated PHP Object Injection",
    "slug": "better-search-replace",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6933",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RS WP Book Showcase \u003c= 6.7.41 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "rs-wp-books-showcase",
    "type": "plugin",
    "affected_version": "* - 6.7.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48119",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 5.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47525",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Golf Tracker \u003c= 0.7 - Authenticated (Contributor+) SQL Injection",
    "slug": "golf-tracker",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51607",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "XStore Core \u003c= 5.3.8 - Authenticated (Subscriber+) Limited Arbitrary File Upload",
    "slug": "et-core-plugin",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33556",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "JetElements For Elementor \u003c= 2.7.7 - Authenticated (Subscriber+) Information Disclosure",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53983",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Premium Packages - Sell Digital Products Securely \u003c= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wpdm-premium-packages",
    "type": "plugin",
    "affected_version": "* - 5.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4293",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ovic Addon Toolkit \u003c= 2.6.1 - Missing Authorization",
    "slug": "ovic-addon-toolkit",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32432",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Full frame \u003c= 2.7.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "full-frame",
    "type": "theme",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44010",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Maps CP \u003c= 1.0.43 - Missing Authorization to Authenticated (Subscriber+) Feedback Form Submission",
    "slug": "codepeople-post-map",
    "type": "plugin",
    "affected_version": "* - 1.0.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25039",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Youzify – BuddyPress Community, User Profile, Social Network \u0026 Membership Plugin for WordPress \u003c= 1.2.5 - Authenticated (Contributor+) SQL Injection",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4742",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "App Embed \u003c= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "appizy-app-embed",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11749",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StoreKeeper for WooCommerce \u003c= 14.4.4 - Unauthenticated Arbitrary File Upload",
    "slug": "storekeeper-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 14.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47687",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "picu – Online Photo Proofing Gallery \u003c= 2.4.0 - Missing Authorization",
    "slug": "picu",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24590",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "NextGen Gallery \u003c= 2.1.10 - Unrestricted File Upload",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9228",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Field Template \u003c= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritping",
    "slug": "custom-field-template",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0653",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Sharebar \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-social-sharebar",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tourfic \u003c= 2.14.5 - Missing Authorization in Multiple Functions",
    "slug": "tourfic",
    "type": "plugin",
    "affected_version": "* - 2.14.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8860",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Icegram \u003c= 3.1.18 - Cross-Site Request Forgery via save_campaign_preview",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 3.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52119",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "illi Link Party! \u003c= 1.0 - Missing Authorization to Unauthenticated Arbitrary Link Deletion",
    "slug": "link-party",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7231",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GamiPress \u003c= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 7.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13495",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Soledad \u003c= 8.5.9 - Unauthenticated Limited Local File Inclusion",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11289",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spotlight \u003c= 4.7 - Cross-Site Scripting",
    "slug": "spotlightyour",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4552",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kudos Donations – Easy donations and payments with Mollie \u003c= 3.2.9 - Reflected Cross-Site Scripting via 'add_query_arg'",
    "slug": "kudos-donations",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11685",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Catalog Importer, Scraper \u0026 Crawler \u003c= 5.1.4 - Unauthenticated PHP Code Injection",
    "slug": "intelligent-importer",
    "type": "plugin",
    "affected_version": "* - 5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8417",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPvivid Backup and Migration \u003c= 0.9.68 - Missing Authorization",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.68",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.68",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1982",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Webba Booking \u003c= 5.1.20 - Missing Authorization",
    "slug": "webba-booking-lite",
    "type": "plugin",
    "affected_version": "* - 5.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54040",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Bannerize Pro \u003c= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-bannerize-pro",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7388",
    "auth_type": "Privileged",
    "cvss_score": 4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP All Export Pro \u003c= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update",
    "slug": "wp-all-export-pro",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7425",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "I Recommend This \u003c= 3.8.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "i-recommend-this",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23673",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soledad \u003c= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8143",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsReady Addons for Elementor \u003c= 6.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "element-ready-lite",
    "type": "plugin",
    "affected_version": "* - 6.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51787",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode Cleaner Lite \u003c= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Export",
    "slug": "shortcode-cleaner-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1481",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Genesis Simple Love \u003c= 2.0 - Unauthenticated PHP Object Injection",
    "slug": "genesis-simple-love",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-49772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49772",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Minimal Coming Soon \u0026 Maintenance Mode \u003c= 2.10 - Missing Authorization",
    "slug": "minimal-coming-soon-maintenance-mode",
    "type": "plugin",
    "affected_version": "[*, 2.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-6168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-6168",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Able Player, accessible HTML5 media player \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter",
    "slug": "ableplayer",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3752",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SparkPost \u003c= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "sparkpost",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23654",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text \u0026 Image Generator \u003c= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "post-saint",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12471",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Subscriptions \u003c 2.6.3 - Stored Cross-Site Scripting",
    "slug": "woocommerce-subscriptions",
    "type": "plugin",
    "affected_version": "[*, 2.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-18834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-18834",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FOX – Currency Switcher Professional for WooCommerce \u003c= 1.4.1.8 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.4.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3734",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Modal Survey \u003c= 2.0.2.0.1 - Unauthenticated SQL Injection",
    "slug": "modal-survey",
    "type": "plugin",
    "affected_version": "* - 2.0.2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39471",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Dashboard Notepad \u003c= 1.42 - Cross-Site Request Forgery",
    "slug": "dashboard-notepad",
    "type": "plugin",
    "affected_version": "* - 1.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57927",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Publitio \u003c= 2.1.8 - Missing Authorization",
    "slug": "publitio",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31798",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Printful Integration for WooCommerce \u003c= 2.2.2 - Cross-Site Request Forgery",
    "slug": "printful-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47168",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Church Donation \u003c= 1.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-church-donation",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13690",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Printcart Web to Print Product Designer for WooCommerce \u003c= 2.4.3 - Missing Authorization",
    "slug": "printcart-integration",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57917",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Better Elementor Addons \u003c= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "better-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34432",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Editor \u003c= 1.2.6.3 - Authenticated (Admin+) SQL injection",
    "slug": "wp-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24151",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Xagio SEO \u003c= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files",
    "slug": "xagio-seo",
    "type": "plugin",
    "affected_version": "* - 7.1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13807",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Font \u003c= 7.5 - Path Traversal",
    "slug": "font",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-7683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7683",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPAdverts \u003c= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpadverts",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48269",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Espresso – Custom Email Template Shortcode \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "email-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32507",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Edit Menu \u003c= 1.5.0 - Cross-Site Request Forgery",
    "slug": "wp-edit-menu",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2275",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "StreamWeasels Twitch Integration \u003c= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "streamweasels-twitch-integration",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7809",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.1 - Cross-Site Request Forgery to Denial of Service",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-7233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7233",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Revision History Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.2",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Revision History Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-5835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Revision History Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.11",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Revision History Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.11",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Revision History Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.8",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Revision History Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.3",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Revision History Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.14",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Revision History Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.14",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Revision History Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.12",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Revision History Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.4",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SEUR Oficial \u003c 1.7.2 - Authenticated Arbitrary File Download",
    "slug": "seur",
    "type": "plugin",
    "affected_version": "[*, 1.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25004",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Mobile Kiosk \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mobile-kiosk",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51829",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup and Staging by WP Time Capsule \u003c= 1.22.6 - Reflected Cross-Site Scripting",
    "slug": "wp-time-capsule",
    "type": "plugin",
    "affected_version": "* - 1.22.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25035",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp Social Login and Register Social Counter \u003c= 3.0.7 - Authentication Bypass via WordPress.com OAuth provider",
    "slug": "wp-social",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9501",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email Users \u003c= 4.8.8 - Arbitrary Settings Update via Cross-Site Request Forgery",
    "slug": "email-users",
    "type": "plugin",
    "affected_version": "* - 4.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1605",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blockspare \u003c= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blockspare",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47495",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VidoRev Extensions \u003c= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Import",
    "slug": "vidorev-extensions",
    "type": "plugin",
    "affected_version": "* - 2.9.9.9.9.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.9.9.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0955",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SAML Single Sign On – SAML SSO Login \u003c 4.8.73 - Cross-Site Scripting",
    "slug": "miniorange-saml-20-single-sign-on",
    "type": "plugin",
    "affected_version": "[*, 4.8.73)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.73",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-12346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12346",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Golo \u003c= 1.7.1 - Reflected Cross-Site Scripting",
    "slug": "golo",
    "type": "theme",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54724",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPQA \u003c 5.9 - Cross-Site Request Forgery",
    "slug": "wpqa",
    "type": "plugin",
    "affected_version": "[*, 5.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-3688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3688",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Xavin's List Subpages \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xavins-list-subpages",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4220",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1503",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Page Builder Lite \u003c= 5.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53823",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woffice \u003c= 5.4.8 - Reflected Cross-Site Scripting",
    "slug": "woffice",
    "type": "theme",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37472",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Forms \u003c= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "* - 6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6842",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Taeggie Feed \u003c= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "taeggie-feed",
    "type": "plugin",
    "affected_version": "* - 0.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11748",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Preloader Plus – WordPress Loading Screen Plugin \u003c= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "preloader-plus",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6849",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme Editor \u003c= 2.8 - Authenticated (Admin+) PHAR Deserialization",
    "slug": "theme-editor",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2440",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "StaticPress \u003c= 0.4.5 - Missing Authorization",
    "slug": "staticpress",
    "type": "plugin",
    "affected_version": "* - 0.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31528",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 5.0.9 - Unauthenticated Information Disclosure",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 5.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39553",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.0 - Cross-Site Request Forgery to PHP Object Injection",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2497",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Coming Soon Landing Page / Holding Page for WordPress \u003c= 3.0 - Authenticated (Susbcriber+) Privilege Escalation",
    "slug": "wordpress-flat-countdown",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-29004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29004",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Analyticator \u003c= 6.4.9.3 - Cross-Site Request Forgery",
    "slug": "google-analyticator",
    "type": "plugin",
    "affected_version": "[*, 6.4.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.9.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-4697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4697",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dynamic Post Grid Elementor Addon \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dynamic-post-grid-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51852",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rock Convert \u003c= 2.10.2 - Reflected Cross-Site Scripting",
    "slug": "rock-convert",
    "type": "plugin",
    "affected_version": "* - 2.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3440",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newspaper \u003c= 12.6.5 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta",
    "slug": "Newspaper",
    "type": "theme",
    "affected_version": "* - 12.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3815",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kadence WooCommerce Email Designer \u003c= 1.5.11 - Cross-Site Request Forgery",
    "slug": "kadence-woocommerce-email-designer",
    "type": "plugin",
    "affected_version": "* - 1.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47186",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cookie Consent \u0026 Autoblock for GDPR/CCPA \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cookie-consent-autoblock",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23501",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anti Hacker \u003c= 4.19 - Missing Authorization to Arbitrary Plugin Install",
    "slug": "antihacker",
    "type": "plugin",
    "affected_version": "* - 4.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3880",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Awesome Filterable Portfolio \u003c 1.9 - Blind SQL Injection",
    "slug": "awesome-filterable-portfolio",
    "type": "plugin",
    "affected_version": "[*, 1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9462",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pixeline's Email Protector \u003c= 1.3.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pixelines-email-protector",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58982",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Calendar \u003c= 3.2.17 - Subscriber+ Reflected Cross-Site Scripting",
    "slug": "my-calendar",
    "type": "plugin",
    "affected_version": "* - 3.2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24927",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2524",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple Anchors Links \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcode",
    "slug": "wp-simple-anchors-links",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9446",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bus Ticket Booking with Seat Reservation \u003c= 5.2.5 - Unauthenticated Cross-Site Scripting",
    "slug": "bus-ticket-booking-with-seat-reservation",
    "type": "plugin",
    "affected_version": "* - 5.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-30496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30496",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The E-Commerce ERP \u003c= 2.1.1.3 - Missing Authorization",
    "slug": "profitori",
    "type": "plugin",
    "affected_version": "* - 2.1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52800",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder \u003c= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "droit-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2252",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Tickera \u003c= 3.4.9.9 - Cross-Site Request Forgery to Plugin Data Deletion \u0026 Settings Changes",
    "slug": "tickera-event-ticketing-system",
    "type": "plugin",
    "affected_version": "* - 3.4.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4549",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Order Delivery \u0026 Pickup Location Date Time ( Free Version ) \u003c= 1.1.0 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "order-delivery-pickup-location-date-time-free-version",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55997",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WOW Best CSS Compiler \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "best-css-compiler",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23588",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Card flip image slideshow \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "card-flip-image-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30983",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart SEO Tool \u003c= 3.0.5 - Reflected Cross-Site Scripting",
    "slug": "smart-seo-tool",
    "type": "plugin",
    "affected_version": "[*, 3.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24976",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FG PrestaShop to WooCommerce \u003c= 4.45.1 - Unauthenticated Sensitive Information Disclosure",
    "slug": "fg-prestashop-to-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.45.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.45.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30511",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Blogger 301 Redirect \u003c= 2.5.3 - Unauthenticated SQL Injection via br",
    "slug": "blogger-301-redirect",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10645",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "moseter \u003c= 1.3.1 - Reflected Cross-Site Scripting",
    "slug": "moseter",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22790",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode IMDB \u003c= 6.0.8 - Authenticated (Administrator+) SQL Injection",
    "slug": "shortcode-imdb",
    "type": "plugin",
    "affected_version": "* - 6.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47432",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Klarna Payments for WooCommerce \u003c= 3.2.4 - Missing Authorization",
    "slug": "klarna-payments-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30477",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Calendar Event Multi View \u003c= 1.3.99 - Reflected Cross-Site Scripting",
    "slug": "cp-multi-view-calendar",
    "type": "plugin",
    "affected_version": "* - 1.3.99",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.99",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24498",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HireHive Job Plugin \u003c= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zartis-job-plugin",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22746",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Order Numbers for WooCommerce \u003c= 1.4.0 - Cross-Site Request Forgery",
    "slug": "custom-order-numbers-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45367",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Print Invoice \u0026 Delivery Notes for WooCommerce \u003c= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletion",
    "slug": "woocommerce-delivery-notes",
    "type": "plugin",
    "affected_version": "* - 5.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12210",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form Store to DB \u003c= 1.1.0 - Stored Cross-Site Scripting",
    "slug": "cf7-store-to-db-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25107",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP URL Shortener \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-url-shortener",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6064",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Geo Controller \u003c= 8.6.4 - Unauthenticated PHP Object Injection via shortcode REST API Route",
    "slug": "cf-geoplugin",
    "type": "plugin",
    "affected_version": "* - 8.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3591",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.9.0 - Reflected Cross-Site Scripting",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24632",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Printcart Web to Print Product Designer for WooCommerce \u003c= 2.4.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "printcart-integration",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24780",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Werk aan de Muur \u003c= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "werk-aan-de-muur",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60131",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Plugins and Themes from Dashboard \u003c= 1.8.7 - Cross-Site Request Forgery",
    "slug": "download-plugins-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7501",
    "auth_type": "Unauth",
    "cvss_score": 4.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Bit Form – Contact Form Plugin \u003c= 2.13.11 - Authenticated (Administrator+) SQL Injection",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.13.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47335",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload for WooCommerce \u003c= 1.1.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "drag-and-drop-multiple-file-upload-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4821",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pliska \u003c= 0.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name",
    "slug": "pliska",
    "type": "theme",
    "affected_version": "* - 0.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33954",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sharebar \u003c= 1.4.2 -  Cross-Site Scripting",
    "slug": "sharebar",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-3491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3491",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Studio \u003c= 2.4.4 - Reflected Cross-Site Scripting",
    "slug": "awesome-studio",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52456",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Open Graph \u003c= 1.11.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "opengraph",
    "type": "plugin",
    "affected_version": "* - 1.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5615",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Login with Cognito \u003c= 1.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "login-with-cognito",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4200",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Quotation \u003c= 1.3.2 - SQL injection",
    "slug": "simple-quotation",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-22735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-22735",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Co-marquage service-public.fr \u003c= 0.5.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "co-marquage-service-public",
    "type": "plugin",
    "affected_version": "* - 0.5.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29908",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Markup \u003c= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-structuring-markup",
    "type": "plugin",
    "affected_version": "* - 4.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4666",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Maker \u003c= 1.16.8 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.16.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4381",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mojo Under Construction \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "mojo-under-construction",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23850",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Open Street Map \u003c= 1.25 - Cross-Site Request Forgery via wp_openstreetmaps",
    "slug": "wp-open-street-map",
    "type": "plugin",
    "affected_version": "* - 1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45645",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Parallax Scrolling Enllax.js \u003c= 0.0.6 - Cross-Site Request Forgery",
    "slug": "parallax-scrolling-enllax-js",
    "type": "plugin",
    "affected_version": "* - 0.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58831",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zotpress \u003c= 7.3.7 - Authenticated (Contributor+) SQL Injection",
    "slug": "zotpress",
    "type": "plugin",
    "affected_version": "* - 7.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30488",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP Photo Effects \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-photo-effects",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10192",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fan Page \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter",
    "slug": "fan-page",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6681",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP2HTML \u003c= 1.0.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp2html",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5930",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor Pro \u003c= 5.4.8 - Unauthenticated Server-Side Request Forgery",
    "slug": "essential-addons-elementor",
    "type": "plugin",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32245",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Activity Log \u003c= 2.4.0 - Multiple Cross-Site Scripting",
    "slug": "aryo-activity-log",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-8729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-8729",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53801",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.44.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.44.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6463",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tabellen von faustball.com \u003c= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "docollipics-faustball-de",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4085",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pods \u003c= 2.4.3 - Multiple Cross-Site Request Forgery",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-7957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7957",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "HT Easy GA4 ( Google Analytics 4 ) \u003c= 1.1.7 - Reflected Cross-Site Scripting",
    "slug": "ht-easy-google-analytics",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FraudLabs Pro for WooCommerce \u003c= 2.22.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "fraudlabs-pro-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.22.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.22.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32659",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Audio Record \u003c= 1.0 - Arbitrary File Upload",
    "slug": "audio-record",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-51792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51792",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Employee Attendance System \u003c= 3.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-employee-attendance-system",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28972",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Zarinpal Paid Downloads \u003c= 2.3 - Reflected Cross-Site Scripting",
    "slug": "zarinpal-paid-downloads",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13543",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) \u003c 4.1.8 - SQL Injection",
    "slug": "gift-voucher",
    "type": "plugin",
    "affected_version": "[*, 4.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-16159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16159",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yoast SEO \u003c= 1.7.3.3 - Cross-Site Request Forgery",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yoast SEO \u003c= 1.7.3.3 - Cross-Site Request Forgery",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "1.6 - 1.6.3",
    "from_version": "1.6",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yoast SEO \u003c= 1.7.3.3 - Cross-Site Request Forgery",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "1.7 - 1.7.3.3",
    "from_version": "1.7",
    "from_inclusive": true,
    "to_version": "1.7.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Automatic Youtube Video Posts Plugin \u003c= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "automatic-youtube-video-posts",
    "type": "plugin",
    "affected_version": "* - 5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49180",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Block Editor Gallery Slider \u003c= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Limited Post Meta Update",
    "slug": "block-editor-gallery-slider",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6726",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Popular Elementor Templates and Widgets \u003c= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6244",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Online Users Stats \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via hk_dataset_results Function",
    "slug": "wp-online-users-stats",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4966",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "integracao-entre-eduzz-e-wc-powers",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3906",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Digitally \u003c= 1.0.8 - Reflected Cross-Site Scripting",
    "slug": "digitally",
    "type": "theme",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49309",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sina Extension for Elementor \u003c= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6228",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyBookProgress by Stormhill Media \u003c= 1.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "mybookprogress",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30982",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Emails \u0026 Newsletters with Jackmail \u003c= 1.2.22 - Authenticated (Subscriber+) CSV Injecton",
    "slug": "jackmail-newsletters",
    "type": "plugin",
    "affected_version": "* - 1.2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46821",
    "auth_type": "Auth",
    "cvss_score": 6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WP-Eggdrop \u003c= 0.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-eggdrop",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2969",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Front End Profile \u003c= 0.2.1 - Stored Cross-Site Scripting",
    "slug": "wp-front-end-profile",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15110",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Consultstreet \u003c= 3.0.0 - Missing Authorization",
    "slug": "consultstreet",
    "type": "theme",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58813",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bg Book Publisher \u003c= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bg-book-publisher",
    "type": "plugin",
    "affected_version": "* - 1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11867",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BigCommerce \u003c= 5.1.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "bigcommerce",
    "type": "plugin",
    "affected_version": "* - 5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49162",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.3 - Directory Traversal",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-0586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0586",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Login Styler – White Label Admin Login Page for WordPress \u003c= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-login-styler",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31344",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Just Writing Statistics \u003c= 5.3 - Missing Authorization",
    "slug": "just-writing-statistics",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30803",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "illi Link Party! \u003c= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "link-party",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7230",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced File Manager \u003c= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "file-manager-advanced",
    "type": "plugin",
    "affected_version": "* - 5.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11391",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 1.5.1 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 1.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2005-1687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2005-1687",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GeoFlickr \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "geoflickr",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54339",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Local Pickup for WooCommerce \u003c= 1.6.1 - Missing Authorization to Notice Dismissal",
    "slug": "advanced-local-pickup-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32814",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ElementsReady Addons for Elementor \u003c= 6.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "element-ready-lite",
    "type": "plugin",
    "affected_version": "* - 6.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47329",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Automatic Ban IP \u003c= 1.0.7 - Reflected Cross-Site Scripting",
    "slug": "automatic-ban-ip",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32632",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shiptimize for WooCommerce \u003c= 3.1.86 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "shiptimize-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.1.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31802",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4 - Brute Force Password Recovery Tokens",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-6412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6412",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Custom Post Type UI \u003c= 1.13.4 - Cross-Site Request Forgery to Sensitive Information Exposure",
    "slug": "custom-post-type-ui",
    "type": "plugin",
    "affected_version": "* - 1.13.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1623",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "404like \u003c= 1.0 - SQL Injection",
    "slug": "404like",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-10009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10009",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "loader-utils (JS package) \u003c 3.2.1 - Regular Expression Denial of Service",
    "slug": "simple-page-ordering",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-37599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37599",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "loader-utils (JS package) \u003c 3.2.1 - Regular Expression Denial of Service",
    "slug": "restricted-site-access",
    "type": "plugin",
    "affected_version": "* - 7.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.4",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-37599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37599",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "loader-utils (JS package) \u003c 3.2.1 - Regular Expression Denial of Service",
    "slug": "elasticpress",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-37599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37599",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "loader-utils (JS package) \u003c 3.2.1 - Regular Expression Denial of Service",
    "slug": "insert-special-characters",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-37599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37599",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "EELV Newsletter \u003c= 3.3.0 - Reflected Cross-Site Scripting",
    "slug": "eelv-newsletter",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-10028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-10028",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel Gutenberg Blocks \u003c= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-travel-blocks",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47627",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exports and Reports \u003c= 0.9.1 - CSV Injection",
    "slug": "exports-and-reports",
    "type": "plugin",
    "affected_version": "* - 0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1539",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Marketer Addons \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "marketer-addons",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31730",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integrate Google Drive \u003c= 1.3.3 - Missing Authorization via save_settings",
    "slug": "integrate-google-drive",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52177",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.13 - Cross-Site Request Forgery to Settings Update in optimizeAllOn",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1336",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JoomSport \u003c= 5.6.3 - Missing Authorization",
    "slug": "joomsport-sports-league-results-management",
    "type": "plugin",
    "affected_version": "* - 5.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44031",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.1 - Full Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-0195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0195",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JobSearch WP Job Board \u003c= 2.9.2 - Authentication Bypass via Social Logins",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11917",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Freemind Viewer \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-freemind",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5536",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hello in All Languages \u003c= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "hello-in-all-languages",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12572",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UDesign \u003c= 4.7.3 - Reflected Cross-Site Scripting",
    "slug": "u-design",
    "type": "theme",
    "affected_version": "* - 4.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4077",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Social SEO Booster – Knowledge Graph Social Signals SEO \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-social-seo-booster",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27348",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Panda Video \u003c= 1.4.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "pandavideo",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5456",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Icegram \u003c= 3.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 3.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51532",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recent Backups \u003c= 0.7 - Directory Traversal",
    "slug": "recent-backups",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-1000006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000006",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Like Button Rating \u003c= 2.6.53 - Cross-Site Request Forgery",
    "slug": "likebtn-like-button",
    "type": "plugin",
    "affected_version": "* - 2.6.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44064",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration, Login \u0026 Landing Pages  \u003c= 1.2.7 - Admin+ Stored Cross-Site Scripting",
    "slug": "custom-landing-pages-leadmagic",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0232",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.22 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31278",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "DobsonDev Shortcodes \u003c= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dobsondev-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31754",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail Baby SMTP \u003c= 2.8 - Cross-Site Request Forgery",
    "slug": "mail-baby-smtp",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57992",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cyr to Lat \u003c= 3.5 - Authenticated SQL Injection",
    "slug": "cyr3lat",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4290",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Web Stories \u003c= 1.24.0 - Server Side Request Forgery",
    "slug": "web-stories",
    "type": "plugin",
    "affected_version": "* - 1.24.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3708",
    "auth_type": "Auth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0380",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCS – WordPress Currency Switcher Professional \u003c= 1.1.9 - Missing Authorization to Custom Drop-Down Currency Switcher Creation",
    "slug": "currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2555",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BA Book Everything \u003c= 1.6.20 - Reflected Cross-Site Scripting",
    "slug": "ba-book-everything",
    "type": "plugin",
    "affected_version": "* - 1.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47360",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinterest Automatic \u003c= 4.14.3 - Unuathenticated Arbitrary Options Update",
    "slug": "wp-pinterest-automatic",
    "type": "plugin",
    "affected_version": "* - 4.14.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-4380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4380",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NextGEN Gallery Voting \u003c= 2.7.6 - Reflected Cross-Site Scripting",
    "slug": "nextgen-gallery-voting",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28869",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AccessPress Social Icons \u003c= 1.8.0 - Author+ SQL Injection",
    "slug": "accesspress-social-icons",
    "type": "plugin",
    "affected_version": "[*, 1.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24143",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Tickets with Ticket Scanner \u003c= 2.3.11 - Authenticated (Author+) Remote Code Execution",
    "slug": "event-tickets-with-ticket-scanner",
    "type": "plugin",
    "affected_version": "* - 2.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52427",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NextGen GalleryView \u003c= 0.5.5 - Cross-Site Request Forgery",
    "slug": "wordpress-nextgen-galleryview",
    "type": "plugin",
    "affected_version": "* - 0.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34185",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 3.8.3 - Cross-Site Request Forgery",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25472",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zita Site Builder \u003c= 1.0.2 - Missing Authorization to Arbitrary Plugin Installation",
    "slug": "ai-site-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54369",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Business Directory Pro \u003c= 15.4.8 - Unauthenticated Privilege Escalation",
    "slug": "simple-business-directory-pro",
    "type": "plugin",
    "affected_version": "* - 15.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.4.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31918",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wheel of Life \u003c= 1.1.8 - Missing Authorization",
    "slug": "wheel-of-life",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47311",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "World Cup Predictor \u003c= 1.9.6 - Reflected Cross-Site Scripting",
    "slug": "world-cup-predictor",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22794",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "e2pdf \u003c= 1.25.05 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "e2pdf",
    "type": "plugin",
    "affected_version": "* - 1.25.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43318",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Toocheke Companion \u003c= 1.166 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "toocheke-companion",
    "type": "plugin",
    "affected_version": "* - 1.166",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.166",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23992",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Media Share Buttons | MashShare \u003c= 4.0.47 - Missing Authorization",
    "slug": "mashsharer",
    "type": "plugin",
    "affected_version": "* - 4.0.47",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.47",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22319",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "If-So Dynamic Content Personalization \u003c= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "if-so",
    "type": "plugin",
    "affected_version": "* - 1.9.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49875",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Typing Text \u003c= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "typing-text",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22315",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Calameo \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-calameo",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29098",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP EasyCart \u003c= 5.4.8 - Cross-Site Request Forgery via process_deactivate_product",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2893",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Motors \u003c= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover",
    "slug": "motors",
    "type": "theme",
    "affected_version": "* - 5.6.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.67",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4322",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Plugin: Newsletter \u003c= 1.5 - Arbitrary File Read",
    "slug": "plugin-newsletter",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-3588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3588",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PictPress \u003c= 0.91 - Directory Traversal",
    "slug": "pictpress",
    "type": "plugin",
    "affected_version": "* - 0.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.91",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-6369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-6369",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Bitcoin Lightning Publisher for WordPress \u003c= 1.4.1 - Reflected Cross-Site Scripting",
    "slug": "bitcoin-lightning-publisher",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12100",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Z-URL Preview \u003c= 1.6.2 - Cross-Site Scripting",
    "slug": "z-url-preview",
    "type": "plugin",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18012",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form, Drag and Drop Form Builder Plugin \u003c= 4.8.5 - Missing Authorization",
    "slug": "liveforms",
    "type": "plugin",
    "affected_version": "* - 4.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32279",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AuthorSure \u003c= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "authorsure",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57979",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.2.11 - Cross-Site Request Forgery",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31113",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Doccure \u003c= 1.4.8 - Unauthenticated Arbitrary File Upload",
    "slug": "doccure",
    "type": "theme",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-9113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9113",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPForms User Registration \u003c= 2.1.0 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation",
    "slug": "wpforms-user-registration",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-52209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52209",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Additional Order Filters for WooCommerce \u003c= 1.11 - Reflected Cross-Site Scripting",
    "slug": "additional-order-filters-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47690",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON (Pro) \u003c= 4.9.9 - Missing Authorization",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47564",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.3.17 - Cross-Site Scripting via begin_date, end_date, or form_id Parameter",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.3.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-19287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19287",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nictitate \u003c= 1.1.4 - Cross-Site Request Forgery",
    "slug": "nictitate",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31096",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Comic Book Management System \u003c 2.2.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "comicbookmanagementsystemweeklypicks",
    "type": "plugin",
    "affected_version": "[*, 2.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-3856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3856",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "RegistrationMagic \u003c= 5.2.2.6 - Cross-Site Request Forgery",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47645",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ActiveCampaign \u003c= 8.1.14 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "activecampaign-subscription-forms",
    "type": "plugin",
    "affected_version": "* - 8.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32430",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ui Slider Filter By Price \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "ui-slider-filter-by-price",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23555",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "2.8",
    "from_version": "2.8",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "3.0",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "3.9",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "4.9 - 4.9.1",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "5.1",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "5.5",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "4.5 - 4.5.2",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "4.8",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "5.3 - 5.3.1",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "2.7 - 2.7.1",
    "from_version": "2.7",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "2.9",
    "from_version": "2.9",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "3.3",
    "from_version": "3.3",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "4.1",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "4.3",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "* - 2.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "3.5",
    "from_version": "3.5",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "3.6",
    "from_version": "3.6",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "4.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "4.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "5.0",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "3.1",
    "from_version": "3.1",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "4.0",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "5.4",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "3.4",
    "from_version": "3.4",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "3.8",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "4.2",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "3.7 - 3.7.1",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "2.6 - 2.6.1",
    "from_version": "2.6",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "3.2",
    "from_version": "3.2",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "4.4 - 4.4.2",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Blocks \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "5.2",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32789",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bug Library \u003c= 2.1 - Unauthenticated Arbitrary File Upload",
    "slug": "bug-library",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5450",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Google Feed Manager \u003c= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Feed Actions",
    "slug": "wp-product-feed-manager",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7258",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GiveWP - Donation Plugin and Fundraising Platform \u003c= 2.5.0 - SQL Injection",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-13578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13578",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Charity Addon for Elementor \u003c= 1.3.3 - Authenticated (Contributor+) Post Disclosure",
    "slug": "charity-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12062",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Front-end login and register \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-front-end-login-and-register",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23540",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maspik \u003c= 2.5.6 - Cross-Site Request Forgery",
    "slug": "contact-forms-anti-spam",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Debug Log Manager \u003c= 2.3.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "debug-log-manager",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3809",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPAMS \u003c= 44.0 - Unauthenticated Local File Inclusion",
    "slug": "apartment-management",
    "type": "plugin",
    "affected_version": "[*, 44.0 (17-08-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "44.0 (17-08-2023)",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39406",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post/Page Copying Tool  to Export and Import post/page for Cross site Migration \u003c= 2.0.3 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "postpage-import-export-with-custom-fields-taxonomies",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24677",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CF7 Spreadsheets \u003c= 2.3.2 - Reflected Cross-Site Scripting",
    "slug": "cf7-spreadsheets",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31536",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Import – Ultimate CSV XML Importer for WordPress \u003c= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 7.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10040",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WishList Member X \u003c= 3.25.1 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wishlist-member-x",
    "type": "plugin",
    "affected_version": "* - 3.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37107",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tag",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2787",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.6.9 - Cross-Site Scripting via field label",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25056",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Firelight Lightbox \u003c= 2.3.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-fancybox",
    "type": "plugin",
    "affected_version": "* - 2.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3597",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tickera \u003c= 3.5.5.6 - Cross-Site Request Forgery",
    "slug": "tickera-event-ticketing-system",
    "type": "plugin",
    "affected_version": "* - 3.5.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58611",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Subscription Forms \u003c= 1.2.4 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-subscription-forms",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32692",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 3.5.1 - Denial of Service via wp-postpass cookie",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-2173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Easy Forms for MailChimp \u003c= 6.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yikes-inc-easy-mailchimp-extender",
    "type": "plugin",
    "affected_version": "* - 6.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1325",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Viable blog \u003c= 1.1.4 - Cross-Site Scripting",
    "slug": "viable-blog",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27419",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LeagueManager \u003c 3.8.1 - SQL Injection",
    "slug": "leaguemanager",
    "type": "plugin",
    "affected_version": "[*, 3.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-1852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1852",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sheet to Table Live Sync for Google Sheet \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via STWT_Sheet_Table Shortcode",
    "slug": "sheet-to-wp-table-for-google-sheet",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6532",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ni WooCommerce Sales Report Email \u003c= 3.1.4 - Reflected Cross-Site Scripting",
    "slug": "ni-woocommerce-sales-report-email",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23481",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tournament Bracket Generator \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via bracket Shortcode",
    "slug": "tournament-bracket-generator",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6290",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SagePay Server Gateway for WooCommerce \u003c 1.0.9 - Cross-Site Scripting",
    "slug": "sagepay-server-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5316",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3553",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "APK Downloader \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross Site Scripting",
    "slug": "apk-downloader",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Repeater \u003c= 1.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "content-repeater",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44632",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conversios.io - Google Analytics and Google Shopping plugin for WooCommerce \u003c= 4.6.1 Authenticated SQL Injection",
    "slug": "enhanced-e-commerce-for-woocommerce-store",
    "type": "plugin",
    "affected_version": "[*, 4.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24952",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content – ProfilePress \u003c= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox'",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3210",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Name Directory \u003c= 1.25.2 - Cross-Site Scripting",
    "slug": "name-directory",
    "type": "plugin",
    "affected_version": "* - 1.25.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2072",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qi Addons For Elementor \u003c= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "qi-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13699",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial \u003c 2.3 - Cross-Site Request Forgery",
    "slug": "indianic-testimonial",
    "type": "plugin",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-5672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5672",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced WordPress Reset \u003c= 1.5 - Reflected Cross-Site Scripting",
    "slug": "advanced-wp-reset",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2181",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RomethemeForm For Elementor \u003c= 1.1.2 - Missing Authorization",
    "slug": "romethemeform",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32727",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site \u003c= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kredeum-nfts",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11876",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Ninja Forms Product Add-ons \u003c= 1.7.0 - Unauthenticated Arbitrary File Upload",
    "slug": "woocommerce-ninjaforms-product-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5601",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Checkout Mestres WP \u003c= 7.1.9.6 - Authentication Bypass via Password Reset",
    "slug": "checkout-mestres-wp",
    "type": "plugin",
    "affected_version": "* - 7.1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.9.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51472",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP TripAdvisor Review Slider  \u003c= 11.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-tripadvisor-review-slider",
    "type": "plugin",
    "affected_version": "* - 11.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6037",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Portfolio Post \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "themify-portfolio-post",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0362",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TFO Graphviz \u003c= 1.9 - Reflected Cross-Site Scripting",
    "slug": "tfo-graphviz",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10131",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder \u003c= 2.8.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.8.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GEO my WordPress \u003c= 4.1 - Cross-Site Request Forgery",
    "slug": "geo-my-wp",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32097",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Motors – Car Dealership \u0026 Classified Listings Plugin \u003c= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.63",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.63",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2808",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Meta Data and Taxonomies Filter (MDTF) \u003c= 1.3.3.2 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-34434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34434",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "WooCommerce myghpay Payment Gateway \u003c= 3.0 Reflected Cross-Site Scripting",
    "slug": "woo-myghpay-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39308",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget4Call \u003c= 1.0.7 - Reflected Cross-Site Scripting",
    "slug": "widget4call",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13099",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ads by datafeedr.com \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ads-by-datafeedrcom",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49169",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ENL Newsletter \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "enl-newsletter",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3058",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 reCAPTCHA \u003c= 1.2.0 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']",
    "slug": "contact-form-7-recaptcha",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8280",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4698",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Contest \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-contest",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23538",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGYM - Wordpress Gym Management System \u003c= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update",
    "slug": "gym-management",
    "type": "plugin",
    "affected_version": "* - 67.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "67.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3671",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery – Image and Video Gallery with Thumbnails \u003c= 2.0.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "gallery-album",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-35750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35750",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Devnex Addons For Elementor \u003c= 1.0.9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "devnex-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53339",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "New User Approve \u003c= 2.4 - Cross-Site Request Forgery",
    "slug": "new-user-approve",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1625",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form by Bit Form \u003c= 2.17.5 - Unauthenticated Sensitive Information Exposure",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.17.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13451",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Headmaster \u003c= 0.3 - Reflected Cross-Site Scripting",
    "slug": "wp-headmaster",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22755",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Head, Footer and Post Injections \u003c= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments",
    "slug": "header-footer",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13900",
    "auth_type": "Privileged",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Viral Signup \u003c= 2.1 - Unauthenticated SQL Injection",
    "slug": "viral-signup",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6926",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "RSFirewall! \u003c= 1.1.24 - IP Address Spoofing",
    "slug": "rsfirewall",
    "type": "plugin",
    "affected_version": "* - 1.1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4226",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Clean Up \u003c= 1.2.3 - Cross-Site Request Forgery via wp_clean_up_optimize",
    "slug": "wp-clean-up",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25034",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Open Close WooCommerce Store \u003c= 4.9.5 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "woc-open-close",
    "type": "plugin",
    "affected_version": "* - 4.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47649",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NewsBlogger \u003c= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation",
    "slug": "newsblogger",
    "type": "theme",
    "affected_version": "* - 0.2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1305",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Magic the Gathering Card Tooltips \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magic-the-gathering-card-tooltips",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24704",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Testimonials Showcase \u003c= 1.1.6 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "simple-testimonials-showcase",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49295",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login Redirect \u003c= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "login-redirect",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30575",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBakery Page Builder \u003c= 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5265",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Planet \u003c= 0.1 - Reflected Cross-Site Scripting",
    "slug": "wp-planet",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4592",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Parcel Pro \u003c= 1.6.11 - Open Redirect via 'redirect'",
    "slug": "woo-parcel-pro",
    "type": "plugin",
    "affected_version": "* - 1.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46624",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Real Estate Manager Pro \u003c= 12.7.3 - Reflected Cross-Site Scripting",
    "slug": "real-estate-manager-pro",
    "type": "plugin",
    "affected_version": "* - 12.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54032",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sensei LMS \u003c= 4.5.1 -  Missing Authorization",
    "slug": "sensei-lms",
    "type": "plugin",
    "affected_version": "* - 4.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2080",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Taxi Booking Manager for WooCommerce – WordPress plugin | Ecab \u003c= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ecab-taxi-booking-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43986",
    "auth_type": "Privileged",
    "cvss_score": 4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SaasPricing \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "saaspricing",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56231",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JSFiddle Shortcode \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "jsfiddle-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Missing Authorization to Product Deletion",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4924",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Paytium \u003c= 4.3.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4042",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soledad \u003c= 8.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59589",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget Options \u003c= 4.0.6.1 - Missing Authorization",
    "slug": "widget-options",
    "type": "plugin",
    "affected_version": "* - 4.0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56219",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GTG Product Feed for Shopping \u003c= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update",
    "slug": "gg-woo-feed",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6638",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Form Vibes \u003c= 1.4.5 - Authenticated (Admininstrator+) SQL Injection",
    "slug": "form-vibes",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3764",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Processing Embed \u003c= 0.5.1 - Cross-Site Scripting",
    "slug": "wordpress-processing-embed",
    "type": "plugin",
    "affected_version": "* - 0.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2010-4747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4747",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Forms for Mailchimp \u003c= 6.8.5 - Reflected Cross-Site Scripting",
    "slug": "yikes-inc-easy-mailchimp-extender",
    "type": "plugin",
    "affected_version": "[*, 6.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24985",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Verge3D \u003c= 4.9.4 - Missing Authorization",
    "slug": "verge3d",
    "type": "plugin",
    "affected_version": "* - 4.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49268",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quotes Collection \u003c= 2.5.2 - Authenticated (Admin+) SQL Injection",
    "slug": "quotes-collection",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24861",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-DownloadManager plugin \u003c= 1.68.6 -  Stored Cross-Site Scripting",
    "slug": "wp-downloadmanager",
    "type": "plugin",
    "affected_version": "[*, 1.68.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.68.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-25605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25605",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Find and Replace \u003c= 1.3.5 - Admin+ SQL Injection",
    "slug": "real-time-auto-find-and-replace",
    "type": "plugin",
    "affected_version": "[*, 1.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1472",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Peach Payments Gateway \u003c= 3.1.9 - Missing Authorization via peach_core_version_rollback()",
    "slug": "wc-peach-payments-gateway",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25922",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.8.25 - Missing Authorization to Notice Dismissal",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35628",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Age Verify \u003c= 1.8.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "easy-age-verify",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35757",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpCentral \u003c= 1.5.0 - Improper Access Control to Privilege Escalation",
    "slug": "wp-central",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-9043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9043",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Recall Products \u003c= 0.8 - Authenticated SQL Injection",
    "slug": "recall-products",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-25379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25379",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cross-RSS \u003c= 1.7 - Path Traversal",
    "slug": "cross-rss",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4941",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GreenMart – Organic \u0026 Food WooCommerce WordPress Theme \u003c 2.4.3 - Reflected Cross-Site Scripting",
    "slug": "greenmart",
    "type": "theme",
    "affected_version": "[*, 2.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-16140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-16140",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Free WooCommerce Theme 99fy Extension \u003c= 1.2.7 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation",
    "slug": "99fy-core",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0503",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Polls CP \u003c= 1.0.1 - Authenticated SQL Injection",
    "slug": "cp-polls",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-125091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-125091",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.43",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3667",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "eShop \u003c= 6.3.11 - Cross-Site Scripting",
    "slug": "eshop",
    "type": "plugin",
    "affected_version": "[*, 6.3.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-3421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3421",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SAHU TikTok Pixel for E-Commerce \u003c= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sahu-tiktok-pixel",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46642",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPFunnels \u003c= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpfunnels",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27965",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cost Calculator \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nd-projects",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1155",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Student Result or Employee Database \u003c= 1.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "simple-student-result",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2312",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Brands \u003c= 1.6.49 - Cross-Site Request Forgery",
    "slug": "woocommerce-brands",
    "type": "plugin",
    "affected_version": "* - 1.6.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.49",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35880",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Pipes \u003c= 1.4.3 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47664",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "pagebar \u003c= 2.65 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting",
    "slug": "pagebar",
    "type": "plugin",
    "affected_version": "* - 2.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.65",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1757",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YITH WooCommerce Tab Manager \u003c= 1.35.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "yith-woocommerce-tab-manager",
    "type": "plugin",
    "affected_version": "* - 1.35.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.35.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35698",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AT Internet SmartTag \u003c= 0.2 - Reflected Cross-Site Scripting",
    "slug": "at-internet",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32506",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swift Framework \u003c 2024.04.30 Authenticated (Contributor+) Stored Cross-Site Scripting via Caption Title",
    "slug": "socialdriver-framework",
    "type": "plugin",
    "affected_version": "[*, 2024.04.30)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.04.30",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-2872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2872",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BA Book Everything \u003c= 1.6.20 - Unauthenticated Arbitrary User Password Reset",
    "slug": "ba-book-everything",
    "type": "plugin",
    "affected_version": "* - 1.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8794",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net \u003c= 1.117.5 - Authenticated (Contributor+) SQL Injection via order_by Parameter",
    "slug": "peachpay-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.117.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.117.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9463",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Structured Content \u003c= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "structured-content",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30918",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Defender Security \u003c= 4.1.0 - Sensitive Information Exposure via Log File",
    "slug": "defender-security",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51490",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WF Cookie Consent \u003c= 1.1.3 - Cross-Site Scripting",
    "slug": "wf-cookie-consent",
    "type": "plugin",
    "affected_version": "[*, 1.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-10371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10371",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce – Store Exporter \u003c= 2.7.4 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-exporter",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32539",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conversios – Google Analytics 4 (GA4), Meta Pixel \u0026 more Via Google Tag Manager For WooCommerce \u003c= 7.0.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "enhanced-e-commerce-for-woocommerce-store",
    "type": "plugin",
    "affected_version": "* - 7.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1203",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hotjar Connecticator \u003c= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "hotjar-connecticator",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24301",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form With Captcha \u003c= 1.6.8 - Cross-Site Request Forgery",
    "slug": "contact-form-with-captcha",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45771",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Betheme \u003c= 28.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_title'",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 28.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "28.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9371",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Primer MyData for Woocommerce \u003c 4.2.4 - Reflected Cross-Site Scripting",
    "slug": "primer-mydata",
    "type": "plugin",
    "affected_version": "[*, 4.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-30924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30924",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Download Manager \u003c= 2.8.5 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "cm-download-manager",
    "type": "plugin",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3076",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Intro Tour Tutorial DeepPresentation \u003c= 6.5.2 - Reflected Cross-Site Scripting",
    "slug": "dp-intro-tours",
    "type": "plugin",
    "affected_version": "* - 6.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11466",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TradeMe widgets \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "trademe-widget",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51613",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sell Media \u003c= 2.4.1 - Cross-Site Scripting",
    "slug": "sell-media",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-6112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6112",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiParcels Shipping For WooCommerce \u003c= 1.15.3 - Reflected Cross-Site Scripting",
    "slug": "multiparcels-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.15.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3954",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Feed \u003c= 6.5.1 - Missing Authorization via hide_free_sidebar()",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 6.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48740",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BookingPress \u003c= 1.0.64 - Unauthenticated Sensitive Information Exposure",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.64",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.64",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36507",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Klaviyo \u003c= 3.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "klaviyo",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0874",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Feed Gallery \u003c= 2.4.7 - Cross-Site Request Forgery",
    "slug": "insta-gallery",
    "type": "plugin",
    "affected_version": "[*, 2.4.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15779",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RSVPMarker  \u003c= 11.5.6 - Authenticated (Contributor+) SQL Injection",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 11.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48278",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CPT – Speakers \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cpt-speakers",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25977",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Vertical Timeline \u003c= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-vertical-timeline",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23856",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Themer \u003c= 1.4.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "beaver-themer",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6694",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Code Generator Pro \u003c= 1.2 - Unauthenticated SQL Injection",
    "slug": "code-generator-pro",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-55978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55978",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AutoListicle: Automatically Update Numbered List Articles \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "autolisticle-automatically-update-numbered-list-articles",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11426",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "* - 4.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-46859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46859",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.4.37.727 - Authenticated Stored Cross-Site Scripting",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.4.37.727",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.37.727",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-35748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35748",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Human Resource Management Plugin \u003c 2.2.6 - Authorization Bypass",
    "slug": "hrm",
    "type": "plugin",
    "affected_version": "[*, 2.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-9573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9573",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Multiple Page Generator Plugin – MPG \u003c= 3.4.0 - Missing Authorization via mpg_get_log_by_project_id",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30235",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Responsive Vertical Icon Menu \u003c= 1.5.8 - Cross-Site Request Forgery",
    "slug": "wpdevart-vertical-menu",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23983",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.12.21 - CSV Injection",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "[*, 1.12.22)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.22",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-10504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10504",
    "auth_type": "Unauth",
    "cvss_score": 7.8,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EPay.bg Payments \u003c= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "epaybg-payments",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7653",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kiwi Social Sharing 2.1.0 - 2.1.2 - Arbitrary Options Change",
    "slug": "kiwi-social-share",
    "type": "plugin",
    "affected_version": "2.1.0 - 2.1.2",
    "from_version": "2.1.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-4362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4362",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Serial Numbers for WooCommerce – License Manager \u003c= 2.1.0 - Missing Authorization",
    "slug": "wc-serial-numbers",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Notification for Telegram \u003c= 3.4.6 - Cross-Site Request Forgery",
    "slug": "notification-for-telegram",
    "type": "plugin",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58794",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Global Meta Keyword \u0026 Description \u003c= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "global-meta-keyword-and-description",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26550",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify – WooCommerce Product Filter \u003c= 1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "themify-wc-product-filter",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44046",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.14.0 - Unauthenticated Local File Inclusion",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-37888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37888",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Finance \u003c= 1.3.6 - Reflected Cross-Site Scripting",
    "slug": "wp-finance",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13097",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Open User Map \u003c= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "open-user-map",
    "type": "plugin",
    "affected_version": "* - 1.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57953",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Email Verification for WooCommerce \u003c= 3.5.0 - Authentication Bypass",
    "slug": "woo-confirmation-email",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2781",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Check \u0026 Log Email \u003c= 0.5.1 - Reflected Cross-Site Scripting",
    "slug": "check-email",
    "type": "plugin",
    "affected_version": "[*, 0.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10934",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Login History Plugin \u003c= 1.5.2 - Cross-Site Scripting",
    "slug": "user-login-history",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-15867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-15867",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4383",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tainacan \u003c= 0.21.12 - Authenticated (Subscriber+) SQL Injection",
    "slug": "tainacan",
    "type": "plugin",
    "affected_version": "* - 0.21.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.21.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13236",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "iCalendrier \u003c= 1.80 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "icalendrier",
    "type": "plugin",
    "affected_version": "* - 1.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.80",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29912",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Author Showcase \u003c= 1.4.3 - Reflected Cross-Site Scripting",
    "slug": "author-showcase",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23443",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Photo Reviews Premium \u003c= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation",
    "slug": "woocommerce-photo-reviews",
    "type": "plugin",
    "affected_version": "* - 1.3.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.13.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8277",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yoo Slider plugin \u003c= 2.0.0 - Stored Cross-Site Scripting",
    "slug": "yoo-slider",
    "type": "plugin",
    "affected_version": "[*, 2.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-25609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25609",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Wand \u003c= 1.2.5 - Missing Authorization",
    "slug": "ai-content-generation",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22302",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HTML2WP \u003c= 1.0.0 - Arbitrary File Upload",
    "slug": "html2wp",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1574",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP To Do \u003c= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Task Comments",
    "slug": "wp-todo",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3944",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Gallery with Slideshow Plugin \u003c= 1.5.2 - Stored Cross-Site Scripting",
    "slug": "image-gallery-with-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-1002011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002011",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Price Calculator \u003c= 1.3 - Missing Authorization",
    "slug": "simple-price-calculator-basic",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58872",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.4.1 \u0026 WOLF \u003c= 1.0.8.1 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31430",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.4.1 \u0026 WOLF \u003c= 1.0.8.1 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31430",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All-in-One Addons for Elementor – WidgetKit \u003c= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates",
    "slug": "widgetkit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10321",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP-Table Reloaded \u003c= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-table-reloaded",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4491",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gestpay for WooCommerce \u003c= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_set_default_card",
    "slug": "gestpay-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 20221130",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20221130",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0431",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Hotel Booking \u003c= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-hotel",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57938",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BBP Core – Expand bbPress powered forums with useful features \u003c= 1.2.5 - Reflected Cross-Site Scripting via add_query_arg Parameter",
    "slug": "bbp-core",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9896",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.4 - Incorrect Authorization to Information Exposure",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1387",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Property Listings \u003c= 3.5.3 - Missing Authorization via epl_update_listing_coordinates()",
    "slug": "easy-property-listings",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32799",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Photo Gallery – Image Gallery \u003c= 2.0.4 - Reflected Cross-Site Scripting",
    "slug": "photo-image-gallery",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27291",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support – WordPress HelpDesk \u0026 Support Plugin \u003c= 6.0.6 - Reflected Cross-Site Scripting",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36919",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 13.1.0.9 - Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 13.1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45848",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Round Robin Lead Distribution \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "contact-form-7-round-robin-lead-distribution",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23812",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-DBManager \u003c 2.72 - Command Injection",
    "slug": "wp-dbmanager",
    "type": "plugin",
    "affected_version": "[*, 2.72)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.72",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-8335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8335",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bridge Core \u003c= 3.0.9 - Reflected Cross-Site Scripting",
    "slug": "bridge-core",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40333",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chameleon \u003c= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chameleon",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44736",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Car Repair Services \u0026 Auto Mechanic \u003c 4.0 - Reflected Cross-Site Scripting",
    "slug": "car-repair-service",
    "type": "theme",
    "affected_version": "[*, 4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24335",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nested Pages \u003c= 3.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-nested-pages",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49195",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RankMath SEO \u003c= 1.0.107.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.107.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.107.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23888",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "* - 3.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Directory Plugin \u003c 5.11 - Cross-Site Request Forgery",
    "slug": "business-directory-plugin",
    "type": "plugin",
    "affected_version": "* - 5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24178",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ad Inserter \u003c= 2.4.19 - Authenticated Path Traversal",
    "slug": "ad-inserter",
    "type": "plugin",
    "affected_version": "* - 2.4.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15323",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.38.10 - Improper Authorization via submit_review",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.38.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.38.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1044",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 2.7.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2735",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Content Filter – Censor All Offensive Content From Your Site \u003c= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-content-filter",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23883",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Google reCaptcha \u003c= 1.27 - Built-in Math CAPTCHA Bypass",
    "slug": "advanced-google-recaptcha",
    "type": "plugin",
    "affected_version": "* - 1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1262",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OceanWP \u003c= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag",
    "slug": "oceanwp",
    "type": "theme",
    "affected_version": "* - 4.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5524",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tiger \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "tiger",
    "type": "theme",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exquisite PayPal Donation \u003c= v2.0.0 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "exquisite-paypal-donation",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23785",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MojoPlug Slide Panel \u003c= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mojoplug-slide-panel",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23807",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Toolkit for LearnDash \u003c= 3.7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "uncanny-learndash-toolkit",
    "type": "plugin",
    "affected_version": "* - 3.7.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48080",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Medical Addon for Elementor \u003c= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter Widget",
    "slug": "medical-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8212",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid  \u003c= 5.9.5.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49876",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Chatbot for WordPress by Collect.chat ⚡️ \u003c= 2.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "collectchat",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6498",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Warranty Requests \u003c= 2.1.9 - Missing Authorization",
    "slug": "woocommerce-warranty",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37870",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Dot html,php,xml etc pages \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "dot-htmlphpxml-etc-pages",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48112",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u0026 WordPress MU \u003c 2.8.1 - Full Path Disclosure",
    "slug": "wpmu",
    "type": "core",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-2432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2432",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u0026 WordPress MU \u003c 2.8.1 - Full Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-2432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2432",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Live Chat with Facebook Messenger \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-facebook-messenger",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5740",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Help Desk \u003c= 2.9.2 - Unauthenticated Arbitrary File Deletion",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30878",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Hotel Booking \u003c 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nd-booking",
    "type": "plugin",
    "affected_version": "[*, 3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-29443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPZOOM Shortcodes \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "wpzoom-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22162",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Funnel Builder \u003c= 1.3.0 - Arbitrary Plugin Activation",
    "slug": "cartflows",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-25151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25151",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Import WP – Import and Export WordPress data to XML or CSV files \u003c= 2.4.5 - Authenticated Arbitrary File Upload",
    "slug": "jc-importer",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1273",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wpPricing Builder \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wppricing-builder-lite-responsive-pricing-table-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49225",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crazy Bone \u003c= 0.6.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "crazy-bone",
    "type": "plugin",
    "affected_version": "* - 0.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0385",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Absolute Links \u003c= 1.1.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "absolute-links",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-43833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-43833",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "wp_automatic_widget \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-automatic-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51876",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FAQ Builder AYS \u003c= 1.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "faq-builder-ays",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24722",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Maker \u003c= 1.16.10 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.16.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3690",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XML Sitemap Generator for Google \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "www-xml-sitemap-generator-org",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0346",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Wp Brand – Hide menu \u0026 Hide Plugin \u003c= 1.1.2 - Missing Authorization",
    "slug": "my-wp-brand",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49694",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Superio - Job Board \u003c= 1.2.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "superio",
    "type": "theme",
    "affected_version": "* - 1.2.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4114",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Offline Or Coming Soon Or Maintenance Mode \u003c= 1.4.2 - Cross-Site Request Forgery and Cross-Site Scripting",
    "slug": "site-offline",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35773",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N"
  },
  {
    "title": "WP EXtra \u003c= 6.2 - Missing Authorization to Export Settings",
    "slug": "wp-extra",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46212",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ultimate Addons for Contact Form 7 \u003c= 3.1.23 - Unauthenticated SQL Injection via form_id",
    "slug": "ultimate-addons-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 3.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.23",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-47586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47586",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fresh Framework \u003c= 1.70.0 - Missing Authorization",
    "slug": "fresh-framework",
    "type": "plugin",
    "affected_version": "* - 1.70.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.70.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26961",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Dashboard \u003c= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "frontend-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49310",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Builder \u003c= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication",
    "slug": "themify-builder",
    "type": "plugin",
    "affected_version": "* - 7.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7836",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Multilang \u003c= 2.4.19 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-multilang",
    "type": "plugin",
    "affected_version": "* - 2.4.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49307",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Media Flying Icons | Floating Social Media Icon \u003c= 4.3.5 -  Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "floating-social-media-icon",
    "type": "plugin",
    "affected_version": "* - 4.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36843",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NEX-Forms \u003c= 9.1.3 - Cross-Site Request Forgery",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 9.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49399",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MH Board \u003c= 1.3.2.1 - Unauthenticated Local File Inclusion",
    "slug": "mh-board",
    "type": "plugin",
    "affected_version": "* - 1.3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-44017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44017",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multi Currency For WooCommerce \u003c= 1.5.5 - Cross-Site Request Forgery",
    "slug": "wc-multi-currency",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49840",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Grid \u003c= 3.1.1 - Unauthenticated Private Post Disclosure",
    "slug": "essential-grid",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3235",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Mollie Payments for WooCommerce \u003c= 7.7.0 -  Unauthenticated Full Path Disclosure",
    "slug": "mollie-payments-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 7.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6448",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Short URL \u003c=  1.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "shorten-url",
    "type": "plugin",
    "affected_version": "1.6.4",
    "from_version": "1.6.4",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1602",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nexter Blocks \u003c= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-block-editor",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56246",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARMember \u003c= 4.0.5 - Cross-Site Request Forgery",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47424",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "which template file \u003c= 4.8.0 - Cross-Site Request Forgery",
    "slug": "which-template-file",
    "type": "plugin",
    "affected_version": "* - 4.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45753",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Buckets \u003c= 0.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "buckets",
    "type": "plugin",
    "affected_version": "* - 0.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57996",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Button \u003c= 1.1.27 - Authenticated (Contributor+) PHP Object Injection in button_shortcode",
    "slug": "button",
    "type": "plugin",
    "affected_version": "* - 1.1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1872",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SMTP for Sendinblue – YaySMTP \u003c= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logs",
    "slug": "smtp-sendinblue",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0953",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Stories Enhancer – Level Up Your Web Stories \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "web-stories-enhancer",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13575",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WappPress \u003c= 6.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wapppress-builds-android-app-for-website",
    "type": "plugin",
    "affected_version": "* - 6.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43137",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Akismet htaccess writer \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "akismet-htaccess-writer",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49316",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 5.9.4 - Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 5.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-13137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-13137",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Hour Booking \u003c= 1.3.15 Admin+ Stored Cross-Site Scripting",
    "slug": "appointment-hour-booking",
    "type": "plugin",
    "affected_version": "[*, 1.3.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24673",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CP Media Player \u003c= 1.1.3 - Cross-Site Request Forgery to Player Deletion and Duplication",
    "slug": "audio-and-video-player",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31941",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Cache.com \u003c= 1.1.1 - Cross-Site Request Forgery",
    "slug": "wp-cachecom",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34177",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Peter's Math Anti-Spam Spinoff \u003c 1.0.0 - CAPTCHA Bypass",
    "slug": "peters-math-anti-spam",
    "type": "plugin",
    "affected_version": "* - 0.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-7216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-7216",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Telegram Bot \u0026 Channel \u003c= 3.8.2 - Cross-Site Request Forgery",
    "slug": "telegram-bot",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38789",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Daily Prayer Time \u003c 2022.03.01 - Unauthenticated SQL Injection",
    "slug": "daily-prayer-time-for-mosques",
    "type": "plugin",
    "affected_version": "[*, 2022.03.01)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2022.03.01",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0785",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mobile Menu \u003c= 2.8.4.3 - Cross-Site Request Forgery",
    "slug": "mobile-menu",
    "type": "plugin",
    "affected_version": "* - 2.8.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37274",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Go Maps (formerly WP Google Maps) \u003c= 9.0.34 - Information Exposure to Potential Denial of Service",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6777",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "wpMandrill \u003c= 1.33 - Missing Authorization via getAjaxStats",
    "slug": "wpmandrill",
    "type": "plugin",
    "affected_version": "* - 1.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47828",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Journal \u003c= 1.1 - Missing Authorization",
    "slug": "wpjournal",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23613",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Radio Player \u003c= 2.0.73 - Missing Authorization to Settings Update",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "* - 2.0.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4027",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Legoeso PDF Manager \u003c= 1.2.2 - Authenticated (Author+) SQL Injection via checkedVals Parameter",
    "slug": "legoeso-pdf-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0866",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Debug Tool \u003c= 2.2 - Missing Authorization",
    "slug": "debug-tool",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23684",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SEO Plugin by Squirrly SEO \u003c= 11.1.11 - Reflected Cross-Site Scripting",
    "slug": "squirrly-seo",
    "type": "plugin",
    "affected_version": "[*, 11.1.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.1.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25019",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SportsPress – Sports Club \u0026 League Manager \u003c= 2.7.21 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "sportspress",
    "type": "plugin",
    "affected_version": "* - 2.7.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3986",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "5centsCDN \u003c= 25.4.15 - Reflected Cross-Site Scripting",
    "slug": "5centscdn",
    "type": "plugin",
    "affected_version": "* - 25.4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "25.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22326",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gmedia Photo Gallery \u003c 1.20.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "grand-media",
    "type": "plugin",
    "affected_version": "[*, 1.20.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0873",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DukaPress \u003c 2.5.4 - Directory Traversal",
    "slug": "dukapress",
    "type": "plugin",
    "affected_version": "[*, 2.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-8799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8799",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "onOffice for WP-Websites \u003c= 5.7 - Authenticated (Editor+) SQL Injection",
    "slug": "onoffice-for-wp-websites",
    "type": "plugin",
    "affected_version": "* - 5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10045",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 2.2.11 - Unauthenticated Server-Side Request Forgery",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 2.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-31288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31288",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bannerlid \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "bannerlid",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3048",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Page Post Widget Clone \u003c= 1.0.1 - Missing Authorization",
    "slug": "wp-page-post-widget-clone",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33636",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Permalinks \u003c= 2.6.0 - Authenticated(Editor+) Stored Cross-Site Scripting",
    "slug": "custom-permalinks",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0926",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zip Attachments \u003c= 1.6 - Missing Authorization to Limited File Deletion",
    "slug": "zip-attachments",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11692",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Admin Menu Plugin \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "admin-menu",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-24316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24316",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Font Awesome Share Icons \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-font-awesome-share-icons",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3198",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ICS Button \u003c= 0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ics-button",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22574",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newspack Blocks \u003c= 3.0.8 - Unauthenticated Sensitive Information Exposure",
    "slug": "newspack-blocks",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37115",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Extra Options – Favicons \u003c= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "extra-options-favicons",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23508",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Your Posts Manually \u003c= 2.2.5 - Reflected Cross-Site Scripting via 'cat_id'",
    "slug": "order-your-posts-manually",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32509",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 2.7.11.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via Task Data",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 2.7.11.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.11.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40681",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple:Press \u003c= 6.8 - Reflected Cross-Site Scripting via Cookie Value",
    "slug": "simplepress",
    "type": "plugin",
    "affected_version": "* - 6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4029",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LSX Tour Operator \u003c= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "tour-operator",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9851",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP YouTube Video Optimizer \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-youtube-video-optimizer",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 3.2.8 - Missing Authorization",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47314",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Denial of Service via XML #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.1",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-5266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5266",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Denial of Service via XML #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-5266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5266",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Denial of Service via XML #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.3",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-5266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5266",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Denial of Service via XML #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.3",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-5266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5266",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Infusionsoft Analytics \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "infusionsoft-web-tracker",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25145",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FluentForm \u003c= 4.3.25 - Authenticated (Administrator+) SQL Injection",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 4.3.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-24410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24410",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "pretix widget \u003c= 1.0.5 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "pretix-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9575",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventPrime \u003c 3.2.0 - Reflected Cross-Site Scripting via keyword and ep_filter_date",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "[*, 3.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4250",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.13 - Unauthenticated Sensitive Information Exposure",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2974",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Abstracts \u003c= 2.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-abstracts-manuscripts-manager",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50411",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DPortfolio \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "dportfolio",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24534",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Basic Contact Form \u003c= 20240502 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "simple-basic-contact-form",
    "type": "plugin",
    "affected_version": "* - 20240502",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20240502",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4144",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "MailOptin \u003c= 1.2.49.0 - Missing Authorization to Cache Deletion",
    "slug": "mailoptin",
    "type": "plugin",
    "affected_version": "* - 1.2.49.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.49.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36340",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Agenda \u003c= 4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-agenda-prise-de-rendez-vous-en-ligne",
    "type": "plugin",
    "affected_version": "* - 4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53294",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zephyr Admin Theme \u003c= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "zephyr-modern-admin-theme",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22814",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BoomBox Theme Extensions \u003c= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password",
    "slug": "boombox-theme-extensions",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12295",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GiftXtore \u003c= 1.7.4 - Unauthenticated Local File Inclusion",
    "slug": "bw-giftxtore",
    "type": "theme",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-28888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28888",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Scribble Maps \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "scribble-maps",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34651",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4203",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Testimonials \u003c= 3.5.2 - Stored Cross-Site Scripting",
    "slug": "easy-testimonials",
    "type": "plugin",
    "affected_version": "[*, 3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-19564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19564",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Runners Log \u003c= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "runners-log",
    "type": "plugin",
    "affected_version": "* - 3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5541",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LWS Hide Login \u003c= 2.1.6 - Cross-Site Request Forgery",
    "slug": "lws-hide-login",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34025",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "my white \u003c= 2.0.8 - Reflected Cross-Site Scripting",
    "slug": "my-white",
    "type": "theme",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22678",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Counter \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter",
    "slug": "download-counter",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8294",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shopwarden – Automated WooCommerce monitoring \u0026 testing \u003c= 1.0.11 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "shopwarden",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13315",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NGG Smart Image Search \u003c= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ngg-smart-image-search",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13658",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All push notification for WP \u003c= 1.5.3 - Cross-Site Request Forgery to SQL Injection",
    "slug": "all-push-notification",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32547",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "S3Bubble Media Streaming \u003c= 8.0 - Reflected Cross-Site Scripting",
    "slug": "s3bubble-amazon-web-services-oembed-media-streaming-support",
    "type": "plugin",
    "affected_version": "* - 8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13862",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pagopar \u0026#8211; WooCommerce Gateway \u003c= 2.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "pagopar-woocommerce-gateway",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31032",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Engine \u003c= 2.5.0 - Authenticated (Admin+) Remote Code Execution",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6451",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple User Registration \u003c= 6.4 - Missing Authorization to Account Takeover",
    "slug": "wp-registration",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49604",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Everest Forms \u003c= 1.7.9 - Reflected Cross-Site Scripting",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "[*, 1.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24907",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Valuation Calculator \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter",
    "slug": "commercial-real-estate-valuation-calculator",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5753",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vitepos \u003c= 3.1.4 - Missing Authorization",
    "slug": "vitepos-lite",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22277",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sell Media File with Stripe \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sell-media-file",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51892",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Video Management System \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "simple-video-management-system",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12256",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exhibit to WP Gallery \u003c= 0.0.2 - Reflected Cross-Site Scripting",
    "slug": "exhibit-to-wp-gallery",
    "type": "plugin",
    "affected_version": "* - 0.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12096",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Poll Maker \u003c= 4.7.0 - Reflected Cross-Site Scripting",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 4.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41871",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Surbma | SalesAutopilot Shortcode \u003c= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "surbma-salesautopilot-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11433",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Affiliate Links \u003c= 6.4.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-auto-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 6.4.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47652",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kv Compose Email From Dashboard \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "kv-send-email-from-admin",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23525",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Button Plus \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fd-elementor-button-plus",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53746",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MediaElement.js – HTML5 Video \u0026 Audio Player \u003c= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "media-element-html5-video-and-audio-player",
    "type": "plugin",
    "affected_version": "* - 4.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4699",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Discourse \u003c= 2.5.1 - Missing Authorization",
    "slug": "wp-discourse",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35168",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Grid \u003c= 3.0.18 - Missing Authorization",
    "slug": "essential-grid",
    "type": "plugin",
    "affected_version": "* - 3.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47771",
    "auth_type": "Auth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
  },
  {
    "title": "Smart Logo Showcase Lite \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "smart-logo-showcase-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0175",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid \u003c= 5.7.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30241",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Lister Lite for Amazon \u003c= 2.4.2 - Reflected Cross-Site Scripting",
    "slug": "wp-lister-for-amazon",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4369",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Weather Atlas Widget \u003c= 3.0.3 - Unauthenticated Cross-Site Scripting",
    "slug": "weather-atlas",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52472",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myCred Elementor \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mycred-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49702",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Images Ape \u003c= 1.6.14 - Stored Cross-Site Scripting",
    "slug": "gallery-images-ape",
    "type": "plugin",
    "affected_version": "* - 1.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-6117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6117",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Altima Lookbook Free for WooCommerce \u003c= 1.1.0 - Refletced Cross-Site Scripting",
    "slug": "altima-lookbook-free-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23429",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Spreadsheet \u003c= 0.6 - Unauthenticated SQL Injection",
    "slug": "wpSS",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-1982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-1982",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hot Files: File Sharing and Download Manager Plugin \u003c= 1.0.0 - Cross-Site scripting",
    "slug": "wphotfiles",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4588",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Category Post List Widget \u003c= 2.0.3 - Cross-Site Request Forgery via gen_set_page",
    "slug": "wp-category-posts-list",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47672",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Visual Adverts \u003c= 2.3.0 - Reflected Cross-Site Scripting",
    "slug": "wp-visual-adverts",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51707",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Products, Order \u0026 Customers Export for WooCommerce \u003c= 2.0.11 - Reflected Cross-Site Scripting",
    "slug": "export-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43127",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Artificial Intelligence \u003c 1.2.4 - Cross-Site Scripting",
    "slug": "artificial-intelligence",
    "type": "theme",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9501",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elements Kit Lite/Pro \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24258",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kali Forms \u003c= 2.1.1 - Cross-Site Request Forgery",
    "slug": "kali-forms",
    "type": "plugin",
    "affected_version": "[*, 2.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36717",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Move Addons for Elementor \u003c= 1.2.9 - Missing Authorization",
    "slug": "move-addons",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30525",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fast Flow \u003c= 1.2.12 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "fast-flow-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2775",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Debt Calculator \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "debt-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23861",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Gallery Box by CRUDLab \u003c= 1.0.3 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "image-gallery-box-by-crudlab",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23938",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Registration \u0026 Membership – Custom Registration Form, Login Form, and User Profile \u003c= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3282",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Tooltips \u003c= 2.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-tooltips",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25958",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AddToAny Share Buttons \u003c= 1.7.45 - Authenticated Stored Cross-Site Scripting",
    "slug": "add-to-any",
    "type": "plugin",
    "affected_version": "[*, 1.7.46)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.46",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24568",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "B1.lt for WooCommerce \u003c= 2.2.56 - Authenticated (Subscriber+) SQL Injection",
    "slug": "b1-accounting",
    "type": "plugin",
    "affected_version": "* - 2.2.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.56",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6717",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Google Analyticator \u003c= 6.4.9.5 - Cross-Site Scripting",
    "slug": "google-analyticator",
    "type": "plugin",
    "affected_version": "[*, 6.4.9.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.9.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-6238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6238",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OMGF \u003c= 4.5.3 - Unauthenticated Path Traversal in REST API",
    "slug": "host-webfonts-local",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24638",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP Cassify \u003c= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-cassify",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30771",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easypromos Plugin \u003c= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easypromos",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coins MarketCap \u003c= 5.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "coins-marketcap",
    "type": "plugin",
    "affected_version": "* - 5.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56257",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FOX – Currency Switcher Professional for WooCommerce \u003c= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8271",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "VK All in One Expansion Unit \u003c= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className",
    "slug": "vk-all-in-one-expansion-unit",
    "type": "plugin",
    "affected_version": "* - 9.96.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.96.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2170",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Currency Converter Widget ⚡ PRO \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "currency-converter-widget-pro",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11760",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accept Donations with PayPal \u003c= 1.3.3 - Arbitrary Post Deletion via Cross-Site Request Forgery",
    "slug": "easy-paypal-donation",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24989",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "VR Calendar \u003c= 2.3.3 - Cross-Site Request Forgery",
    "slug": "vr-calendar-sync",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3852",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Shipment Tracking for WooCommerce \u003c= 3.5.2 - Cross-Site Request Forgery via paginate_shipping_provider_list and filter_shipping_provider_list",
    "slug": "woo-advanced-shipment-tracking",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41635",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 2.0.5 - Cross-Site Request Forgery leading to Settings Change",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36878",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TypeSquare Webfonts for ConoHa \u003c= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ts-webfonts-for-conoha",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25458",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 4.1.10 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 4.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1894",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goodlayers Hotel \u003c= 3.1.4 - Reflected Cross-Site Scripting",
    "slug": "gdlr-hotel",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SchedulePress \u003c= 5.1.3 - Unauthenticated Full Path Disclosure",
    "slug": "wp-scheduled-posts",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6557",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution \u003c= 4.2.14 - Unauthenticated Limited Local File Inclusion",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.14",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-0493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0493",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Insert HTML Here \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "insert-html-here",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31379",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "tagDiv Composer \u003c= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2804",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Limit Login Attempts (Spam Protection) \u003c= 5.3 - IP Address Spoofing to Protection Mechanism Bypass",
    "slug": "wp-limit-failed-login-attempts",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4534",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy SVG Support \u003c= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "easy-svg",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10269",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carousel Ultimate \u003c= 1.8 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "carousel",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58820",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login With Ajax \u003c 3.0.4.1 - Cross-Site Scripting",
    "slug": "login-with-ajax",
    "type": "plugin",
    "affected_version": "[*, 3.0.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-4283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4283",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant Menu and Food Ordering by Five Star Plugins \u003c= 2.4.6 - Cross-Site Request Forgery via maybe_duplicate_item",
    "slug": "food-and-drink-menu",
    "type": "plugin",
    "affected_version": "[*, 2.4.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-37985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37985",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Theme Blvd Sliders \u003c= 1.2.5 - Reflected Cross-Site Scripting",
    "slug": "theme-blvd-sliders",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46456",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Share This Image \u003c= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter",
    "slug": "share-this-image",
    "type": "plugin",
    "affected_version": "* - 2.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8108",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simplish \u003c= 2.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "simplish",
    "type": "theme",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22281",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery, Images, Slider in Rbs Image Gallery \u003c= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3894",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Super Cache Plugin \u003c= 1.3 - Multiple Cross-Site Scripting",
    "slug": "wp-super-cache",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2008",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Revive.so \u003c= 2.0.6 - Missing Authorization",
    "slug": "revive-so",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59551",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OTP-less one tap Sign in 2.0.14 - 2.0.59 - Unauthenticated Arbitrary Email Update to Account Takeover/Privilege Escalation",
    "slug": "otpless",
    "type": "plugin",
    "affected_version": "2.0.14 - 2.0.59",
    "from_version": "2.0.14",
    "from_inclusive": true,
    "to_version": "2.0.59",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3746",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Express Payments Module \u003c= 1.1.8 - Unauthenticated SQL Injection via type_id",
    "slug": "express-pay",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52474",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Modal Window \u003c= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "modal-window",
    "type": "plugin",
    "affected_version": "* - 6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43346",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Job Postings \u003c= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "job-postings",
    "type": "plugin",
    "affected_version": "* - 2.7.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10105",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Conditional Marketing Mailer \u003c= 1.5.1 - Improper Authorization",
    "slug": "wp-maintenance-mode-site-under-construction",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24190",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.0.13 - Unrestricted SVG Uploads",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36171",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Table \u003c= 2.0.1 - Cross-Site Request Forgery via ajax()",
    "slug": "elfsight-pricing-table",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4100",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Taxonomy Switcher \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "taxonomy-switcher",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10013",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6521",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Knowledge Base documentation \u0026 wiki plugin – BasePress \u003c= 2.16.1 - Missing Authorization",
    "slug": "basepress",
    "type": "plugin",
    "affected_version": "* - 2.16.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33588",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "XStore \u003c= 9.3.8 - Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "xstore",
    "type": "theme",
    "affected_version": "* - 9.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-33564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33564",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Pro \u003c= 3.21.2 - Reflected Cross-Site Scripting",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.21.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.21.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35656",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WBW Product Table Pro \u003c= 1.9.4 - Unauthenticated Arbitrary SQL Execution",
    "slug": "woo-producttables-pro",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43918",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "TweetThis Shortcode \u003c= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tweetthis-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10136",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BestWebSoft's Like \u0026 Share \u003c= 2.73 - Unauthenticated Password Protected Post Disclosure",
    "slug": "facebook-button-plugin",
    "type": "plugin",
    "affected_version": "* - 2.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6250",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Content Grabber \u003c= 1.0 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "content-grabber",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9469",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF for WPForms \u003c= 5.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "pdf-for-wpforms",
    "type": "plugin",
    "affected_version": "* - 5.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30767",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS \u003c= 0.0.21 - Reflected Cross-Site Scripting",
    "slug": "sikshya",
    "type": "plugin",
    "affected_version": "* - 0.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24630",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pagination by BestWebSoft \u003c= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pagination",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28778",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Note Press \u003c= 0.1.10 - Authenticated (Admin+) SQL Injection via ids Parameter",
    "slug": "note-press",
    "type": "plugin",
    "affected_version": "* - 0.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1688",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress File Upload \u003c= 4.3.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "[*, 4.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-9172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-9172",
    "auth_type": "Auth",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection \u003c= 10.23 - Missing Authorization to Information Expsoure",
    "slug": "stopbadbots",
    "type": "plugin",
    "affected_version": "* - 10.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4355",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Salon Booking System and Salon Booking System Pro \u003c= 7.6.2 - Sensitive Data Disclosure",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 7.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0919",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2504",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adventure Bucket List \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "adventure-bucket-list",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51908",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DeBounce Email Validator \u003c= 5.8.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "debounce-io-email-validator",
    "type": "plugin",
    "affected_version": "* - 5.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32580",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Scheduling Plugin – Online Booking for WordPress \u003c= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "calendar-booking",
    "type": "plugin",
    "affected_version": "* - 3.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23517",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Wish Lists \u003c 1.1.1 - Cross-Site Scripting",
    "slug": "edd-wish-lists",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9531",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Video Lightbox \u003c= 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-video-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4465",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elevio \u003c= 4.4.1 - Cross-Site Request Forgery",
    "slug": "elevio",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22328",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stylish Cost Calculator \u003c 7.9.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "stylish-cost-calculator-premium",
    "type": "plugin",
    "affected_version": "[*, 7.9.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.9.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-0983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0983",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Manager \u003c= 2.0.0 - Cross-Site Request Forgery",
    "slug": "wp-job-manager",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52212",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 1.2.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6446",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cazamba \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "cazamba",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25100",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clean-Contact \u003c= 1.6 - Cross-Site Request Forgery",
    "slug": "clean-contact",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1914",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FAQs \u003c= 1.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "faqs",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54246",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Views Counter \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpecounter",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49859",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPComplete \u003c= 2.9.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpcomplete",
    "type": "plugin",
    "affected_version": "* - 2.9.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58974",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mantenimiento web \u003c= 0.13 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mantenimiento-web",
    "type": "plugin",
    "affected_version": "* - 0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41980",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Code Snippets \u003c= 1.0.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "easy-code-snippets",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23780",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "All in One Slider \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "all-in-one-slider",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49323",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zippy \u003c= 1.6.9 - Authenticated (Editor+) Arbitrary File Upload",
    "slug": "zippy",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-27964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27964",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wp-flickr-press \u003c= 2.6.4 - Reflected Cross-Site Scripting",
    "slug": "wp-flickr-press",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23894",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Meta \u003c= 2.4.2 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "user-meta",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0376",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Headline Analyzer \u003c= 1.3.3 - Cross-Site Request Forgery",
    "slug": "headline-analyzer",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32806",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FloLaunch \u003c= 2.4 - Missing Authorization",
    "slug": "flo-launch",
    "type": "plugin",
    "affected_version": "[*, 2.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0541",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Map Pro \u003c= 5.5.0 - Cross-Site Request Forgery",
    "slug": "image-map-pro",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45846",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sideblog WordPress Plugin \u003c= 6.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting",
    "slug": "sideblog",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Bridge Core \u003c= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import",
    "slug": "bridge-core",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9860",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "User Feedback \u003c= 1.0.10 - Missing Authorization",
    "slug": "userfeedback-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50887",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Gallery PhotoBlocks \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "photoblocks-grid-gallery",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37407",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ABC Notation \u003c= 6.1.3 - Authenticated (Contributor+) Arbitrary File Read",
    "slug": "abc-notation",
    "type": "plugin",
    "affected_version": "* - 6.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13550",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ReviveNews \u003c= 1.0.2 - Missing Authorization via revivenews_install_and_activate_plugins()",
    "slug": "revivenews",
    "type": "theme",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43974",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.11.2.1 - Missing Authorization",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.11.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.11.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PowerPack Pro for Elementor \u003c= 2.10.17 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "powerpack-elements",
    "type": "plugin",
    "affected_version": "* - 2.10.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3668",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Data Tables Generator by Supsystic \u003c= 1.9.91 - Missing Authorization on AJAX Actions",
    "slug": "data-tables-generator-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.9.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-12075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12075",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins By ThemeHunk (Various Versions) - Missing Authorization via settings_init",
    "slug": "th-product-compare",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25969",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins By ThemeHunk (Various Versions) - Missing Authorization via settings_init",
    "slug": "lead-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25969",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins By ThemeHunk (Various Versions) - Missing Authorization via settings_init",
    "slug": "th-advance-product-search",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25969",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Dashboard \u003c= 2.2.5 - Unauthenticated SQL Injection",
    "slug": "frontend-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-46248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46248",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ARforms \u003c= 6.4 - Reflected Cross-Site Scripting",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32702",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SIP Reviews Shortcode for WooCommerce \u003c= 1.2.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "sip-reviews-shortcode-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6479",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP GeoNames \u003c= 1.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-geonames",
    "type": "plugin",
    "affected_version": "* - 1.9.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11757",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid  \u003c= 5.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30513",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Hotel Booking \u003c= 1.10.1 - Cross-Site Request Forgery Bypass",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "[*, 1.10.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36757",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Eventin \u003c= 3.3.52 - Missing Authorization",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 3.3.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49756",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mang Board WP \u003c= 1.8.0 - Reflected Cross-Site Scripting",
    "slug": "mangboard",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30431",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Find and Replace \u003c= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "real-time-auto-find-and-replace",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53466",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.2.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12278",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WpDevTool \u003c= 0.1.1 - Reflected Cross-Site Scripting",
    "slug": "wpdevtool",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23624",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 4.2.2 -  Missing Authorization",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19984",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "AZIndex \u003c= 0.8.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "azindex",
    "type": "plugin",
    "affected_version": "* - 0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Manager \u003c= 2.9.10 - Cross-Site Request Forgery",
    "slug": "wp-user-manager",
    "type": "plugin",
    "affected_version": "* - 2.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43336",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BP Email Assign Templates \u003c= 1.5 - Reflected Cross-Site Scripting",
    "slug": "bp-email-assign-templates",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12441",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Pack Elementor addons \u003c= 2.0.9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "the-pack-addon",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50453",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Media Player Addons for Elementor \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields",
    "slug": "media-player-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9203",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soundcloud Is Gold \u003c= 2.5.1 - Missing Authorization to Soundcloud User Add",
    "slug": "soundcloud-is-gold",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32586",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Uncode \u003c= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia",
    "slug": "uncode",
    "type": "theme",
    "affected_version": "* - 2.9.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13691",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP JobHunt \u003c= 7.6 Authenticated (Custom+) Authorization Bypass",
    "slug": "wp-jobhunt",
    "type": "plugin",
    "affected_version": "* - 7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7374",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net \u003c= 1.1.4.2 - Reflected Cross-Site Scripting",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30200",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Corona Virus (COVID-19) Banner \u0026 Live Data \u003c= 1.7.0.6 - Cross-Site Request Forgery",
    "slug": "corona-virus-covid-19-banner",
    "type": "plugin",
    "affected_version": "* - 1.7.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43469",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Docket (WooCommerce Collections / Wishlist / Watchlist) \u003c 1.7.0 - Unauthenticated SQL Injection",
    "slug": "woocommerce-collections",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2024-43132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43132",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Glossary \u003c= 2.2.26 - Unauthenticated Full Path Disclosure",
    "slug": "glossary-by-codeat",
    "type": "plugin",
    "affected_version": "* - 2.2.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6570",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Popup Maker \u003c= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.19.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7054",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Uploader \u003c= 1.3.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "frontend-uploader",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24563",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Verowa Connect \u003c= 3.0.1 - Unauthenticated SQL Injection",
    "slug": "verowa-connect",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11460",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Greenshift – animation and page builder blocks \u003c=9.7 - Missing Authorization",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50419",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tagregator \u003c= 0.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "tagregator",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10752",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MC4WP: Mailchimp Top Bar \u003c= 1.6.0 - Reflected Cross-Site Scripting",
    "slug": "mailchimp-top-bar",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9210",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Olevmedia Shortcodes \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "olevmedia-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25798",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TrueBooker \u003c= 1.0.3 - Unauthenticated SQL Injection",
    "slug": "truebooker-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6924",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.0.14 - Cross-Site Request Forgery",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32712",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \u003c= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 6.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9390",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Access Manager \u003c= 6.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "advanced-access-manager",
    "type": "plugin",
    "affected_version": "* - 6.9.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Tickets and Registration \u003c= 5.8.2 - Improper Authorization to Information Disclosure",
    "slug": "event-tickets",
    "type": "plugin",
    "affected_version": "* - 5.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2261",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Nested Pages \u003c= 3.1.15 - Open Redirect",
    "slug": "wp-nested-pages",
    "type": "plugin",
    "affected_version": "* - 3.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38343",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Meta Data and Taxonomies Filter (MDTF) \u003c= 1.3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50451",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kama Click Counter \u003c= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kama-clic-counter",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58682",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classified Pro \u003c= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation",
    "slug": "classified-pro",
    "type": "theme",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10706",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FluentSMTP \u003c= 2.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Email Logs",
    "slug": "fluent-smtp",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-0219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0219",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Contempo Real Estate Core \u003c= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ct-real-estate-core",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2906",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iPanorama 360 WordPress Virtual Tour Builder \u003c= 1.6.29 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ipanorama-360-virtual-tour-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.6.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4392",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Event Aggregator \u003c= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-event-aggregator",
    "type": "plugin",
    "affected_version": "* - 1.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RomethemeKit For Elementor \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rometheme-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47626",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Feed \u003c= 2.2.0 - Reflected Cross-Site Scripting",
    "slug": "wp-social-feed",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45003",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Empty Tags Remover \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "empty-tags-remover",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24640",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Borderless - Widgets, Elements, Templates and Toolkit for Elementor \u0026 Gutenberg \u003c= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "borderless",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4666",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez \u003c= 4.1.1 - Unauthenticated Local File Inclusion",
    "slug": "houzez",
    "type": "theme",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49405",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Piotnet Addons For Elementor \u003c= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "piotnet-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5502",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EasyEvent \u003c= 1.0.0 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "easyevent",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3628",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "H5P \u003c= 1.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "h5p",
    "type": "plugin",
    "affected_version": "* - 1.15.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Payflex Payment Gateway \u003c= 2.6.1 - Open Redirect",
    "slug": "payflex-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47646",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Field Template \u003c= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name",
    "slug": "custom-field-template",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0627",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Private Messages For WordPress \u003c= 2.1.10 - Stored Cross-Site Scripting",
    "slug": "private-messages-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29442",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mediavine Control Panel \u003c= 2.10.6 - Unauthenticated Information Exposure",
    "slug": "mediavine-control-panel",
    "type": "plugin",
    "affected_version": "* - 2.10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39556",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Cost Calculator Builder \u003c= 3.2.65 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "* - 3.2.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.65",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31414",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Analytics Insights \u003c= 6.2 - Open Redirect",
    "slug": "analytics-insights",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0250",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Directory Plugin \u003c= 6.3.10 - Cross-Site Request Forgery",
    "slug": "business-directory-plugin",
    "type": "plugin",
    "affected_version": "* - 6.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5803",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HT Event \u003c= 1.4.5 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation",
    "slug": "ht-event",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0496",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Download Counter \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-download-counter",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46240",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bg Patriarchia BU \u003c= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bg-patriarchia-bu",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51799",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hummingbird \u003c= 3.7.3 - Missing Authorization",
    "slug": "hummingbird-performance",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32792",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Responsive Slider \u003c= 0.2.2.5 - Reflected Cross-Site Scripting",
    "slug": "simple-responsive-slider",
    "type": "plugin",
    "affected_version": "* - 0.2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37954",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SuperBackup \u003c= 2.3.3 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "indeed-wp-superbackup",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56068",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Catalog Importer, Scraper \u0026 Crawler \u003c= 5.1.3 - Reflected Cross-Site Scripting",
    "slug": "intelligent-importer",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22775",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Owl Carousel \u003c= 0.5.3 - Missing Authorization via save_paramter.php",
    "slug": "owl-carousel",
    "type": "plugin",
    "affected_version": "* - 0.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44578",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 5.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "[*, 5.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24323",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Akal - Multipurpose WordPress Theme (All Versions) - Reflected Cross-Site Scripting",
    "slug": "akal",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10957",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YourChannel \u003c= 1.2.2 Authenticated (Contributor+) Cross-Site Scripting via Shortcode",
    "slug": "yourchannel",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4833",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Wired Impact Volunteer Management \u003c= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wired-impact-volunteer-management",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26980",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gotcha | Gesture-based Captcha \u003c= 1.0.0 - Reflected Cross-Site Scripting via menu Parameter",
    "slug": "gotcha-gesture-based-captcha",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2482",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support – WordPress HelpDesk \u0026 Support Plugin \u003c= 6.1.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0594",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.15.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1533",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vilva \u003c= 1.2.2 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "vilva",
    "type": "theme",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37102",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newspack Newsletters \u003c= 2.13.2 - Missing Authorization",
    "slug": "newspack-newsletters",
    "type": "plugin",
    "affected_version": "* - 2.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37475",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Dave's WordPress Live Search \u003c= 4.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "daves-wordpress-live-search",
    "type": "plugin",
    "affected_version": "* - 4.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30876",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restrict Anonymous Access \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "restrict-anonymous-access",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24610",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM WordPress Plugin – RepairBuddy \u003c= 3.8213 - Missing Authorization",
    "slug": "computer-repair-shop",
    "type": "plugin",
    "affected_version": "* - 3.8213",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8213",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32277",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GG Woo Feed for WooCommerce Shopping Feed \u003c= 1.2.6 - Missing Authorization",
    "slug": "gg-woo-feed",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32519",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Voltax Video Player \u003c= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "voltax-video-player",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6539",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Contact Form 7 \u003c= 2.0.0 - Authenticated (Administrator+) Local File Inclusion",
    "slug": "ht-contactform",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54015",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.5.1.8 - Reflected Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-1002003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1002003",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AnyWhere Elementor \u003c= 1.2.11 - Authenticated (Contributor+) Post Disclosure",
    "slug": "anywhere-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10777",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form 7 to Database Extension 2.10.32 - CSV Injection",
    "slug": "contact-form-7-to-database-extension",
    "type": "plugin",
    "affected_version": "2.10.32",
    "from_version": "2.10.32",
    "from_inclusive": true,
    "to_version": "2.10.32",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-9035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-9035",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Browser Caching with .htaccess  1.2.1 - Cross-Site Request Forgery",
    "slug": "browser-caching-with-htaccess",
    "type": "plugin",
    "affected_version": "1.2.1",
    "from_version": "1.2.1",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31439",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iMember360 3.8.012 - 3.9.001 - Remote Code Execution",
    "slug": "imember360",
    "type": "plugin",
    "affected_version": "3.8.012 - 3.9.001",
    "from_version": "3.8.012",
    "from_inclusive": true,
    "to_version": "3.9.001",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-8949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8949",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Author Avatars List/Block \u003c= 2.1.21 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "author-avatars",
    "type": "plugin",
    "affected_version": "* - 2.1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47370",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Reorder Image Text Slider \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "advanced-reorder-image-text-slider",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4188",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Directory Kit \u003c= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2280",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 3.1.3 - Clickjacking",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2011-3127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3127",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "SiteAlert (Formerly WP Health) \u003c= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information Exposure",
    "slug": "my-wp-health-check",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10212",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "XV Random Quotes \u003c= 1.40 - Unauthenticated SQL Injection",
    "slug": "xv-random-quotes",
    "type": "plugin",
    "affected_version": "* - 1.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.40",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30971",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Frontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via fed_admin_setting_form_function Function",
    "slug": "frontend-dashboard",
    "type": "plugin",
    "affected_version": "1.0 - 2.2.7",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4474",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Printeers Print \u0026 Ship \u003c= 1.17.0 - Unauthenticated Path Traversal",
    "slug": "invition-print-ship",
    "type": "plugin",
    "affected_version": "* - 1.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48081",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Abstracts \u003c= 2.6.1 - Reflected Cross-Site Scripting",
    "slug": "wp-abstracts-manuscripts-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29385",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Sell Digital Files \u0026 Subscriptions (eCommerce Store + Payments Made Easy) \u003c= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13517",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider \u003c= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update",
    "slug": "ultimate-store-kit",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2168",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Directorist – WordPress Business Directory Plugin with Classified Ads Listings \u003c= 7.2.3 - Missing Authorization",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2377",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "A/B Testing for WordPress \u003c= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ab-testing-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.18.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4587",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fetch JFT \u003c= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "fetch-jft",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4419",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HQ60 Fidelity Card \u003c= 1.8 - Reflected Cross-Site Scripting",
    "slug": "hq60-fidelity-card",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51713",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Block and Stop Bad Bots \u003c= 6.92 - SQL Injection",
    "slug": "stopbadbots",
    "type": "plugin",
    "affected_version": "[*, 6.930)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.930",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0949",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WolfNet IDX for WordPress \u003c= 1.19.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wolfnet-idx-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.19.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6783",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8106",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Theme Blvd Widget Areas \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "theme-blvd-widget-areas",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53289",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hero Mega Menu - Responsive WordPress Menu Plugin \u003c= 1.16.5 - Reflected Cross-Site Scripting",
    "slug": "hmenu",
    "type": "plugin",
    "affected_version": "* - 1.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49300",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cryptocurrency All-in-One \u003c= 3.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cryptocurrency-prices",
    "type": "plugin",
    "affected_version": "* - 3.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29435",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "dejure.org Vernetzungsfunktion \u003c= 1.97.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "dejureorg-vernetzungsfunktion",
    "type": "plugin",
    "affected_version": "* - 1.97.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.97.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11417",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookie Monster \u003c= 1.2.2 - Unauthenticated Local File Inclusion",
    "slug": "cookie-monster",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22656",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Interactive Medical Drawing of Human Body \u003c= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "interactive-medical-drawing-of-human-body",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9332",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.6 - Cross-Site Request Forgery",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0180",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LTL Freight Quotes – GlobalTranz Edition \u003c= 2.3.12 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "ltl-freight-quotes-globaltranz-edition",
    "type": "plugin",
    "affected_version": "* - 2.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1483",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Homey \u003c= 2.4.5 - Reflected Cross-Site Scripting",
    "slug": "homey",
    "type": "theme",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31037",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11714",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Cost Calculator \u003c= 1.8 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode",
    "slug": "nd-projects",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0165",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AZIndex \u003c= 0.8.1 - Cross-Site Request Forgery to Index Deletion",
    "slug": "azindex",
    "type": "plugin",
    "affected_version": "* - 0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7688",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ZoomSounds \u003c= 5.96 - Unauthenticated Arbitrary File Upload",
    "slug": "dzs-zoomsounds",
    "type": "plugin",
    "affected_version": "* - 5.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.96",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-4449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4449",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RegistrationMagic \u003c= 5.2.4.1 - Reflected Cross-Site Scripting via section_id",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "[*, 5.2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-51509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51509",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HUSKY – Products Filter for WooCommerce \u003c= 1.3.6.3 - Reflected Cross-Site Scripting via really_curr_tax Parameter",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11400",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kubio AI Page Builder \u003c= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kubio",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39661",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium SEO Pack \u003c= 1.6.001 - Authenticated (Contributor+) SQL Injection",
    "slug": "premium-seo-pack",
    "type": "plugin",
    "affected_version": "* - 1.6.001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.001",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50465",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "20.0.0 - 21.8.0",
    "from_version": "20.0.0",
    "from_inclusive": true,
    "to_version": "21.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10633",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "7.0.0 - 8.8.0",
    "from_version": "7.0.0",
    "from_inclusive": true,
    "to_version": "8.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10633",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "30.0.0 - 31.8.0",
    "from_version": "30.0.0",
    "from_inclusive": true,
    "to_version": "31.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10633",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Beaver Builder Addons by WPZOOM \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget",
    "slug": "wpzoom-addons-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2185",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soundy Background Music \u003c= 3.9 - Cross-Site Scripting",
    "slug": "soundy-background-music",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-6002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6002",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-search",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-tabs",
    "type": "plugin",
    "affected_version": "* - 2.1.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-blog",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-theme-core",
    "type": "plugin",
    "affected_version": "* - 2.1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-compare-wishlist",
    "type": "plugin",
    "affected_version": "* - 1.5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-popup",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-woo-builder",
    "type": "plugin",
    "affected_version": "* - 2.1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-reviews",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-engine",
    "type": "plugin",
    "affected_version": "* - 3.2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-tricks",
    "type": "plugin",
    "affected_version": "* - 1.4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-menu",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-woo-product-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Missing Authorization",
    "slug": "jet-smart-filters",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48761",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Turbo Addons for Elementor \u003c= 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "turbo-addons-elementor",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32186",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Clictracker \u003c= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "clictracker",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44735",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bbPress \u003c= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalation",
    "slug": "bbpress",
    "type": "plugin",
    "affected_version": "* - 2.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1435",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Simple Logo Carousel \u003c= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "simple-logo-carousel",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5700",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dokan Pro \u003c= 3.10.3 - Unauthenticated SQL Injection",
    "slug": "dokan-pro",
    "type": "plugin",
    "affected_version": "* - 3.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3922",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Mocho Blog \u003c= 1.0.4 - Cross-Site Scripting",
    "slug": "mocho-blog",
    "type": "theme",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27412",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MPWizard – Create Mercado Pago Payment Links \u003c= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion",
    "slug": "mpwizard",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9885",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-DB-Table-Editor \u003c= 1.8.4 - Missing Authorization to Authenticated(Contributor+) Database Access",
    "slug": "wp-db-table-editor",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2019",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Atarim \u003c= 4.0.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "atarim-visual-collaboration",
    "type": "plugin",
    "affected_version": "* - 4.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24570",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Career Opening \u003c= 0.4 - Unauthenticated Cross-Site Scripting",
    "slug": "easy-career-openings",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4523",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ListingPro - WordPress Directory \u0026 Listing Theme \u003c 2.0.14.5 - Reflected Cross-Site Scripting",
    "slug": "listingpro",
    "type": "theme",
    "affected_version": "[*, 2.0.14.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-19540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19540",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Importer \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "wp-smart-import",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30201",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CPT Shortcode Generator \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "cpt-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45644",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All In One SEO Pack \u003c= 3.2.6 - Stored Cross-Site Scripting",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16520",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "article2pdf 0.24 - 0.27 - Information Disclosure",
    "slug": "article2pdf",
    "type": "plugin",
    "affected_version": "0.24",
    "from_version": "0.24",
    "from_inclusive": true,
    "to_version": "0.24",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-1010257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1010257",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "article2pdf 0.24 - 0.27 - Information Disclosure",
    "slug": "article2pdf",
    "type": "plugin",
    "affected_version": "0.25",
    "from_version": "0.25",
    "from_inclusive": true,
    "to_version": "0.25",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-1010257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1010257",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "article2pdf 0.24 - 0.27 - Information Disclosure",
    "slug": "article2pdf",
    "type": "plugin",
    "affected_version": "0.26",
    "from_version": "0.26",
    "from_inclusive": true,
    "to_version": "0.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-1010257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1010257",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "article2pdf 0.24 - 0.27 - Information Disclosure",
    "slug": "article2pdf",
    "type": "plugin",
    "affected_version": "0.27",
    "from_version": "0.27",
    "from_inclusive": true,
    "to_version": "0.27",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-1010257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1010257",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "WP Songbook \u003c= 2.0.11 - Reflected Cross-Site Scripting",
    "slug": "wp-songbook",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34655",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP STAGING PRO - Backup Duplicator \u0026 Migration \u003c= 5.6.0 - Cross-Site Request Forgery to Limited Local File Inclusion",
    "slug": "wp-staging-pro",
    "type": "plugin",
    "affected_version": "* - 5.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5551",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MainWP Dashboard \u003c= 4.5.1.2 - Authenticated(Administrator+) CSS Injection",
    "slug": "mainwp",
    "type": "plugin",
    "affected_version": "* - 4.5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-6164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6164",
    "auth_type": "Privileged",
    "cvss_score": 2.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CataBlog \u003c= 1.7.0 - Authenticated (Editor+) Arbitrary File Deletion",
    "slug": "catablog",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47843",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "All in One SEO \u003c= 2.0.3 - Cross-Site Scripting via Search Parameter",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-5988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5988",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments - wpDiscuz \u003c= 5.3.5 - Blind SQL Injection via order Parameter",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "[*, 5.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-13640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13640",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Envira Photo Gallery \u003c= 1.8.7.3 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "envira-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 1.8.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37095",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Html Social share buttons \u003c= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "html-social-share-buttons",
    "type": "plugin",
    "affected_version": "* - 2.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9849",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress Notification Widget \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "buddypress-notifications-widget",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58263",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Topbar ID for Elementor \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "topbar-id-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51894",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 2.3.3 - Authenticated PHP Object Injection",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "[*, 2.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24280",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CMSMasters Elementor Addon \u003c= 1.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "cmsmasters-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 1.14.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9694",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Field Template \u003c= 2.6.1 - Authenticated(Contributor+) Information Exposure",
    "slug": "custom-field-template",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6748",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Canto \u003c= 3.0.8 - Unauthenticated Remote File Inclusion",
    "slug": "canto",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4936",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Missing Authorization in 'attach_rule'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1338",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Construction Mode \u003c= 1.8 - Cross-Site Scripting",
    "slug": "wp-construction-mode",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4854",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Private Content Plus \u003c= 3.6.2 - Unauthenticated Information Exposure",
    "slug": "wp-private-content-plus",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10720",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.15.0 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.15.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0080",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "CM Pop-Up Banners \u003c= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cm-pop-up-banners",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5799",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link Library \u003c= 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46237",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Composite Products \u003c= 8.7.5 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-composite-products",
    "type": "plugin",
    "affected_version": "* - 8.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32801",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Deliver via Shipos for WooCommerce \u003c= 3.0.2 - Cross-Site Request Forgery",
    "slug": "wc-shipos-delivery",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57914",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "affiliate-toolkit – WordPress Affiliate Plugin \u003c= 3.5.4 - Missing Authorization via atkp_create_list",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1851",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Precious Metals Charts and Widgets for WordPress \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-site Scripting",
    "slug": "precious-metals-chart-and-widgets",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13572",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Build App Online \u003c= 1.0.23 - Unauthenticated Local File Inclusion",
    "slug": "build-app-online",
    "type": "plugin",
    "affected_version": "* - 1.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49649",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Anywhere Flash Embed \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "anywhere-flash-embed",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47811",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rewrite \u003c= 0.2.1 - Cross-Site Request Forgery",
    "slug": "rewrite",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30617",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "XStore Core \u003c= 5.3.8 - Missing Authorization",
    "slug": "et-core-plugin",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33555",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Captcha \u003c= 2.0.0 - Cross-Site Request Forgery",
    "slug": "wp-captcha",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44236",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Carousel For Elementor \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-carousel-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0280",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shared Files \u003c= 1.7.48 - Unauthenticated Stored Cross-Site Scripting via sanitize_file Function",
    "slug": "shared-files",
    "type": "plugin",
    "affected_version": "* - 1.7.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.48",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4392",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMTP for SendGrid – YaySMTP \u003c= 1.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "smtp-sendgrid",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48301",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Product Specifications for Woocommerce \u003c= 0.6.0 - Reflected Cross-Site Scripting via Arbitrary Query String Parameter",
    "slug": "product-specifications",
    "type": "plugin",
    "affected_version": "* - 0.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46858",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nasa Core \u003c= 6.3.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "nasa-core",
    "type": "plugin",
    "affected_version": "* - 6.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39507",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Podlove Web Player \u003c= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "podlove-web-player",
    "type": "plugin",
    "affected_version": "* - 5.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29788",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Weather Atlas Widget \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "weather-atlas",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5163",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Hour Booking \u003c= 1.3.72 - CAPTCHA Bypass",
    "slug": "appointment-hour-booking",
    "type": "plugin",
    "affected_version": "* - 1.3.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4036",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Hyperlink Group Block \u003c= 1.17.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hyperlink-group-block",
    "type": "plugin",
    "affected_version": "* - 1.17.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49279",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackupBuddy \u003c= 2.2.28 - Sensitive Information Disclosure",
    "slug": "backupbuddy",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-2744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2744",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Demo Awesome \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "demo-awesome",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37206",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Motors – Car Dealer \u0026 Classified Ads \u003c= 1.4.6 - Reflected Cross-Site Scripting",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46208",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calculate Prices based on Distance For WooCommerce \u003c= 1.3.5 - Missing Authorization",
    "slug": "calculate-prices-based-on-distance-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47602",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Complianz | GDPR/CCPA Cookie Consent \u003c= 6.4.5 - Cross-Site Request Forgery",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "[*, 6.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-34030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34030",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Savoy \u003c= 3.0.8 - Unauthenticated Information Exposure",
    "slug": "savoy",
    "type": "theme",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54736",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Dbox 3D Slider Lite \u003c= 1.2.2 - SQL Injection",
    "slug": "dbox-slider-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-5374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5374",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fancy Product Designer \u003c 6.1.81 - Authenticated (Admin+) Stored Cross-Site Scripting via License Field",
    "slug": "fancy-product-designer",
    "type": "plugin",
    "affected_version": "[*, 6.1.81)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.81",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-0904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0904",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UsersWP \u003c= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "userswp",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2423",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Display custom fields in the frontend – Post and User Profile Fields \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_data",
    "slug": "shortcode-to-display-post-and-user-data",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6982",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thim Core \u003c= 2.3.3 - Missing Authorization",
    "slug": "thim-core",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53346",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 5.4.8 - Reflected Cross-Site Scripting in PDF Invoicing Module",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "[*, 5.4.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vision Interactive \u003c= 1.7.1 - Missing Authorization",
    "slug": "vision",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32779",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Views for WPForms \u003c= 3.2.2 - Missing Authorization via save_view",
    "slug": "views-for-wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0370",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Size Charts Plugin for WooCommerce \u003c= 2.4.5 - Missing Authorization",
    "slug": "woo-advanced-product-size-chart",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23991",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Kaswara Modern VC Addons \u003c= 3.0.1 - Arbitrary File Upload",
    "slug": "kaswara",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24284",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Batch Cat \u003c= 0.3 - Missing Authorization",
    "slug": "batch-cat",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24788",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "AddThis Sharing Buttons \u003c= 5.0.12 - Authenticated Cross-Site Scripting",
    "slug": "addthis",
    "type": "plugin",
    "affected_version": "[*, 5.0.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9439",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SearchIQ – The Search Solution \u003c= 3.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "searchiq",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0780",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Time Slots Booking Form \u003c= 1.1.81 - Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "wp-time-slots-booking-form",
    "type": "plugin",
    "affected_version": "* - 1.1.81",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.81",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-23971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23971",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "LC Wizard \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ghl-wizard",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58237",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plugin Oficial – Getnet para WooCommerce \u003c= 1.7.3 - Reflected Cross-Site Scripting",
    "slug": "wc-checkout-getnet",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30906",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hide admin notices – Admin Notification Center \u003c= 2.3.2 - Cross-Site Request Forgery",
    "slug": "wp-admin-notification-center",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41672",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gallery Objects \u003c= 0.4 - SQL Injection",
    "slug": "gallery-objects",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-5201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5201",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Burst Statistics – Privacy-Friendly Analytics for WordPress \u003c= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_count",
    "slug": "burst-statistics",
    "type": "plugin",
    "affected_version": "* - 1.5.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1894",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google SEO Pressor Snippet \u003c= 2.0 - Missing Authorization",
    "slug": "google-seo-author-snippets",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31530",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "eDoc Easy Tables \u003c= 1.29 - Authenticated (Contributor+) SQL Injection",
    "slug": "edoc-easy-tables",
    "type": "plugin",
    "affected_version": "* - 1.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22519",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Mediavine Control Panel \u003c= 2.10.2 - Cross-Site Request Forgery via render_settings_page",
    "slug": "mediavine-control-panel",
    "type": "plugin",
    "affected_version": "* - 2.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44259",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WC Marketplace \u003c= 4.0.23 - Missing Authorization via mvx_save_dashpages",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51355",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "ZooEffect \u003c= 1.11 - Reflected Cross-Site Scripting",
    "slug": "1-jquery-photo-gallery-slideshow-flash",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26954",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Automator Pro \u003c 5.3.0.1 - Cross-Site Request Forgery to License Setting Reset",
    "slug": "uncanny-automator-pro",
    "type": "plugin",
    "affected_version": "[*, 5.3.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-37118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37118",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FoodBook \u003c= 4.7.1 - Unauthenticated Sensitive Information Exposure",
    "slug": "foodbook",
    "type": "theme",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60125",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "1 click disable all \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "first-graders-toolbox",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-21749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-21749",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HD FLV Player \u003c= 1.7 - Arbitrary File Upload",
    "slug": "contus-hd-flv-player",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-10011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10011",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-RecentComments \u003c= 2.2.7 - Unauthenticated Information Exposure",
    "slug": "wp-recentcomments",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23886",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Maintenance \u003c= 5.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-maintenance",
    "type": "plugin",
    "affected_version": "* - 5.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-19979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19979",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H"
  },
  {
    "title": "Elements kit Elementor addons \u003c= 2.9.1 - Missing Authorization",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39993",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP 2FA – Two-factor authentication for WordPress \u003c= 2.2.0 - Reflected Cross-Site Scripting",
    "slug": "wp-2fa",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1527",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Memphis Documents Library \u003c= 2.6.16 - Local File Inclusion",
    "slug": "memphis-documents-library",
    "type": "plugin",
    "affected_version": "* - 2.6.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-10384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10384",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woocommerce Notify Updated Product \u003c= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "woocommerce-notify-updated-product",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58856",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenify \u003c= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutenify",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32168",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Log \u003c= 2.4.6 - Admin+ SQL Injection",
    "slug": "email-log",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24758",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Magways \u003c= 1.2.1 - Unauthenticated Local File Inclusion",
    "slug": "magways",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49281",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CSS Hero \u003c= 4.0.3 - Reflected Cross-Site Scripting",
    "slug": "css-hero",
    "type": "plugin",
    "affected_version": "* - 4.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19133",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.17",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.13",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.11",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.2",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.39",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.36",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.28",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.21",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.7",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.5",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.4",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.39",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.33",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.29",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.27",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.24",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.24",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.20",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.14",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.37",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.36",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.16",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.10",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Information Disclosure (Email Address)",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.9",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Blue Wrench Video Widget \u003c 2.0.0 - Cross-Site Request Forgery and to Cross-Site Scripting",
    "slug": "blue-wrench-videos-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-6797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6797",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Time Sheets \u003c= 2.1.3 - Reflected Cross-Site Scripting",
    "slug": "time-sheets",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49054",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVG Block \u003c= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "svg-block",
    "type": "plugin",
    "affected_version": "* - 1.1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11098",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCargo Track \u0026 Trace \u003c= 8.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference",
    "slug": "wpcargo",
    "type": "plugin",
    "affected_version": "* - 8.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31609",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TNC PDF viewer \u003c= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "pdf-viewer-by-themencode",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25097",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Robo Gallery \u003c= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47521",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Remove CPT base \u003c= 5.8 - Cross-Site Request Forgery to CPT base deletion",
    "slug": "remove-cpt-base",
    "type": "plugin",
    "affected_version": "* - 5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29431",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Visual Sound (old) \u003c= 1.06 -  Cross-Site Request Forgery to Settings Update",
    "slug": "visual-sound-widget-for-soundcloud-and-artistplugme-visualdreams",
    "type": "plugin",
    "affected_version": "* - 1.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8047",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "StaffList \u003c= 3.2.6 - Missing Authorization",
    "slug": "stafflist",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32232",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Disable Comments | WPZest \u003c= 1.51 - Authenticated (Administrator+) SQL Injection",
    "slug": "disable-comments-wpz",
    "type": "plugin",
    "affected_version": "* - 1.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.51",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32135",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Kahuna \u003c= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kahuna",
    "type": "theme",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43994",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Pro \u003c= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets",
    "slug": "elementskit",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3500",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "aThemes Addons for Elementor Lite \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "athemes-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.5.1 - Arbitrary File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-2392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-2392",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 3.3.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-2404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2404",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ENL Newsletter \u003c= 1.0.1 - Cross-Site Request Forgery to Campaign Deletion",
    "slug": "enl-newsletter",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3059",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress \u003c= 2.8.6 - Reflected Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-8815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qi Addons For Elementor \u003c= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "qi-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47680",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Made Easy \u003c= 2.2.35 - Subscriber+ SQL Injection",
    "slug": "events-made-easy",
    "type": "plugin",
    "affected_version": "* - 2.2.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.35",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25030",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.3.1 - Cross-Site Request Forgery to WPForm/Blocks Import",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23825",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "JetElements \u003c= 2.6.10 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-39157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39157",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fan Page Widget by ThemeNcode \u003c= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "facebook-fan-page-widget",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33695",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Categories Post Footer \u003c= 2.2.2 - Reflected Cross-Site Scripting",
    "slug": "add-categories-post-footer",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49239",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Feed \u003c= 1.2.7 - Cross-Site Request Forgery leading to Limited Plugin Activation",
    "slug": "ht-instagram",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23804",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ReConstruction \u003c= 1.4.7 - Reflected Cross-Site Scripting",
    "slug": "reconstruction",
    "type": "theme",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52417",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Consent \u0026 Compliance Notice \u003c= 1.8.2 - Authenticated Stored Cross-Site Scripting and Authorization Bypass",
    "slug": "cookie-law-info",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-20633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-20633",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce EnvioPack \u003c= 1.2 Reflected Cross-Site Scripting",
    "slug": "woo-enviopack",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39314",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PKT1 Centro de envios \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "pkt1-centro-de-envios",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11806",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beautiful Cookie Consent Banner \u003c= 2.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "beautiful-and-responsive-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3823",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Basic Ordernumbers \u003c= 1.4.4 - Missing Authorization",
    "slug": "woocommerce-basic-ordernumbers",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55992",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Linkify Text \u003c= 1.9.1 - Unauthenticated Full Path Disclosure",
    "slug": "linkify-text",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7382",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MagicForm - WordPress Form Builder \u003c= 1.6.2 - Missing Authorization",
    "slug": "magicform",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0939",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "User Activity Log Pro \u003c= 2.3.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "user-activity-log-pro",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32137",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Job Board and Recruitment Plugin – JobWP \u003c= 2.1 - Sensitive Information Exposure",
    "slug": "jobwp",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48288",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP ULike – Most Advanced WordPress Marketing Toolkit \u003c= 4.6.9 - Authenticated (Contributor+) SQL Injection via Shortcodes",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1797",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BuddyBoss Media \u003c= 3.2.3 - Stored Cross-Site Scripting",
    "slug": "buddyboss-media",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-21014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-21014",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export Post Info \u003c= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "export-post-info",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38068",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "xili-tidy-tags \u003c= 1.12.06 - Reflected Cross-Site Scripting",
    "slug": "xili-tidy-tags",
    "type": "plugin",
    "affected_version": "* - 1.12.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47680",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Videochat Turnkey Site \u003c= 7.3.11 - Authentication Bypass",
    "slug": "ppv-live-webcams",
    "type": "plugin",
    "affected_version": "* - 7.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31380",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Embed PDF \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "dirtysuds-embed-pdf",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4788",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventin \u003c= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47539",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Calendar \u003c= 3.4.3 - Cross-Site Request Forgery",
    "slug": "my-calendar",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23813",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multi Rating \u003c= 5.0.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "multi-rating",
    "type": "plugin",
    "affected_version": "* - 5.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47433",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.3.6 - Missing Authorization",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35725",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Chauffeur Taxi Booking System for WordPress \u003c= 6.9 - Unauthenticated Arbitrary File Upload",
    "slug": "chauffeur-booking-system",
    "type": "plugin",
    "affected_version": "* - 6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31115",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Simple Redirection \u003c= 1.5 - Cross-Site Request Forgery to Arbitrary Site Redirect",
    "slug": "eelv-redirection",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11341",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Molongui \u003c= 4.6.19 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "molongui-authorship",
    "type": "plugin",
    "affected_version": "* - 4.6.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39921",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directorist \u003c= 7.3.0 - Sensitive Information Disclosure",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2376",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Salon booking system \u003c= 10.8.1 - Unauthenticated Open Redirect",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 10.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43280",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hummingbird \u003c= 3.4.1 - Unauthenticated Path Traversal",
    "slug": "hummingbird-performance",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1478",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPMozo Addons Lite for Elementor \u003c= 1.1.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wpmozo-addons-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56282",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARForms Form Builder \u003c= 1.6.4 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletion",
    "slug": "arforms-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1945",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.24 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2666",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Bootstrap Elements for Elementor \u003c= 1.4.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "ultimate-bootstrap-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37462",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP App Maker \u003c= 1.0.16.4 - Reflected Cross-Site Scripting",
    "slug": "wp-app-maker",
    "type": "plugin",
    "affected_version": "* - 1.0.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4578",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LifterLMS – WordPress LMS Plugin for eLearning \u003c= 7.5.1 - Missing Authorization via process_review",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "* - 7.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0377",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Arcade Ready \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "arcadeready",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22581",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mailing Group Listserv \u003c= 3.0.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-mailing-group",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46463",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Custom Field Template \u003c= 2.5.7 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "custom-field-template",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4324",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MaxButtons \u003c= 9.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "* - 9.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39444",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritping",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0586",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Share VOD – Turnkey Video Site Builder Script \u003c= 2.7.6 - Cross-Site Request Forgery to Command Injection",
    "slug": "video-share-vod",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7812",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Nextend Social Login and Register \u003c= 1.5.0 - Cross-Site Scripting",
    "slug": "nextend-facebook-connect",
    "type": "plugin",
    "affected_version": "[*, 1.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-8800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8800",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Frontend Uploader \u003c 0.9.4 - Cross-Site Scripting",
    "slug": "frontend-uploader",
    "type": "plugin",
    "affected_version": "[*, 0.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9444",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed PDF for WPForms \u003c= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "embed-pdf-wpforms",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10647",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions)  - Reflected DOM-Based Cross-Site Scripting via content",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "20.0.0 - 21.8.0",
    "from_version": "20.0.0",
    "from_inclusive": true,
    "to_version": "21.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10636",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions)  - Reflected DOM-Based Cross-Site Scripting via content",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "7.0.0 - 8.8.0",
    "from_version": "7.0.0",
    "from_inclusive": true,
    "to_version": "8.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10636",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions)  - Reflected DOM-Based Cross-Site Scripting via content",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "30.0.0 - 31.8.0",
    "from_version": "30.0.0",
    "from_inclusive": true,
    "to_version": "31.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10636",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Transposh WordPress Translation \u003c= 1.0.9.1 - Missing Authorization Checks",
    "slug": "transposh-translation-filter-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25810",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core 5.4 - 5.8 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.4, 5.4.7)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-39200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39200",
    "auth_type": "Auth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core 5.4 - 5.8 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.5, 5.5.6)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-39200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39200",
    "auth_type": "Auth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core 5.4 - 5.8 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.6, 5.6.5)",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-39200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39200",
    "auth_type": "Auth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core 5.4 - 5.8 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.7, 5.7.3)",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-39200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39200",
    "auth_type": "Auth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core 5.4 - 5.8 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.8, 5.8.1)",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-39200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39200",
    "auth_type": "Auth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Bricksbuilder \u003c= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave",
    "slug": "bricks",
    "type": "theme",
    "affected_version": "* - 1.9.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2297",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.48  - Authenticated (Admin+) Cross Site Scripting (XSS)",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47170",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom User CSS \u003c= 0.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "custom-user-css",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6391",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dashboard Widgets Suite \u003c= 3.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dashboard-widgets-suite",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49743",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Doneren met Mollie \u003c= 2.8.4 - Information Disclosure",
    "slug": "doneren-met-mollie",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4377",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.4.2. - HTML Injection",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 6.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54940",
    "auth_type": "Privileged",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery \u003c= 1.5.74 - File Upload Path Traversal",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.75)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.75",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24363",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Cf7Save Extension \u003c= 1 - Reflected Cross-Site Scripting",
    "slug": "cf7save-extension",
    "type": "plugin",
    "affected_version": "* - 1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22331",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Capitalize My Title \u003c= 0.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "capitalize-my-title",
    "type": "plugin",
    "affected_version": "* - 0.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53760",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shared Files – Frontend File Upload Form \u0026 Secure File Sharing \u003c= 1.7.42 - Limited Unauthenticated Stored Cross-Site Scripting via File Upload",
    "slug": "shared-files",
    "type": "plugin",
    "affected_version": "* - 1.7.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.42",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Master \u003c= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text']",
    "slug": "ajax-filter-posts",
    "type": "plugin",
    "affected_version": "* - 3.4.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5084",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp-FileManager \u003c= 1.2 - Arbitrary File Upload",
    "slug": "wp-filemanager",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-0222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0222",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Widgets on Pages \u003c= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "widgets-on-pages",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4488",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce \u003c= 2.6.15 - Reflected Cross-Site Scripting",
    "slug": "sender-net-automated-emails",
    "type": "plugin",
    "affected_version": "* - 2.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43126",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spare \u003c= 1.7 - Unauthenticated PHP Object Injection",
    "slug": "spare",
    "type": "theme",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31919",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sumo \u003c= 1.34 - Cross-Site Request Forgery",
    "slug": "sumome",
    "type": "plugin",
    "affected_version": "* - 1.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31265",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Optimizer WD \u003c= 1.0.26 - Reflected Cross-Site Scripting",
    "slug": "image-optimizer-wd",
    "type": "plugin",
    "affected_version": "* - 1.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2122",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import XML and RSS Feeds \u003c= 2.1.5 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "import-xml-feed",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31292",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "SI CAPTCHA Anti-Spam \u003c 2.7.6 - Reflected Cross-Site Scripting",
    "slug": "si-captcha-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 2.7.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-5190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5190",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Custom Layouts – Post + Product grids made easy \u003c= 1.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-layouts",
    "type": "plugin",
    "affected_version": "* - 1.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43305",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "gSlideShow \u003c= 0.1 - Cross-Site Request Forgery",
    "slug": "gslideshow",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9391",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks – Page Builder Features \u003c= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2273",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RomethemeKit For Elementor \u003c= 1.4.1 - Missing Authorization",
    "slug": "rometheme-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33919",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DesignThemes Core Features \u003c= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "designthemes-core-features",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0845",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup and Restore WordPress \u003c= 1.50 - Missing Authorization",
    "slug": "wp-backitup",
    "type": "plugin",
    "affected_version": "* - 1.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43268",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Membership Subscriptions – Effortless Memberships, Recurring Payments \u0026 Content Restriction \u003c= 2.12.8 - Reflected Cross-Site Scripting",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.12.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9222",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dreamfox Media Payment gateway per Product for Woocommerce \u003c= 3.5.8 - Missing Authorization",
    "slug": "woocommerce-product-payments",
    "type": "plugin",
    "affected_version": "* - 3.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55996",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio \u003c= 3.6.4 - Cross-Site Request Forgery",
    "slug": "play-ht",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0827",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Gallery Plugin \u003c= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wordpress-gallery-plugin",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23842",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Noo JobMonster \u003c 4.5.2.9 - Reflected Cross-Site Scripting",
    "slug": "noo-jobmonster",
    "type": "theme",
    "affected_version": "[*, 4.5.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1170",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fast Flow \u003c= 1.2.16 - Reflected Cross-Site Scripting",
    "slug": "fast-flow-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26868",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Forms \u003c= 6.7 - HTML Injection",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "* - 6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6830",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Foliopress WYSIWYG \u003c= 2.6.18 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "foliopress-wysiwyg",
    "type": "plugin",
    "affected_version": "* - 2.6.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32610",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin 4.2.1 - 4.2.12 - Unprotected AJAX Actions",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "4.2.1 - 4.2.12",
    "from_version": "4.2.1",
    "from_inclusive": true,
    "to_version": "4.2.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35948",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ShortPixel Image Optimizer \u003c= 5.6.3 - Authenticated (Editor+) SQL Injection",
    "slug": "shortpixel-image-optimiser",
    "type": "plugin",
    "affected_version": "* - 5.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48043",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE \u003c= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3343",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Code Clone \u003c= 0.9 - Authenticated (Administrator+) SQL Injection via snippetId Parameter",
    "slug": "code-clone",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2478",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5073",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Custom Fields Search \u003c= 1.2.34 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-custom-fields-search",
    "type": "plugin",
    "affected_version": "* - 1.2.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47157",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All Bootstrap Blocks \u003c= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "all-bootstrap-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43349",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Users \u003c= 1.3 - SQL Injection",
    "slug": "wordpress-users",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2011-4669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4669",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPFavicon \u003c= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wpfavicon",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-37558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37558",
    "auth_type": "Privileged",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Easy Filter \u003c= 1.10 - Reflected Cross-Site Scripting",
    "slug": "easy-filter",
    "type": "plugin",
    "affected_version": "* - 1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23788",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vertical scroll recent post \u003c= 13.8 - Reflected Cross-Site Scripting",
    "slug": "vertical-scroll-recent-post",
    "type": "plugin",
    "affected_version": "[*, 14.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1171",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form builder with drag \u0026 drop - Kali Forms \u003c= 2.3.27 - Missing Authorization via Contact Form",
    "slug": "kali-forms",
    "type": "plugin",
    "affected_version": "* - 2.3.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46083",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Checkfront Online Booking System \u003c= 3.6 - Cross-Site Request Forgery",
    "slug": "checkfront-wp-booking",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44146",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Job Manager \u0026 Career – Manage job board listings, and recruitments \u003c= 1.4.4 - Cross-Site Request Forgery to PHP Object Injection",
    "slug": "job-manager-career",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51545",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPAMS \u003c= 44.0 (17-08-2023) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "apartment-management",
    "type": "plugin",
    "affected_version": "[*, 44.0 (17-08-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "44.0 (17-08-2023)",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39405",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "eDoc Employee Job Application \u003c= 1.13 - Reflected Cross-Site Scripting",
    "slug": "edoc-employee-application",
    "type": "plugin",
    "affected_version": "* - 1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48322",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10148",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "InFunding – Plugin for Charity \u0026 Crowdfunding Website \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "infunding",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23768",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sensei Pro (WC Paid Courses) \u003c= 4.23.1.1.23.1 - Authenticated (Student+) Stored Cross-Site Scripting",
    "slug": "woothemes-sensei",
    "type": "plugin",
    "affected_version": "* - 4.23.1.1.23.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.23.1.1.23.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34765",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fast Flow \u003c= 1.2.10 - Cross-Site Scripting",
    "slug": "fast-flow-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1269",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Perfmatters \u003c= 2.1.6 - Reflected Cross-Site Scripting",
    "slug": "perfmatters",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47876",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteGround Security \u003c= 1.2.5 - Authentication Bypass via 2FA Setup",
    "slug": "sg-security",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0992",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form vCard Generator \u003c= 2.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contact-form-vcard-generator",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31582",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MFPlugin \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mfplugin",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23660",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.7.0.62 - Unauthenticated Sensitive Information Exposure",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.7.0.62",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.0.62",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58015",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Responsive Tabs \u003c= 4.0.5 - Authenticated Stored Cross-Site Scripting",
    "slug": "responsive-tabs",
    "type": "plugin",
    "affected_version": "* - 4.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36893",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pro Quoter Plugin \u003c= 1.0 - Cross-Site Scripting",
    "slug": "proquoter",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4545",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Guten Free Options \u003c= 0.9.5 - Reflected Cross-Site Scripting",
    "slug": "guten-free-options",
    "type": "plugin",
    "affected_version": "* - 0.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13492",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form \u0026 SMTP Plugin for WordPress by PirateForms \u003c= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "pirate-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13453",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "ONet Regenerate Thumbnails \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "onet-regenerate-thumbnails",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53264",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Auction Nudge – Your eBay on Your Site \u003c= 7.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "auction-nudge",
    "type": "plugin",
    "affected_version": "* - 7.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24658",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BVD Easy Gallery Manager \u003c= 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "bvd-easy-gallery-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22353",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Allow PHP Execute \u003c= 1.0 - Authenticated (Editor+) PHP Code Injection",
    "slug": "allow-php-execute",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13890",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TS Webfonts for SAKURA  \u003c= 3.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ts-webfonts-for-sakura",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32624",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Intagrate Lite \u003c= 1.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "instagrate-to-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31929",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Asgaros Forum \u003c= 2.7.2 - Unauthenticated PHP Object Injection in prepare_unread_status",
    "slug": "asgaros-forum",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-22284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22284",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MailerLite – WooCommerce integration \u003c= 2.0.8 - Missing Authorization via Multiple Functions",
    "slug": "woo-mailerlite",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52227",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "XML Multilanguage Sitemap Generator \u003c= 2.0.6 - Missing Authorization",
    "slug": "xml-multilanguage-sitemap-generator",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55999",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MapSVG \u003c= 8.5.32 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "mapsvg",
    "type": "plugin",
    "affected_version": "* - 8.5.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.32",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47559",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GPS Plotter \u003c= 5.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gps-plotter",
    "type": "plugin",
    "affected_version": "* - 5.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30874",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "decode-uri-component \u003c= 0.2.1 - Denial of Service",
    "slug": "autoshare-for-twitter",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38900",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "CP Contact Form with PayPal \u003c 1.1.6 - Cross-Site Request Forgery",
    "slug": "cp-contact-form-with-paypal",
    "type": "plugin",
    "affected_version": "[*, 1.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9233",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Guest Author \u003c= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "guest-author",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pages Order \u003c= 1.1.3 - Reflected Cross-Site Scripting",
    "slug": "pages-order",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31445",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Back Button \u003c= 1.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-back-button",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35643",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – FreightQuote Edition \u003c= 2.3.11 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-freightquote-edition",
    "type": "plugin",
    "affected_version": "* - 2.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22290",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks \u003c= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1291",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Next Page \u003c= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "next-page",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45768",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP 2.4.0 - 2.9.7 - Reflected Cross Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "[2.4.0, 2.10.0)",
    "from_version": "2.4.0",
    "from_inclusive": true,
    "to_version": "2.10.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24213",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swift Framework \u003c 2024.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "socialdriver-framework",
    "type": "plugin",
    "affected_version": "[*, 2024.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-2697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2697",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2399",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker – Customer Satisfaction Questionnaire, Chat Survey, Calculation Form, Payment Forms \u003c= 4.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 4.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8488",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "trust-reviews",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9899",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AHAthat Plugin \u003c= 1.6 - Authenticated (Administrator+) SQL Injection via id Parameter",
    "slug": "ahathat",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2511",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Payment Forms for Paystack \u003c= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "payment-forms-for-paystack",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10894",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stockholm \u003c= 9.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "stockholm",
    "type": "theme",
    "affected_version": "* - 9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-34552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34552",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Maker \u003c= 1.19.2 - Missing Authorization",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.19.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47358",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Timeline – Vertical and Horizontal timeline plugin \u003c= 3.6.7 - Unauthenticated Local File Inclusion",
    "slug": "wp-timelines",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-47323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47323",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Block Plugin Update \u003c= 3.3.1 - Cross-Site Request Forgery via bspu_plugin_select.php",
    "slug": "block-specific-plugin-updates",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44261",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 5.9.14 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attribute",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3333",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Pro \u003c= 7.21.0 - Missing Authorization",
    "slug": "bdthemes-element-pack",
    "type": "plugin",
    "affected_version": "* - 7.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.21.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46258",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.09 - Unauthenticated Local/Remote File Inclusion \u0026 Remote Code Execution",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.09",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.09",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-4634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4634",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Maps made Simple \u003c= 0.6 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "wp-gmappity-easy-google-maps",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5315",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Logo Showcase \u003c= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "logo-showcase",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47497",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTTP Headers \u003c= 1.18.8 - Authenticated(Administrator+) SQL Injection",
    "slug": "http-headers",
    "type": "plugin",
    "affected_version": "* - 1.18.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1207",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Sign Up \u003c= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-sign-up",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23701",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Social Widget \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-social-widget",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49306",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WOW Entrance Effects (WEE!) \u003c= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wow-entrance-effects-wee",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1560",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega \u003c= 2.3.3 - Cross-Site Request Forgery via Several Functions",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51529",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JSON API User \u003c= 3.9.3 - Unauthenticated Privilege Escalation",
    "slug": "json-api-user",
    "type": "plugin",
    "affected_version": "* - 3.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6624",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Genesis Blocks \u003c= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Content",
    "slug": "genesis-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1946",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maintenance Notice \u003c= 1.0.6 - Cross-Site Request Forgery",
    "slug": "maintenance-notice",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28859",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Booking Calendar \u003c= 1.6.9 - Unauthenticated SQL Injection",
    "slug": "advanced-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0694",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 5.4 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "* - 5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25042",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Popups \u003c= 4.7.5 - Open Redirect",
    "slug": "arscode-ninja-popups",
    "type": "plugin",
    "affected_version": "* - 4.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27861",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Random Image Selector \u003c= 2.4 - Reflected Cross-Site Scripting",
    "slug": "random-image-selector",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26548",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2922",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Plugin by Squirrly SEO \u003c= 12.1.20 - Reflected Cross-Site Scripting via 'page' and 'tab'",
    "slug": "squirrly-seo",
    "type": "plugin",
    "affected_version": "* - 12.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45065",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InstaWP Connect \u003c= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.0.9.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.9.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-3956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3956",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ShopLentor – WooCommerce Builder for Elementor \u0026 Gutenberg +20 Modules – All in One Solution (formerly WooLentor) \u003c= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3775",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce \u003c= 3.4.6 - Improper Authorization",
    "slug": "a4-barcode-generator",
    "type": "plugin",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1677",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c= 2.2 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-3140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-3140",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Password Protected \u003c= 2.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "password-protected",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32580",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Filebird \u003c= 6.3.2 - Missing Authorization",
    "slug": "filebird",
    "type": "plugin",
    "affected_version": "* - 6.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53825",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tab My Content \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "tab-my-content",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23601",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Button Widget Smartsoft \u003c= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "smartsoftbutton-widget-de-botones-de-chat",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1912",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Play.ht \u003c= 3.6.4 - Missing Authorization",
    "slug": "play-ht",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37233",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PayU CommercePro Plugin \u003c= 3.8.3 - Unauthenticated Privilege Escalation",
    "slug": "payu-india",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12264",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hide My WP Ghost – Security \u0026 Firewall \u003c= 5.3.01 - Reflected Cross-Site Scripting via URL",
    "slug": "hide-my-wp",
    "type": "plugin",
    "affected_version": "* - 5.3.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10825",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aiomatic \u003c= 1.9.3 - Missing Authorization",
    "slug": "aiomatic-automatic-ai-content-writer",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Music Request Manager \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "music-request-manager",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6017",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Booking Calendar \u003c= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 10.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6930",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DNUI \u003c= 2.8.1 - Cross-Site Request Forgery leading to Unused Image Deletion and Database Image Access",
    "slug": "dnui-delete-not-used-image-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47609",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
  },
  {
    "title": "Homey \u003c= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check",
    "slug": "homey",
    "type": "theme",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0749",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Builder by SiteOrigin \u003c= 2.10.15 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "siteorigin-panels",
    "type": "plugin",
    "affected_version": "[*, 2.10.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-13643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13643",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Ultimate CSV Importer \u003c= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 7.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4141",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Launchpad \u003c= 1.0.13 - Cross-Site Request Forgery",
    "slug": "launchpad-by-obox",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-46854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46854",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Affiliate Disclosure \u003c= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via $id",
    "slug": "wp-affiliate-disclosure",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52178",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zenny \u003c= 1.7.5 - Unauthenticated Local File Inclusion",
    "slug": "bw-zenny",
    "type": "theme",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-24769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24769",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "iCafe Library \u003c= 1.8.3 - Authenticated (Editor+) SQL Injection",
    "slug": "icafe-library",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39370",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Defender Security \u003c= 4.4.1 - IP Address Spoofing",
    "slug": "defender-security",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25595",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.9.6 - Authenticated (Administrator+) Directory Traversal",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6120",
    "auth_type": "Privileged",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WP FuneralPress \u003c= 1.1.6 - Cross-Site Scripting",
    "slug": "wp-funeral-press",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-3529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3529",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Table of content \u003c= 1.5.3.1 - Cross-Site Request Forgery",
    "slug": "content-table",
    "type": "plugin",
    "affected_version": "* - 1.5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58857",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Local Delivery Drivers for WooCommerce \u003c= 1.9.0 - Missing Authorization to Driver Account Takeover",
    "slug": "local-delivery-drivers-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51481",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Mega Main Menu \u003c=  2.2.2 - Authenticated (Administrator+) Cross-Site Scripting",
    "slug": "mega_main_menu",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1575",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UsersWP – Front-end login form, User Registration, User Profile \u0026 Members Directory plugin for WP \u003c= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories",
    "slug": "userswp",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6477",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Connections Business Directory \u003c 8.5.9 - Cross-Site Scripting",
    "slug": "connections",
    "type": "plugin",
    "affected_version": "[*, 8.5.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-0770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-0770",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WCP Contact Form \u003c= 3.1.0 - Missing Authorization via downloadCsv",
    "slug": "wcp-contact-form",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32520",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution \u003c= 2.0.00 - Missing Authorization",
    "slug": "marketking-multivendor-marketplace-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12413",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Navayan Subscribe \u003c= 1.13 - Cross-Site Request Forgery",
    "slug": "navayan-subscribe",
    "type": "plugin",
    "affected_version": "* - 1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53311",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP MultiTasking \u003c= 0.1.12 - Cross-Site Request Forgery to SMTP Settings Update",
    "slug": "wp-multitasking",
    "type": "plugin",
    "affected_version": "* - 0.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6856",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Revisions Manager \u003c= 1.0.2 - Cross-Site Request Forgery",
    "slug": "Plugin",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53761",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Internal Link Juicer: SEO Auto Linker for WordPress \u003c= 2.24.3 - Cross-Site Request Forgery",
    "slug": "internal-links",
    "type": "plugin",
    "affected_version": "* - 2.24.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.24.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37941",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Data Access \u003c= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wp-data-access",
    "type": "plugin",
    "affected_version": "* - 5.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1874",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Performance Pack \u003c= 2.5.4 - Cross-Site Request Forgery",
    "slug": "wp-performance-pack",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32485",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Platinum SEO \u003c= 2.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "platinum-seo-pack",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31089",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Dynamic Pricing and Discount Rules \u003c= 2.4.0 - Cross-Site Request Forgery",
    "slug": "woo-conditional-discount-rules-for-checkout",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40559",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PayPlus Payment Gateway \u003c= 7.0.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "payplus-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 7.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37564",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Woo Custom and Sequential Order Number \u003c= 2.6.0 - Cross-Site Request Forgery",
    "slug": "woo-custom-and-sequential-order-number",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47687",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.5.30 - SQL Injection",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.31)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.31",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-14313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14313",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "asMember \u003c= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "asmember",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26541",
    "auth_type": "Privileged",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "GD Rating System \u003c= 2.3 - Directory Traversal",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-5290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5290",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Birthdays Widget \u003c= 1.7.18 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "birthdays-widget",
    "type": "plugin",
    "affected_version": "* - 1.7.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1643",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.22.1 - Authenticated (Contributor+) Arbitrary SVG Download",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.22.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.22.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37437",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "dsSearchAgent: WordPress Edition \u003c= 1.0-beta10 - Reflected Cross-Site Scripting",
    "slug": "dssearchagent-wordpress-edition",
    "type": "plugin",
    "affected_version": "[*, 1.0-beta10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0-beta10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woo superb slideshow transition gallery with random effect \u003c= 9.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "woo-superb-slideshow-transition-gallery-with-random-effect",
    "type": "plugin",
    "affected_version": "* - 9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9199",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SimpleCharm \u003c= 1.4.3 - Reflected Cross-Site Scripting",
    "slug": "simplecharm",
    "type": "theme",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56056",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery – Photo Albums Plugin \u003c= 1.3.170 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-media-gallery",
    "type": "plugin",
    "affected_version": "* - 1.3.170",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.170",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31586",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mind3doM RyeBread Widgets \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "mind3dom-ryebread-widgets",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23722",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Add-ons \u003c= 6.1.3 - Authenticated (Shop Manager+) PHP Object Injection",
    "slug": "woocommerce-product-addons",
    "type": "plugin",
    "affected_version": "* - 6.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32795",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Enter Addons \u003c= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "enteraddons",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56252",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Showcase \u003c= 1.22.15 - Object Injection",
    "slug": "team",
    "type": "plugin",
    "affected_version": "[*, 1.22.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-35938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35938",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blog2Social: Social Media Auto Post \u0026 Scheduler \u003c= 7.4.2 - Information Exposure",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "* - 7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3678",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Slider Revolution \u003c= 6.7.36 - Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images'",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.7.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9217",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Post Grid, Slider \u0026 Carousel Ultimate – with Shortcode, Gutenberg Block \u0026 Elementor Widget \u003c= 1.6.10 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "post-grid-carousel-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13408",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sharable Password Protected Posts \u003c= 1.1.0 - Unauthenticated Password protected Post Exposure",
    "slug": "sharable-password-protected-posts",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5920",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "RestroPress – Online Food Ordering System \u003c= 3.1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "restropress",
    "type": "plugin",
    "affected_version": "* - 3.1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35719",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Directory Plugin \u003c= 5.11 - Authenticated PHP4 Upload",
    "slug": "business-directory-plugin",
    "type": "plugin",
    "affected_version": "* - 5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24248",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Video List Manager \u003c= 1.7 - Missing Authorization",
    "slug": "video-list-manager",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49986",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce \u003c= 2.6.18 - Cross-Site Request Forgery",
    "slug": "sender-net-automated-emails",
    "type": "plugin",
    "affected_version": "* - 2.6.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39657",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event post \u003c= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "event-post",
    "type": "plugin",
    "affected_version": "* - 5.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26923",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spam protection, AntiSpam, FireWall by CleanTalk \u003c= 6.20 - Cross-Site Request Forgery",
    "slug": "cleantalk-spam-protect",
    "type": "plugin",
    "affected_version": "* - 6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51535",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Preloader for Website \u003c= 1.2.2 - Missing Authorization via plwao_register_settings()",
    "slug": "preloader-for-website",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48273",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pretty Links \u003c= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link",
    "slug": "pretty-link",
    "type": "plugin",
    "affected_version": "[*, 2.1.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-25147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25147",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently \u003c= 4.1.1 - Authenticated (Contributor+) PHP Object Injection in mep_event_meta_save",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-24796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24796",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 1.5.1.3 - Arbitrary Email Content Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 1.5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2005-2109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2005-2109",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProfileGrid  \u003c= 5.8.7 - Missing Authorization",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37453",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Appointment Booking \u0026amp; Scheduling \u003c= 1.9 - Cross-Site Request Forgery",
    "slug": "advanced-appointment-booking-scheduling",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57978",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery ( Responsive ) \u003c= 4.0 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "photo-gallery-pearlbells",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27276",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Amazon Product Information \u003c= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "easy-amazon-product-information",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26568",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WS Form LITE and Pro \u003c 1.8.176 - Stored Cross-Site Scripting",
    "slug": "ws-form",
    "type": "plugin",
    "affected_version": "[*, 1.8.176)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.176",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-23987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23987",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WS Form LITE and Pro \u003c 1.8.176 - Stored Cross-Site Scripting",
    "slug": "ws-form-pro",
    "type": "plugin",
    "affected_version": "[*, 1.8.176)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.176",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-23987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23987",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Community by PeepSo \u003c= 6.3.1.1 - Reflected Cross-Site Scripting",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0187",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "140+ Widgets | Xpro Addons For Elementor – FREE \u003c= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12584",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Forms for Mailchimp \u003c= 6.8.10 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "yikes-inc-easy-mailchimp-extender",
    "type": "plugin",
    "affected_version": "* - 6.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4925",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsReady Addons for Elementor \u003c= 6.6.2 - Cross-Site Request Forgery",
    "slug": "element-ready-lite",
    "type": "plugin",
    "affected_version": "* - 6.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39546",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Coupon Affiliates \u003c= 5.12.7 - Reflected Cross-Site Scripting",
    "slug": "woo-coupon-usage",
    "type": "plugin",
    "affected_version": "* - 5.12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29125",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KB Support – WordPress Help Desk and Knowledge Base \u003c= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions",
    "slug": "kb-support",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8548",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Contact Form With Captcha \u003c= 1.6.7 - Cross-Site Request Forgery",
    "slug": "contact-form-with-captcha",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-42358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42358",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NotificationX \u003c= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "notificationx",
    "type": "plugin",
    "affected_version": "* - 2.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22683",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.35.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.35.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10402",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads – Commissions \u003c= 3.1.2 - Reflected Cross-Site Scripting",
    "slug": "edd-commissions",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9508",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPFront Notification Bar \u003c= 1.9.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wpfront-notification-bar",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24518",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enfold \u003c= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wrapper_class and class Parameters",
    "slug": "enfold",
    "type": "theme",
    "affected_version": "* - 6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Otter Blocks PRO \u003c= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG Upload",
    "slug": "otter-pro",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1691",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Feed – Social Photos Gallery – Post Feed – Like Box \u003c= 6.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 6.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1278",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Subscriptions \u003c 5.8.0 - Missing Authorization",
    "slug": "woocommerce-subscriptions",
    "type": "plugin",
    "affected_version": "[*, 5.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50850",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Listings for Buildium \u003c= 0.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "listings-for-buildium",
    "type": "plugin",
    "affected_version": "* - 0.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32606",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "teachPress \u003c= 9.0.7 - Authenticated (Contributor+) SQL Injection",
    "slug": "teachpress",
    "type": "plugin",
    "affected_version": "* - 9.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1321",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Affiliate Plugin - Coupon Affiliates \u003c 4.16.4.5 - Stored Cross-Site Scripting",
    "slug": "woo-coupon-usage",
    "type": "plugin",
    "affected_version": "[*, 4.16.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16.4.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0818",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Posts Grid \u003c= 1.7 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "featured-posts-grid",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28905",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress \u003c= 7.3.4 - Insecure Direct Object Reference",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36865",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Column Widgets \u003c= 1.2.7 - Open Redirect via responsive_column_widgets_link",
    "slug": "responsive-column-widgets",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45762",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "News Element Elementor Blog Magazine \u003c= 1.0.5 - Unauthenticated Local File Inlcusion",
    "slug": "news-element",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6459",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Change Memory Limit \u003c= 1.0 - Missing Authorization via admin_logic()",
    "slug": "change-memory-limit",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1093",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mollie Forms \u003c= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mollie-forms",
    "type": "plugin",
    "affected_version": "* - 2.7.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47502",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "guzzlehttp/psr7 \u003c 1.9.1 \u0026 2.4.5 - Interpretation Conflict",
    "slug": "wp-ses",
    "type": "plugin",
    "affected_version": "[*, 1.6.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-29197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29197",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "guzzlehttp/psr7 \u003c 1.9.1 \u0026 2.4.5 - Interpretation Conflict",
    "slug": "amazon-s3-and-cloudfront",
    "type": "plugin",
    "affected_version": "[*, 3.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-29197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29197",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Master Addons for Elementor \u003c= 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2139",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paytium: Mollie payment forms \u0026 donations \u003c= 4.3.7 - Missing Authorization in 'create_mollie_profile'",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7294",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "WPCargo Track \u0026 Trace \u003c= 8.0.1 - Missing authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "wpcargo",
    "type": "plugin",
    "affected_version": "* - 8.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54271",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Travel Engine \u003c= 6.3.5 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 6.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30871",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TZ PlusGallery \u003c= 1.5.5 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "tz-plus-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57974",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Competition Form \u003c= 2.0 - Cross-Site Request Forgery to Competition Deletion",
    "slug": "competition-form",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12750",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SEOPress \u003c= 8.1.1 - Missing Authorization",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 8.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50454",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Visual Composer Website Builder \u003c= 45.0 - Authenticated Stored Cross-Site Scripting via 'Text Block'",
    "slug": "visualcomposer",
    "type": "plugin",
    "affected_version": "* - 45.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "45.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2430",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Oliver POS – A WooCommerce Point of Sale (POS) \u003c= 2.4.2.1 - Missing Authorization",
    "slug": "oliver-pos",
    "type": "plugin",
    "affected_version": "* - 2.4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0702",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Omnishop \u003c= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint",
    "slug": "omnishop",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6214",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "CommentLuv \u003c= 3.0.4 - Server Side Request Forgery via do_click",
    "slug": "commentluv",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-49159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49159",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
  },
  {
    "title": "Broken Link Checker \u003c 1.10.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "broken-link-checker",
    "type": "plugin",
    "affected_version": "[*, 1.10.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-125105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-125105",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smash Balloon Custom Facebook Feed \u003c= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute",
    "slug": "custom-facebook-feed",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4577",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Control \u003c= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "content-control",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47501",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Datetime Change \u003c= 1.11 - Missing Authorisation",
    "slug": "bulk-datetime-change",
    "type": "plugin",
    "affected_version": "[*, 1.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24842",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "AFS Analytics \u003c= 4.21 - Missing Authorization",
    "slug": "addfreestats",
    "type": "plugin",
    "affected_version": "* - 4.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49864",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c= 8.8.02.002 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 8.8.02.002",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.02.002",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38713",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themedy Toolbox \u003c= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themedy-toolbox",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50547",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Compress for MainWP \u003c= 6.30.32 - Missing Authorization",
    "slug": "wp-compress-mainwp",
    "type": "plugin",
    "affected_version": "* - 6.30.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.30.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30932",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bricksforge \u003c= 2.0.17 - Missing Authorization to Unauthenticated Arbitrary Email Sending",
    "slug": "bricksforge",
    "type": "plugin",
    "affected_version": "* - 2.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31242",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce - Social Login \u003c= 2.7.5 - Authentication Bypass to Account Takeover",
    "slug": "woo-social-login",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-7503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7503",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OAuth Client by DigitialPixies \u003c= 1.1.0 - Cross-Site Request Forgery",
    "slug": "dpt-oauth-client",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3632",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FooBox Image Lightbox  \u003c= 2.7.33 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "foobox-image-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.7.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32139",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Social Media Share Buttons \u003c= 3.8.2 - Unauthenticated Password Protected Post Disclosure",
    "slug": "smartcrawl-seo",
    "type": "plugin",
    "affected_version": "[*, 3.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5949",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple User Registration \u003c= 6.3 - Unauthenticated Privilege Escalation",
    "slug": "wp-registration",
    "type": "plugin",
    "affected_version": "* - 6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4334",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.2.6 - Cross-Site Request Forgery",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31293",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cyklodev WP Notify \u003c= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cyklodev-wp-notify",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44625",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myCred \u003c= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47853",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schedule \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "schedule",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13891",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Beaver Builder – Lite \u003c= 1.5.4 - Cross-Site Request Forgery",
    "slug": "ultimate-addons-for-beaver-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23882",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "SCORM Cloud For WordPress \u003c 1.0.7 - SQL Injection",
    "slug": "scormcloud",
    "type": "plugin",
    "affected_version": "[*, 1.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2011-5216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5216",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LTL Freight Quotes – Worldwide Express Edition \u003c= 5.0.21 - Reflected Cross-Site Scripting",
    "slug": "ltl-freight-quotes-worldwide-express-edition",
    "type": "plugin",
    "affected_version": "* - 5.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22286",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter  \u003c= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "* - 8.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3582",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Webinar Plugin – WebinarPress \u003c= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation",
    "slug": "wp-webinarsystem",
    "type": "plugin",
    "affected_version": "* - 1.33.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11270",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-NOTCAPTCHA \u003c= 1.3.1 - Reflected Cross-Site Scripting",
    "slug": "wp-notcaptcha",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23840",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MP3 Audio Player – Music Player, Podcast Player \u0026 Radio by Sonaar \u003c= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode",
    "slug": "mp3-music-player-by-sonaar",
    "type": "plugin",
    "affected_version": "* - 5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10268",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rencontre – Dating Site \u003c= 3.10.1 - Privilege Escalation",
    "slug": "rencontre",
    "type": "plugin",
    "affected_version": "* - 3.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51425",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Livemesh Addons for Elementor \u003c= 7.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 7.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3862",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SecureSubmit \u003c= 1.5.18 - Unauthenticated Sensitive Information Exposure",
    "slug": "securesubmit",
    "type": "plugin",
    "affected_version": "* - 1.5.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56270",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WHMpress \u003c= 6.2-revision-5 - Reflected Cross-Site Scripting",
    "slug": "whmpress",
    "type": "plugin",
    "affected_version": "[*, 6.2-revision-5]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2-revision-5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43246",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mighty Builder \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mighty-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48049",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Events Manager \u003c= 2.2.1 - Missing Authorization",
    "slug": "wp-events-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57987",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35760",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP RSS Aggregator \u003c= 4.19.3 - Reflected Cross-Site Scripting",
    "slug": "wp-rss-aggregator",
    "type": "plugin",
    "affected_version": "* - 4.19.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0189",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Map Shortcode \u003c= 3.1.2 - Reflected Cross-Site Scripting",
    "slug": "google-map-shortcode",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35772",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woo Confirmation Email \u003c 3.2.0 - Improper Access Control",
    "slug": "woo-confirmation-email",
    "type": "plugin",
    "affected_version": "* - 3.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-21007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-21007",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "eCommerce Product Catalog \u003c= 3.4.3 - Authenticated (Orders manager+) PHP Object Injection",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49331",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form \u0026 Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "2.0 - 2.13.9",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.13.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7780",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Slider 3 \u003c= 3.5.1.9 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "smart-slider-3",
    "type": "plugin",
    "affected_version": "* - 3.5.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45845",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 - PayPal \u0026 Stripe Add-on \u003c= 2.3.1 - Reflected Cross-Site Scripting",
    "slug": "contact-form-7-paypal-add-on",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10683",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Automator \u003c= 6.7.0.1 - Missing Authorization",
    "slug": "uncanny-automator",
    "type": "plugin",
    "affected_version": "* - 6.7.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58193",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smartarget Popup \u003c= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "smartarget-popup",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31853",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modula Image Gallery \u003c= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library",
    "slug": "modula-best-grid-gallery",
    "type": "plugin",
    "affected_version": "* - 2.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9416",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Access Demo Importer \u003c= 1.0.7 - Cross-Site Request Forgery to Data Reset",
    "slug": "access-demo-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23976",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Salon booking system \u003c= 9.9 - Missing Authorization",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4468",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Under Construction \u003c= 1.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ultimate-under-construction",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33943",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BP Messages Tool \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "bp-messages-tool",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-43839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-43839",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Animated AL List \u003c= 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "animated-al-list",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5728",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Docs \u003c= 1.9.8 - Missing Authorization via multiple AJAX actions",
    "slug": "wp-docs",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30873",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.3 - Cross-Site Request Forgery via 'regenerateSitemaps'",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1029",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MyOrderDesk \u003c= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "myorderdesk",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50546",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPPerformanceTester \u003c= 2.0.0 - Cross-Site Request Forgery",
    "slug": "wpperformancetester",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49844",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Duplicate Theme \u003c= 0.1.6 - Cross-Site Request Forgery via themeDuplicationAction",
    "slug": "duplicate-theme",
    "type": "plugin",
    "affected_version": "* - 0.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46204",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Related Post \u003c= 2.0.53 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "related-post",
    "type": "plugin",
    "affected_version": "* - 2.0.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51666",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AffiEasy \u003c= 1.1.6 - Cross-Site Request Forgery to Various Actions",
    "slug": "affieasy",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4218",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Hesabfa Accounting \u003c= 2.1.2 - Reflected Cross-Site Scripting",
    "slug": "hesabfa-accounting",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22682",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail On Update \u003c 5.3.0 - Cross-Site Request Forgery",
    "slug": "mail-on-update",
    "type": "plugin",
    "affected_version": "[*, 5.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-2107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2107",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Flexible Checkout Fields for WooCommerce \u003c= 4.1.2 - Missing Authorization",
    "slug": "flexible-checkout-fields",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31267",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Link Library \u003c= 7.7.1 - Reflected Cross-Site Scripting",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38711",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "support-x",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram Engage \u003c= 2.1.7 - Cross-Site Scripting",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "[*, 2.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1776",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmailKit \u003c= 1.6.0 - Missing Authorization to Authenticated (Author+) Arbitrary Content Deletion",
    "slug": "emailkit",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60106",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.9.9.1 - Reflected Cross-Site Scripting",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47346",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Function",
    "slug": "hrm",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.2.17",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5956",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "DS.DownloadList \u003c= 1.3 - Unauthenticated PHP Object Injection",
    "slug": "dsdownloadlist",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50507",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appointment Hour Booking \u003c= 1.4.56 - Captcha Bypass",
    "slug": "appointment-hour-booking",
    "type": "plugin",
    "affected_version": "* - 1.4.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.56",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32720",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Video Lightbox \u003c= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter",
    "slug": "wp-video-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4324",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram Express \u003c= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2656",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Gallery with Filter \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-gallery-with-filter",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13583",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share And Social Locker \u003c= 1.4.2 - Unauthenticated SQL Injection",
    "slug": "social-share-and-social-locker-arsocial",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31911",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Swiss Toolkit For WP \u003c= 1.4.1 - Missing Authorization",
    "slug": "swiss-toolkit-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31544",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Penci Recipe \u003c= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "penci-recipe",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59585",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56063",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Year Make Model Search for WooCommerce \u003c= 1.0.11 - Cross-Site Request Forgery",
    "slug": "ymm-search",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48265",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Travel Engine \u003c= 5.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 5.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37944",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GetPaid \u003c= 2.8.11 - Missing Authorization via column_subscription()",
    "slug": "invoicing",
    "type": "plugin",
    "affected_version": "* - 2.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43973",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Coupon Zen \u003c= 1.0.5 - Cross-Site Request Forgery to Plugin Activation",
    "slug": "coupon-zen",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1089",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Vimeography: Vimeo Video Gallery WordPress Plugin \u003c= 2.3.2 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "vimeography",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0825",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Casengo Live Chat Support \u003c= 2.1.4 - Cross-Site Request Forgery",
    "slug": "the-casengo-chat-widget",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58688",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blog-in-Blog \u003c= 1.1.1 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "blog-in-blog",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2436",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avenir-soft Direct Download \u003c= 1.0 - Cross-Site Scripting",
    "slug": "avenirsoft-directdownload",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9442",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Sitepact's Contact Form 7 Extension For Klaviyo \u003c= 1.0.5 - Unauthenticated SQL Injection",
    "slug": "sitepact-klaviyo-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-25928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25928",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WpEvently \u003c= 4.4.8 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 4.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54742",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fyrebox Quizzes \u003c= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "fyrebox-shortcode",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25125",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 + Telegram \u003c= 0.8.5 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse",
    "slug": "cf7-telegram",
    "type": "plugin",
    "affected_version": "* - 0.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9629",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Kodex Posts likes \u003c= 2.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "kodex-posts-likes",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44036",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP iCal Availability \u003c= 1.0.3 - Cross-Site Request Forgery",
    "slug": "wp-ical-availability",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41853",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Crowd \u003c= 0.9.6.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "social-crowd",
    "type": "plugin",
    "affected_version": "* - 0.9.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31390",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Vouchers \u003c= 4.9.4 - Unauthenticated Arbitrary File Deletion",
    "slug": "woocommerce-pdf-vouchers",
    "type": "plugin",
    "affected_version": "* - 4.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-39651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39651",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Reales WP - Real Estate WordPress Theme \u003c= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates",
    "slug": "reales-wp-real-estate-wordpress-theme",
    "type": "theme",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13307",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SlickNav Mobile Menu \u003c= 1.9.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "slicknav-mobile-menu",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51548",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Audio Dock \u003c= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "themify-audio-dock",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49392",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Float menu \u003c= 5.0.2 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "float-menu",
    "type": "plugin",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3225",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor \u003c= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.29.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.29.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3075",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Meetup \u003c= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "wp-meetup",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23916",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Site Search 360 \u003c= 2.1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "site-search-360",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39530",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Store Kit Elementor Addons \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-store-kit",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32184",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Short URL \u003c= 1.6.8 - Missing Authorization via multiple AJAX functions",
    "slug": "shorten-url",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47225",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Ahmeti Wp Güzel Sözler \u003c= 4.0 - Cross-Site Request Forgery",
    "slug": "ahmeti-wp-guzel-sozler",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53707",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Accordion FAQ \u003c= 2.2.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "pressapps-accordion-faq",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58024",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MainWP Staging Extension \u003c= 4.0.3 - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "mainwp-staging-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23639",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Duplicator \u003c= 1.5.7 AND Duplicator Pro \u003c 4.5.14.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "duplicator-pro",
    "type": "plugin",
    "affected_version": "[*, 4.5.14.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.14.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-6114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6114",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Duplicator \u003c= 1.5.7 AND Duplicator Pro \u003c 4.5.14.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6114",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPCS \u003c= 1.2.0.1 - Cross-Site Request Forgery",
    "slug": "currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30456",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.24.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.24.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6494",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Sentinel \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "wordpress-sentinel",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2011-5226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5226",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AdRotate Banner Manager \u003c= 5.9 - Cross-Site Request Forgery",
    "slug": "adrotate",
    "type": "plugin",
    "affected_version": "* - 5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-26366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-26366",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Basic Log Viewer \u003c= 1.0.4 - Cross-Site Request Forgery via wpst_lw_viewer",
    "slug": "wpsimpletools-log-viewer",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24935",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "PopAd \u003c= 1.0.4 - Cross-Site Request Forgery to Settings Update",
    "slug": "popad",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9616",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.05 - Authenticated (Administrator+) SQL Injection",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.05",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0279",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Timeline Event History \u003c= 3.1 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "timeline-event-history",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5726",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Playerzbr \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Meta Field",
    "slug": "playerzbr",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11825",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fontiran \u003c= 2.1 - Missing Authorization via fi_add_rule and fi_delete_webfont_php",
    "slug": "fontiran",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25791",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c 1.5.3 - SQL Injection",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 1.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-7791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7791",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced What should we write next about \u003c= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "advanced-what-should-we-write-about-next",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53789",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fish and Ships \u003c= 1.5.9 - Reflected Cross-Site Scripting",
    "slug": "fish-and-ships",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9237",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stratum – Elementor Widgets \u003c= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates",
    "slug": "stratum",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10316",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Floating Social Bar \u003c= 1.1.6 - Unauthenticated Cross-Site Scripting",
    "slug": "floating-social-bar",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3299",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant Menu by MotoPress \u003c= 2.4.4 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "mp-restaurant-menu",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30846",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce EAN Payment Gateway \u003c 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update",
    "slug": "woocommerce-ean-payment-gateway",
    "type": "plugin",
    "affected_version": "[*, 6.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4947",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Custom Auto Excerpt \u003c 2.4.7 - Stored Cross-Site Scripting",
    "slug": "easy-custom-auto-excerpt",
    "type": "plugin",
    "affected_version": "[*, 2.4.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5311",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Platinum SEO \u003c= 1.3.7 - Reflected Cross-Site Scripting",
    "slug": "platinum-seo-pack",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-5918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5918",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via aux_contact_box and aux_gmaps Shortcodes",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9545",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TinySalt \u003c 3.10.0 - Unauthenticated Local File Inclusion",
    "slug": "tinysalt",
    "type": "theme",
    "affected_version": "[*, 3.10.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-49454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49454",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TablePress \u003c= 1.8 - XML External Entity Injection",
    "slug": "tablepress",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-10889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-10889",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Image Alt Text \u003c= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update",
    "slug": "image-alt-text",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11918",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Splashing Images \u003c= 2.1 - PHP Object Injection",
    "slug": "wp-splashing-images",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-6195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6195",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin \u003c= 4.48 - Missing Authorization",
    "slug": "real-estate-right-now",
    "type": "plugin",
    "affected_version": "* - 4.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48150",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SVG Complete \u003c= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "svg-complete",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9119",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP STAGING \u003c= 3.4.3 and WP STAGING Pro \u003c= 5.4.3 - Sensitive Information Exposure via Log File",
    "slug": "wp-staging",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3682",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP STAGING \u003c= 3.4.3 and WP STAGING Pro \u003c= 5.4.3 - Sensitive Information Exposure via Log File",
    "slug": "wp-staging-pro",
    "type": "plugin",
    "affected_version": "* - 5.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3682",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MainWP Links Manager Extension \u003c= 2.1 - Unauthenticated PHP Object Injection",
    "slug": "mainwp-links-manager-extension",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-23649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23649",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email Tracker \u003c= 5.2.6 - Cross-Site Request Forgery",
    "slug": "email-tracker",
    "type": "plugin",
    "affected_version": "* - 5.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-44777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-44777",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Tainacan \u003c= 0.21.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tainacan",
    "type": "plugin",
    "affected_version": "* - 0.21.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.21.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34795",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DrawBlog \u003c= 0.90 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "drawblog",
    "type": "plugin",
    "affected_version": "* - 0.90",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.90",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24479",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Delete Me \u003c= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "delete-me",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5126",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Internal Links Manager \u003c= 3.0.1 - Cross-Site Request Forgery",
    "slug": "seo-automated-link-building",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9949",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin \u003c= 3.1.2 - Cross-Site Scripting",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4337",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Dashboard \u003c= 3.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ultimate-dashboard",
    "type": "plugin",
    "affected_version": "* - 3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1524",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gosign – Posts Slider Block \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gosign-posts-slider-block",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "News Kit Elementor Addons \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "news-kit-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32196",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cookie \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-cookie",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22578",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress - Export/Import Courses \u003c= 4.0.2 - Reflected Cross-Site Scripting",
    "slug": "learnpress-import-export",
    "type": "plugin",
    "affected_version": "[*, 4.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-30487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30487",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 6.0.1.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 6.0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43317",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Evolve \u003c 1.2.7 - Cross-Site Scripting",
    "slug": "evolve",
    "type": "theme",
    "affected_version": "[*, 1.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-3852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3852",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Linear \u003c= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "linear",
    "type": "plugin",
    "affected_version": "* - 2.7.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52426",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yaad Sarig Payment Gateway For WC \u003c= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion",
    "slug": "yaad-sarig-payment-gateway-for-wc",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10665",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "SEO Plugin LiveOptim \u003c= 1.1.3 - Cross-Site Request Forgery",
    "slug": "liveoptim",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-100001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-100001",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Gallery Slideshow \u0026 Masonry Tiled Gallery \u003c= 1.0.3 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-responsive-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-25218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25218",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Genki Announcement \u003c= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "genki-announcement",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23900",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Progressive License \u003c= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "progressive-license",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2171",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Real Cookie Banner: GDPR (DSGVO) \u0026 ePrivacy Cookie Consent \u003c 2.14.2 - Cross-Site Request Forgery",
    "slug": "real-cookie-banner",
    "type": "plugin",
    "affected_version": "[*, 2.14.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0445",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Small Package Quotes – For Customers of FedEx \u003c= 4.3.1 - Unauthenticated SQL Injection",
    "slug": "small-package-quotes-fedex-edition",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13491",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Neon text \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "neon-text",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Insert or Embed Articulate Content into WordPress \u003c= 4.3000000021 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "insert-or-embed-articulate-content-into-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.3000000021",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3000000021",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50824",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Direct Checkout for WooCommerce Lite \u003c= 1.0.3 - Missing Authorization",
    "slug": "woo-direct-checkout-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29006",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPBakery \u003c= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5708",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Block (Meow Gallery) \u003c= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meow-gallery",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4386",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MIMO Woocommerce Order Tracking \u003c= 1.0.2 - Missing Authorization to Limited Settings Update",
    "slug": "mimo-woocommerce-order-tracking",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5769",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPJobBoard \u003c= 5.10.1 - Reflected Cross-Site Scripting",
    "slug": "wpjobboard",
    "type": "plugin",
    "affected_version": "* - 5.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24781",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bg Church Memos \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bg-church-memos",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58242",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flipping Cards \u003c= 1.30 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "flipping-cards",
    "type": "plugin",
    "affected_version": "* - 1.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45460",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plexx Elementor Extension \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "plexx-elementor-extension",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49234",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zalomení  \u003c= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "zalomeni",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12872",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GoQMieruca \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "goqmieruca",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52454",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Badgearoo \u003c= 1.0.14 - Reflected Cross-Site Scripting",
    "slug": "badgearoo",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13828",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget for Social Page Feeds \u003c= 6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "facebook-pagelike-widget",
    "type": "plugin",
    "affected_version": "* - 6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0973",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Remote Thumbnail \u003c= 1.3.2 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "wp-remote-thumbnail",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32140",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon \u003c= 200.3.9 - Authentication Bypass",
    "slug": "miniorange-login-openid",
    "type": "plugin",
    "affected_version": "* - 200.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "200.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11087",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Hotel Booking \u003c= 2.1.9 - Cross-Site Request Forgery",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47448",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lenix scss compiler \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "lenix-scss-compiler",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60145",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MailPoet Newsletters \u003c= 2.6.7 - Authorization Bypass",
    "slug": "wysija-newsletters",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4726",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.3 - Cross-Site Request Forgery via 'setIgnore'",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1028",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Authorsy – Author Box, Multiple Authors, Guest Authors \u0026 Post Rating \u003c= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "authorsy",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27006",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cost Calculator Builder \u003c= 3.1.42 - Improper Authorization",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "[*, 3.1.43)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.43",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-40011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40011",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Paytium \u003c= 4.4.10 - Missing Authorization",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51667",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "wpDiscuz \u003c= 7.6.10 - Unauthenticated Content Injection",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46310",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better Font Awesome \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "better-font-awesome",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4512",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gateway for Pasargad Bank \u003c= 2.5.2 - Reflected Cross-Site Scripting",
    "slug": "a-gateway-for-pasargad-bank-on-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23966",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Import Export Lite \u003c= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "wp-import-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.9.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2839",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Simple Shopping Cart \u003c= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wordpress-simple-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 5.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ofiz - WordPress Business Consulting Theme \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "ofiz",
    "type": "theme",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31072",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event post \u003c= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "event-post",
    "type": "plugin",
    "affected_version": "* - 5.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2167",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Hide Links \u003c= 1.4.2 - Unauthenticated Shortcode Execution",
    "slug": "hide-links",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9578",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.2.10 - Authenticated Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.2.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-1394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1394",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Builder by Bit Form \u003c= 2.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3645",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unseen Blog \u003c= 1.0.0 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "unseen-blog",
    "type": "theme",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7432",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Transporters.io \u003c= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "transportersio",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12557",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6175",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Import XML and RSS Feeds \u003c= 2.1.3 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "import-xml-feed",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4300",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EasyAzon – Amazon Associates Affiliate Plugin \u003c= 5.1.0 - Reflected Cross-Site Scripting via easyazon-cloaking-locale",
    "slug": "easyazon",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6956",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lasa \u003c= 1.1 - Unauthenticated Local File Inclusion",
    "slug": "lasa",
    "type": "theme",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49253",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction \u003c= 2.6.2 - Cross-Site Request Forgery",
    "slug": "wallet-system-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13682",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Constant Contact Forms by MailMunch \u003c= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "constant-contact-forms-by-mailmunch",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22137",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Total Security \u003c= 3.4.0 - Unauthenticated Settings Change",
    "slug": "total-security",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10899",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Popup \u003c= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-popup-plugin",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53741",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP CSV to Database \u003c= 2.6 - Cross-Site Request Forgery",
    "slug": "wp-csv-to-database",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47163",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form, Drag and Drop Form Builder for WordPress – Everest Forms \u003c= 1.4.9 - SQL Injection",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-13575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13575",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DP ALTerminator - Missing ALT manager \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dp-alterminator-missing-alt-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28943",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customize My Account for WooCommerce \u003c= 1.8.3 - Cross-Site Request Forgery via restore_my_account_tabs",
    "slug": "customize-my-account-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51369",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WpBookingly \u003c= 1.2.1 - Unauthenticated PHP Object Injection",
    "slug": "service-booking-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32607",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Database Cleaner \u003c= 3.1.1 - Cross-Site Request Forgery via aDBc_save_settings_callback",
    "slug": "advanced-database-cleaner",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46813",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GD Rating System \u003c= 2.3 - Directory Traversal",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-5287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5287",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Login Redirect \u003c= 2.2.4 - Cross-Site Request Forgery",
    "slug": "woo-login-redirect",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48773",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10560",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 – CCAvenue Add-on \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "cf7-cc-avenue-add-on",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23623",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Collapse-O-Matic \u003c= 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "jquery-collapse-o-matic",
    "type": "plugin",
    "affected_version": "* - 1.8.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login as User or Customer \u003c= 3.8 - Unauthenticated Limited Admin Account Compromise",
    "slug": "login-as-customer-or-user",
    "type": "plugin",
    "affected_version": "3.8",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7247",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shortcoder \u003c= 6.3 - Missing Authorization",
    "slug": "shortcoder",
    "type": "plugin",
    "affected_version": "* - 6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49849",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quick Paypal Payments \u003c= 5.7.46 - Cross-Site Request Forgery",
    "slug": "quick-paypal-payments",
    "type": "plugin",
    "affected_version": "* - 5.7.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27003",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy PayPal Events \u003c= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion",
    "slug": "easy-paypal-events-tickets",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8476",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Avada Builder \u003c= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fusion-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1665",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP AD Gallery \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-ad-gallery",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Front User Submit / Front Editor \u003c= 4.9.4 - Cross-Site Request Forgery",
    "slug": "front-editor",
    "type": "plugin",
    "affected_version": "* - 4.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52795",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SupportCandy \u003c= 2.2.6 - Reflected Cross-Site Scripting",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24878",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mini Course Generator | Embed mini-courses and interactive content \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mini-course-generator",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cowidgets – Elementor Addons \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via heading_tag Parameter",
    "slug": "cowidgets-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4697",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGlobus – Multilingual Everything! \u003c= 1.9.6 - Cross-Site Scripting via wpglobus_option[browser_redirect][redirect_by_language]",
    "slug": "wpglobus",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5364",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress + Microsoft Office 365 / Azure AD | LOGIN \u003c= 15.3 - Stored Cross-Site Scripting",
    "slug": "wpo365-login",
    "type": "plugin",
    "affected_version": "* - 15.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-43409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-43409",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tainacan \u003c=  0.21.14 - Unauthenticated Arbitrary File Deletion",
    "slug": "tainacan",
    "type": "plugin",
    "affected_version": "* - 0.21.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.21.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47512",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Security Question \u003c= 1.0.5 - Cross-Site Request Forgery Bypass",
    "slug": "wp-security-questions",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "School Management System for Wordpress \u003c= 93.2.0 - Unauthenticated SQL Injection",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 93.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "93.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12612",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Spider Elements – Addons for Elementor \u003c= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spider-elements",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32182",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bricks 1.2 - 1.5.3 - Remote Code Execution",
    "slug": "bricks",
    "type": "theme",
    "affected_version": "1.2 - 1.5.3",
    "from_version": "1.2",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3401",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appointments Scheduler \u003c= 1.5 - Cross-Site Scripting",
    "slug": "wp-appointments-schedules",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4579",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Scraper \u003c= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "wp-scraper",
    "type": "plugin",
    "affected_version": "* - 5.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9975",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Xpro Elementor Addons \u003c= 1.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43150",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Truelysell Core \u003c= 1.8.6 - Unauthenticated Arbitrary User Password Change",
    "slug": "truelysell-core",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-10742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10742",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WOOCS – WooCommerce Currency Switcher \u003c= 1.4.1.4 - Cross-Site Request Forgery via delete_profiles_data",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49834",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "External featured image from bing \u003c= 1.0.2 - Authenticated (Subscriber+) Remote Code Execution",
    "slug": "external-featured-image-from-bing",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-48027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48027",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "3DPrint Lite \u003c=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'material_text'",
    "slug": "3dprint-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3429",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Mailster \u003c= 1.8.17.0 - Cross-Site Request Forgery",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54355",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WeSecur Security \u003c= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wesecur-security",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24390",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPFunnels \u003c= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde",
    "slug": "wpfunnels",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0173",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Wordfence Extension \u003c= 4.0.7 - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "mainwp-wordfence-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22699",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CAOS \u003c= 4.1.8 - Admin+ Arbitrary Folder Deletion via Path Traversal",
    "slug": "host-analyticsjs-local",
    "type": "plugin",
    "affected_version": "* - 4.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25020",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Ultimate Addons for Contact Form 7 \u003c= 3.1.23 - Authenticated(Subscriber+) SQL Injection",
    "slug": "ultimate-addons-for-contact-form-7",
    "type": "plugin",
    "affected_version": "3.1.23",
    "from_version": "3.1.23",
    "from_inclusive": true,
    "to_version": "3.1.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1615",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Auctions Allegro Plugin \u003c= 3.6.31 - Authenticated (Admin+) SQL Injection",
    "slug": "my-auctions-allegro-free-edition",
    "type": "plugin",
    "affected_version": "* - 3.6.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10048",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "FooGallery Captions \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "foogallery-captions",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23889",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Property Hive Stamp Duty Calculator \u003c= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "property-hive-stamp-duty-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12465",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Designer \u003c= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "product-designer",
    "type": "plugin",
    "affected_version": "* - 1.0.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "I Plant A Tree \u003c= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "i-plant-a-tree",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51883",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Behance Portfolio Manager \u003c= 1.7.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "portfolio-manager-powered-by-behance",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31526",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SUPER RESPONSIVE SLIDER \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "super-slider",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22575",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Login and Registration \u003c= 1.0.0 - Missing Authorization",
    "slug": "ms-registration",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46535",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stop User Enumeration \u003c= 1.3.8 - Unauthenticated Username Enumeration",
    "slug": "stop-user-enumeration",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-1000226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000226",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Weekly Class Schedule \u003c= 3.19 - Reflected Cross-Site Scripting",
    "slug": "weekly-class-schedule",
    "type": "plugin",
    "affected_version": "* - 3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31084",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Missing Authorization to Product Manipulation",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4943",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Embed PDF Viewer \u003c= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via height and width Parameters",
    "slug": "embed-pdf-viewer",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9451",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Manager \u003c= 1.6.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "popup-manager",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4125",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "odPhotogallery \u003c= 0.5.3 - Reflected Cross-Site Scripting",
    "slug": "od-photogallery-plugin",
    "type": "plugin",
    "affected_version": "* - 0.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56036",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Litho \u003c= 3.0 - Unauthenticated Arbitrary File Deletion",
    "slug": "Litho - Multipurpose Elementor WordPress Theme",
    "type": "theme",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49879",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Bulk Posts Editing For WordPress \u003c= 4.2.3 - Authenticated (Subscriber+) Missing Authorization",
    "slug": "ithemeland-bulk-posts-editing-lite",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4199",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booster Elite for WooCommerce \u003c 7.1.2 -  Missing Authorization to Order Information Disclosure",
    "slug": "booster-elite-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 7.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-52234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52234",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Presenter \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "simple-presenter",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54340",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 1.1.150 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 1.1.150",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.150",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0389",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enjoy Social Feed plugin for WordPress website \u003c= 6.2.2 - Missing Authorization to Database Reset",
    "slug": "enjoy-instagram-instagram-responsive-images-gallery-and-carousel",
    "type": "plugin",
    "affected_version": "* - 6.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0780",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13873",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Project Manager \u003c= 2.6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49860",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetPopup \u003c= 2.0.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-popup",
    "type": "plugin",
    "affected_version": "* - 2.0.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.15.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53995",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adding drop down roles in registration \u003c= 1.1 - Unauthenticated Privilege Escalation",
    "slug": "user-drop-down-roles-in-registration",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49217",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Smart Coupons \u003c= 4.6.0 - Unauthenticated Coupon Creation",
    "slug": "woocommerce-smart-coupons",
    "type": "plugin",
    "affected_version": "[*, 4.6.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36841",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13605",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UpStream: a Project Management Plugin for WordPress \u003c= 2.1.0 - Missing Authorization",
    "slug": "upstream",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49974",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Dispatcher \u003c= 1.2.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-dispatcher",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9212",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Site Table of Contents \u003c= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "site-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31385",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JW Player for WordPress \u003c= 2.3.3 - Missing Authorization",
    "slug": "jw-player-7-for-wp",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33931",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Cross-Site Request Forgery via 'queue_posts'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1345",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OS Pricing Tables \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "os-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52343",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Widgets \u003c= 1.5.10 - Authenticated SQL Injection",
    "slug": "dynamic-widgets",
    "type": "plugin",
    "affected_version": "* - 1.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10100",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Store credit / Gift cards for woocommerce \u003c= 1.0.49.46 - Reflected Cross-Site Scripting",
    "slug": "store-credit-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.49.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.49.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11369",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Activity Log Premium \u003c= 4.5.0 - Cross-Site Request Forgery via ajax_switch_db",
    "slug": "wp-security-audit-log-premium",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2285",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Core Web Vitals \u0026 PageSpeed Booster \u003c= 1.0.12 - Open Redirect via _wp_http_referer",
    "slug": "core-web-vitals-pagespeed-booster",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35883",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Collapse-O-Matic \u003c= 1.8.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "jquery-collapse-o-matic",
    "type": "plugin",
    "affected_version": "* - 1.8.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4095",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "K Elements \u003c= 5.3.9 - Authentication Bypass",
    "slug": "k-elements",
    "type": "plugin",
    "affected_version": "* - 5.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56000",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Chat App \u003c= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation",
    "slug": "wp-whatsapp",
    "type": "plugin",
    "affected_version": "* - 3.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10533",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShiftController Employee Shift Scheduling \u003c= 4.9.25 - Reflected Cross-Site Scripting via Query String",
    "slug": "shiftcontroller",
    "type": "plugin",
    "affected_version": "* - 4.9.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1978",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opal Woo Custom Product Variation \u003c= 1.2.0 - Unauthenticated Arbitrary File Deletion",
    "slug": "opal-woo-custom-product-variation",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47535",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "I Am Gloria \u003c= 1.1.4 - Cross-Site Request Forgery",
    "slug": "gloria-assistant-by-webtronic-labs",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0990",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "B1.lt for WooCommerce \u003c= 2.2.56 -  Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection",
    "slug": "b1-accounting",
    "type": "plugin",
    "affected_version": "* - 2.2.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.56",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6718",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Roles \u003c= 1.3.1- Cross-Site Request Forgery Bypass",
    "slug": "multiple-roles",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4402",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "POWR \u003c= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "powr-pack",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5741",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPrezi \u003c= 0.8.2 - Authenticated (Contributor+) Strored Cross-Site Scripting via Shortcode",
    "slug": "wordprezi",
    "type": "plugin",
    "affected_version": "* - 0.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Post Passwords \u003c= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "multiple-post-passwords",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49157",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plugin Propagator \u003c= 0.1 - Unauthenticated Arbitrary File Upload",
    "slug": "wp-propagator",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50495",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VP Sitemap \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "vp-sitemap",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51922",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Preloader Matrix \u003c= 2.0.1 - Cross-Site Request Forgery",
    "slug": "matrix-pre-loader",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47685",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Helper by Codexin \u003c= 1.2.0 - Cross-Site Request Forgery via rate_the_plugin_action",
    "slug": "media-library-helper",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Awesome Contact Form7 for Elementor \u003c= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget",
    "slug": "awesome-contact-form7-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4486",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mini Mail Dashboard Widget \u003c 1.43 - Cross-Site Scripting",
    "slug": "mini-mail-dashboard-widget",
    "type": "plugin",
    "affected_version": "[*, 1.43)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.43",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-2583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2583",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iFlyChat – WordPress Chat \u003c= 4.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "iflychat",
    "type": "plugin",
    "affected_version": "* - 4.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31108",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "B Slider - Gutenberg Slider Block for WP \u003c= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "b-slider",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8680",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Tumult Hype Animations \u003c= 1.9.12 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "tumult-hype-animations",
    "type": "plugin",
    "affected_version": "* - 1.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2890",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TimeZoneCalculator \u003c= 3.37 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "timezonecalculator",
    "type": "plugin",
    "affected_version": "* - 3.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5559",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Member Approval \u003c= 131109 - Cross-Site Scripting",
    "slug": "member-approval",
    "type": "plugin",
    "affected_version": "* - 131109",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "131109",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-3850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3850",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP MultiTasking - WP Utilities \u003c= 0.1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-multitasking",
    "type": "plugin",
    "affected_version": "* - 0.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8189",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pz-LinkCard \u003c= 2.5.2 - Sever-Side Request Forgery",
    "slug": "pz-linkcard",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0677",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "Request a Quote \u003c= 2.3.4 - Stored Cross-Site Scripting",
    "slug": "request-a-quote",
    "type": "plugin",
    "affected_version": "[*, 2.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24489",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XO Security \u003c 1.5.3 - Cross-Site Scripting",
    "slug": "xo-security",
    "type": "plugin",
    "affected_version": "[*, 1.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18541",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 5.1.6 - Missing Authorization to Stored Cross-Site Scripting and Settings Update",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "[*, 5.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-9459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9459",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 8.1.16 - Missing Authorization",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51507",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via camp_id parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6097",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Recall – Registration, Profile, Commerce \u0026 More \u003c= 16.26.6 - Unauthenticated Payment Deletion via delete_payment",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1175",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "MemorialDay \u003c= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "memorialday",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13523",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Koko Analytics \u003c= 1.3.12 - Reflected Cross-Site Scripting",
    "slug": "koko-analytics",
    "type": "plugin",
    "affected_version": "* - 1.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8662",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Albo Pretorio Online \u003c= 4.6.6 - Unauthenticated Sensitive Information Disclosure",
    "slug": "albo-pretorio-on-line",
    "type": "plugin",
    "affected_version": "* - 4.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22301",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "DSGVO Youtube \u003c= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dsgvo-youtube",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32596",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadstreet \u003c= 1.51.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "broadstreet",
    "type": "plugin",
    "affected_version": "* - 1.51.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.51.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48113",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GREYD.SUITE \u003c= 1.2.6 - Unauthenticated Arbitrary File Upload",
    "slug": "greyd_suite",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-2180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2180",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Dispatcher \u003c= 1.2.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-dispatcher",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10582",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FWD Slider \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "fwd-slider",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23462",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Country State City Dropdown CF7 \u003c= 2.7.2 - Unauthenticated SQL Injection",
    "slug": "country-state-city-auto-dropdown",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3495",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Persian Woocommerce SMS \u003c= 7.0.5 - Reflected Cross-Site Scripting",
    "slug": "persian-woocommerce-sms",
    "type": "plugin",
    "affected_version": "* - 7.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54312",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution \u003c= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8289",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All In One SEO Pack \u003c= 4.8.7.1 - Missing Authorization",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "* - 4.8.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58650",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "OSM \u003c= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes",
    "slug": "osm",
    "type": "plugin",
    "affected_version": "* - 6.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8991",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Image Gallery \u003c= 1.0.18 - Cross-Site Request Forgery",
    "slug": "photoshow",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3632",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Live Webcam Widget \u0026 Shortcode \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-webcam-widget-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10129",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RS WP Book Showcase \u003c= 6.7.40 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rs-wp-books-showcase",
    "type": "plugin",
    "affected_version": "* - 6.7.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47679",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon \u003c= 2.4 - Unauthenticated Arbitrary File Read",
    "slug": "elementor_widget_clever_radio_player",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3103",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Gutenberg Blocks and Page Layouts – Attire Blocks \u003c= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "attire-blocks",
    "type": "plugin",
    "affected_version": "* - 1.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11914",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stratum \u003c= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stratum",
    "type": "plugin",
    "affected_version": "* - 1.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29914",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eduma \u003c= 5.4.7 - Reflected Cross-Site Scripting",
    "slug": "eduma",
    "type": "theme",
    "affected_version": "* - 5.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35697",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Matterport Shortcode \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcode-gallery-for-matterport-showcase",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4289",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support Plus Responsive Ticket System \u003c 7.1.0 - Insecure Direct Object Reference",
    "slug": "wp-support-plus-responsive-ticket-system",
    "type": "plugin",
    "affected_version": "[*, 7.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10930",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP SHAPES \u003c= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "wp-shapes",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9619",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP JobHunt \u003c= 7.6 - Authenticated (Candidate+) Stored Cross-Site Scripting via ‘cs_job_title’",
    "slug": "wp-jobhunt",
    "type": "plugin",
    "affected_version": "* - 7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7781",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-CommentNavi \u003c= 1.12.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-commentnavi",
    "type": "plugin",
    "affected_version": "* - 1.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22715",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enfold \u003c= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php",
    "slug": "enfold",
    "type": "theme",
    "affected_version": "* - 6.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13693",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery \u003c= 3.59 - Missing Authorization to Unauthenticated Information Disclosure",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3097",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "G Web Pro Store Locator  \u003c= 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "gwebpro-store-locator",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Akismet Privacy Policies \u003c= 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "akismet-privacy-policies",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25071",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Music Store - WordPress eCommerce \u003c= 1.1.13 - Authenticated (Admin+) SQL Injection",
    "slug": "music-store",
    "type": "plugin",
    "affected_version": "* - 1.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-36082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-36082",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Envo's Elementor Templates \u0026 Widgets for WooCommerce \u003c= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "envo-elementor-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35167",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Newsletter \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "contact-form-7-newsletter",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31110",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Persian Woocommerce SMS \u003c= 7.0.10 - Authenticated (Shop manager+) SQL Injection",
    "slug": "persian-woocommerce-sms",
    "type": "plugin",
    "affected_version": "* - 7.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49315",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Vitepos \u003c= 3.0.1 - Missing Authorization",
    "slug": "vitepos-lite",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33574",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Market Exporter \u003c= 2.0.22 - Cross-Site Request Forgery",
    "slug": "market-exporter",
    "type": "plugin",
    "affected_version": "* - 2.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49269",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Admin Logo Changer \u003c= 1.0 - Plugin's Settings Update via Cross-Site Request Forgery",
    "slug": "wp-admin-logo-changer",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24784",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Countdown Timer \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "timer-countdown",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13864",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGraphQL \u003c= 0.2.3 - Unauthenticated Comment Creation",
    "slug": "wp-graphql",
    "type": "plugin",
    "affected_version": "* - 0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-9881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9881",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GB Gallery Slideshow \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "gb-gallery-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32649",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Steveas WP Live Chat Shoutbox \u003c= 1.4.2 - Unauthenticated SQL Injection",
    "slug": "wp-shoutbox-live-chat",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-1020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1020",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) \u003c= 3.12.4 - Authenticated (Admin+) SQL Injection",
    "slug": "leaflet-maps-marker",
    "type": "plugin",
    "affected_version": "* - 3.12.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1123",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1510",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload PRO \u003c= 2.10.9 - Directory Traversal",
    "slug": "drag-n-drop-upload-cf7-pro",
    "type": "plugin",
    "affected_version": "* - 2.10.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1112",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "KN Fix Your Title \u003c= 1.0.1 - Stored Cross-Site Scripting",
    "slug": "kn-fix-your",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24547",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Configurator for WooCommerce \u003c= 1.4.4 - Cross-Site Request Forgery",
    "slug": "product-configurator-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54674",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AWcode Toolkit \u003c= 1.0.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "awcode-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48238",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quttera Web Malware Scanner \u003c= 3.4.1.48 - Authenticated (Administrator+) Directory Traversal via ShowFile",
    "slug": "quttera-web-malware-scanner",
    "type": "plugin",
    "affected_version": "* - 3.4.1.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6222",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce License Manager \u003c= 5.3.1 - Reflected Cross-Site Scripting",
    "slug": "fs-license-manager",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29121",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 4.0.27 - Authenticated (Contributor+) SQL Injection",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-30244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30244",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP All Import \u003c= 3.6.7 - Admin+ Arbitrary File Upload",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2268",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) \u003c= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "graphicsly",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9069",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Restrict \u003c= 2.5.5 - Protection Mechanism Bypass",
    "slug": "pagerestrict",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0682",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form Plugin \u003c= 4.0.1 - Stored Cross-Site Scripting",
    "slug": "contact-form-lite",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-20055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20055",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBot Pro Wordpress Chatbot \u003c= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wpbot-pro",
    "type": "plugin",
    "affected_version": "* - 13.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3812",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Password Policy Manager \u003c= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover",
    "slug": "password-policy-manager",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31019",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Internal Link Optimiser \u003c= 5.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "internal-link-finder",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BRW \u003c= 1.8.7 - Unauthenticated Local File Inclusion",
    "slug": "ova-brw",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52814",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AnyVar \u003c= 0.1.1 - Cross-Site Scripting",
    "slug": "anyvar",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6103",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Credit Tracker \u003c= 1.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "credit-tracker",
    "type": "plugin",
    "affected_version": "* - 1.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49152",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Total Theme \u003c= 2.1.19 - Authenticated(Subscriber+) Plugin Activation",
    "slug": "total",
    "type": "theme",
    "affected_version": "* - 2.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27456",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Primary Addon for Elementor \u003c= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "primary-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54314",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DirectoriesPro by SabaiApps \u003c= 1.3.45 - Reflected Cross-Site Scripting",
    "slug": "directories",
    "type": "plugin",
    "affected_version": "[*, 1.3.46)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.46",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-29304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-29304",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meow Gallery (+ Gallery Block) \u003c= 4.1.8 - SQL Injection",
    "slug": "meow-gallery",
    "type": "plugin",
    "affected_version": "[*, 4.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24465",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "WP Guppy \u003c= 4.3.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-guppy",
    "type": "plugin",
    "affected_version": "* - 4.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31920",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ocean Extra \u003c=1.6.5 - Cross-Site Request Forgery Bypass",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "[*, 1.6.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36760",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wp Social Login and Register Social Counter \u003c= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status Update",
    "slug": "wp-social",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1763",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Extensive VC Addons for WPBakery page builder \u003c= 1.9 - Unauthenticated Local File Inclusion",
    "slug": "extensive-vc-addon",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-0159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0159",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.276",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.276",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4451",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Business Directory Pro \u003c= 15.5.1 - Reflected Cross-Site Scripting",
    "slug": "simple-business-directory-pro",
    "type": "plugin",
    "affected_version": "* - 15.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48162",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPack Lite for Elementor \u003c= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url'",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8388",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.1 - Incorrect Authorization Leading to Arbitrary Plugin Installation and Post Deletion",
    "slug": "redux-framework",
    "type": "plugin",
    "affected_version": "* - 4.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-38312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38312",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Frontend File Manager \u003c= 18.2 - Unauthenticated Post Meta Change",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "[*, 18.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4351",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Login Watchdog  \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "login-watchdog",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23716",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backend Designer \u003c= 1.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "backend-designer",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32591",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CubeWP Framework \u003c= 1.1.24 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "cubewp-framework",
    "type": "plugin",
    "affected_version": "* - 1.1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54735",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Exclusive Addons Elementor \u003c= 2.6.9.1 - Missing Authorization to Post Duplication",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33914",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Real Estate Directory \u003c= 1.0.5 - Cross-Site Request Forgery via rdm_activate_plugin",
    "slug": "real-estate-directory",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28532",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) \u003c= 7.6.6 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "miniorange-login-openid",
    "type": "plugin",
    "affected_version": "* - 7.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47683",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lottie Player \u003c= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload",
    "slug": "embed-lottie-player",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2579",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lava Directory Manager \u003c= 1.1.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "lava-directory-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47659",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBakery Page Builder Addons by Livemesh \u003c= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "addons-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2079",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Domain Theme \u003c= 1.3 - Cross-Site Request Forgery",
    "slug": "domain-theme",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28897",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "lasTunes \u003c= 3.6.1 - Cross-Site Request Forgery",
    "slug": "lastunes",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6499",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Workreap Theme \u003c 2.2.2 - Authorization Bypass",
    "slug": "workreap",
    "type": "theme",
    "affected_version": "[*, 2.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24501",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "FreshMail For WordPress \u003c= 2.3.2 - Cross-Site Request Forgery",
    "slug": "freshmail-integration",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22304",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MultiParcels Shipping For WooCommerce \u003c= 1.15.1 - Cross-Site Request Forgery",
    "slug": "multiparcels-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.15.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-3366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3366",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29455",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "uDesign Theme 2.3.0 - 2.7.9 - Unauthenticated DOM Cross-Site Scripting",
    "slug": "u-design",
    "type": "theme",
    "affected_version": "2.3.0 - 2.7.9",
    "from_version": "2.3.0",
    "from_inclusive": true,
    "to_version": "2.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-7357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7357",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bug Library \u003c= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bug-library",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5604",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Upcasted S3 Offload – AWS S3, Digital Ocean Spaces, Backblaze, Minio and more \u003c= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "upcasted-s3-offload",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22676",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Under Construction \u003c= 3.96 - Cross-Site Request Forgery via admin_action_install_weglot",
    "slug": "under-construction-page",
    "type": "plugin",
    "affected_version": "* - 3.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.96",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0832",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pósturinn\\'s Shipping with WooCommerce \u003c= 1.3.1 - Reflected Cross-Site Scripting",
    "slug": "posturinn",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Parabola \u003c= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "parabola",
    "type": "theme",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44058",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Customer Reviews \u003c= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-customer-reviews",
    "type": "plugin",
    "affected_version": "* - 3.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4648",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bon Toolkit \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bon-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4589",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMS for Lead Capture Forms \u003c= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion",
    "slug": "clicksend-lead-capture-form",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11353",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Democracy Poll \u003c= 5.3.6 - Cross-Site Request Forgery",
    "slug": "democracy-poll",
    "type": "plugin",
    "affected_version": "* - 5.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-18521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18521",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Error Log Viewer by BestWebSoft \u003c= 1.1.1 - Cross-Site Request Forgery",
    "slug": "error-log-viewer",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24761",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hustle \u003c= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys",
    "slug": "wordpress-popup",
    "type": "plugin",
    "affected_version": "* - 7.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0368",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WoodMart \u003c= 8.2.5 - Unauthenticated Post Disclosure",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 8.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6745",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Image Optimizer, Resizer and CDN – Sirv \u003c= 7.2.0 - Missing Authorization",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "* - 7.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27950",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Regina Lite \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "regina-lite",
    "type": "theme",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27619",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "AddToAny Share Buttons \u003c= 1.7.47 - Authenticated Stored Cross-Site Scripting",
    "slug": "add-to-any",
    "type": "plugin",
    "affected_version": "[*, 1.7.48)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.48",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24616",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Cron Manager – debug \u0026 control \u003c= 2.5.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-cron-manager",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4004",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Sentry \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "wp-sentry",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1844",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ketchup Shortcodes \u003c= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ketchup-shortcodes-pack",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24673",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Menu Editor \u003c= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder Parameter",
    "slug": "admin-menu-editor",
    "type": "plugin",
    "affected_version": "* - 1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9493",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Layout Builder \u003c= 1.9.3 - Reflected Cross-Site Scripting",
    "slug": "page-layout-builder",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000141",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kopa Framework \u003c= 1.3.5 - Cross-Site Request Forgery",
    "slug": "kopatheme",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47180",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Tableau Viz \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-tableau-viz",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form to DB by BestWebSoft \u003c= 1.7.1 - Authenticated (Administrator+) SQL Injection via 's'",
    "slug": "contact-form-to-db",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-36508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36508",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Manual Purchases \u003c 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "exchange-addon-manual-purchases",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9371",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM Perks Forms \u003c= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "crm-perks-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7484",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bulk Me Now! \u003c= 2.0 - Cross-Site Request Forgery to Message Deletion",
    "slug": "bulk-me-now",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12709",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Footer Putter \u003c= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "footer-putter",
    "type": "plugin",
    "affected_version": "* - 1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52188",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Job Board Manager \u003c= 2.1.60 - Missing Authorization",
    "slug": "job-board-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31862",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.240 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.240",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.240",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bbPress \u003c= 2.6.4 - Unauthenticated Privilege Escalation",
    "slug": "bbpress",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-13693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13693",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IssueM \u003c= 2.9.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "issuem",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58631",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clever Fox – One Click Website Importer by Nayra Themes \u003c= 25.2.0 - Missing Authorization to arbitrary theme activation via clever-fox-activate-theme",
    "slug": "clever-fox",
    "type": "plugin",
    "affected_version": "* - 25.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "25.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6876",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Build App Online \u003c= 1.0.22 - Account Takeover via Weak Password Reset Mechanism",
    "slug": "build-app-online",
    "type": "plugin",
    "affected_version": "* - 1.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7264",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booster Extension \u003c= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_display",
    "slug": "booster-extension",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2109",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP AVCL Automation Helper (formerly WPFlyLeads) \u003c= 3.4 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "woozap",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46531",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Autochat Automatic Conversation \u003c= 1.1.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "auyautochat-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3041",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.9.34 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "* - 3.9.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58197",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant Menu – Food Ordering System – Table Reservation \u003c= 2.4.2 - Reflected Cross-Site Scripting",
    "slug": "menu-ordering-reservations",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9653",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YOGO Booking \u003c= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yogo-booking",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12462",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conditional Cart Messages for WooCommerce \u0026#8211; YourPlugins.com \u003c= 1.2.10 - Cross-Site Request Forgery",
    "slug": "yourplugins-wc-conditional-cart-notices",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60171",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Live Chat Support \u003c= 7.1.02 - Cross-Site Scripting",
    "slug": "wp-live-chat-support",
    "type": "plugin",
    "affected_version": "* - 7.1.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18508",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Additional Order Filters for WooCommerce \u003c= 1.22 - Cross-Site Request Forgery",
    "slug": "additional-order-filters-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53271",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paged Gallery \u003c= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "paged-gallery",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5686",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Weixin \u003c= 1.3.16 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-weixin",
    "type": "theme",
    "affected_version": "* - 1.3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30875",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Help Desk \u003c= 2.7.1 - Cross-Site Request Forgery",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46842",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Quran multilanguage Text \u0026 Audio \u003c= 2.3.21 - Reflected Cross-Site Scripting via sourate and lang Parameters",
    "slug": "quran-text-multilanguage",
    "type": "plugin",
    "affected_version": "* - 2.3.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11973",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime – Events Calendar, Bookings and Tickets \u003c= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1124",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive iframe \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-iframe",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12768",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML5 Video Player – mp4 Video Player Plugin and Block \u003c= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler",
    "slug": "html5-video-player",
    "type": "plugin",
    "affected_version": "* - 2.5.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7727",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "brodos.net Onlineshop Plugin \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "brodos-net-onlineshop",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12529",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML Forms – Simple WordPress Forms Plugin \u003c= 1.3.33 - Cross-Site Request Forgery",
    "slug": "html-forms",
    "type": "plugin",
    "affected_version": "* - 1.3.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6412",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BA Book Everything \u003c= 1.6.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "ba-book-everything",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32125",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 Captcha \u003c= 0.1.1 - Reflected Cross-Site Scripting",
    "slug": "contact-form-7-simple-recaptcha",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2187",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Movies \u003c= 0.6 - Reflected Cross-Site Scripting",
    "slug": "movies",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4539",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 9.0.11.006",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.11.006",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8726",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.3.3 - Unauthenticated Local File Inclusion via template",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3136",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Chatbot with ChatGPT \u003c= 2.4.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "smartsearchwp",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6843",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail Mint \u003c= 1.18.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "mail-mint",
    "type": "plugin",
    "affected_version": "* - 1.18.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59570",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WCFM Membership \u003c= 2.10.0 - Unauthenticated Privilege Escalation",
    "slug": "wc-multivendor-membership",
    "type": "plugin",
    "affected_version": "* - 2.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4939",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wpForo Forum \u003c= 2.0.9 - Authenticated (Subscriber+) HTML Injection",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38055",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Remove Footer Credit \u003c= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "remove-footer-credit",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24446",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Members \u003c= 5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "team-members",
    "type": "plugin",
    "affected_version": "* - 5.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38670",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Filmix \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "filmix",
    "type": "theme",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44060",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JustTables – WooCommerce Product Table \u003c= 1.4.9 - Cross-Site Request Forgery via plugin_activation()",
    "slug": "just-tables",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23803",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c= 4.7.4 - Cross-Site Request Forgery to Statistic Deletion",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9649",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Survey \u0026 Poll – Quiz, Survey and Poll Plugin for WordPress \u003c= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-survey-and-poll",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12528",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Management Xtended  \u003c= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "admin-management-xtended",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elements Plus! \u003c= 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "elements-plus",
    "type": "plugin",
    "affected_version": "* - 2.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8689",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media File Renamer \u003c 1.9.4 - Stored Cross-Site Scripting",
    "slug": "media-file-renamer",
    "type": "plugin",
    "affected_version": "[*, 1.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-2040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2040",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MC Woocommerce Wishlist \u003c= 1.8.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "smart-wishlist-for-more-convert",
    "type": "plugin",
    "affected_version": "* - 1.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30879",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Nelio AB Testing \u003c 4.5.0 - Directory Traversal",
    "slug": "nelio-ab-testing",
    "type": "plugin",
    "affected_version": "* - 4.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10977",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Image vertical reel scroll slideshow \u003c= 9.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "image-vertical-reel-scroll-slideshow",
    "type": "plugin",
    "affected_version": "* - 9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5428",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Majestic Support \u003c= 1.0.6 - Unauthenticated Local File Inclusion",
    "slug": "majestic-support",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26985",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Go Maps (formerly WP Google Maps) \u003c= 9.0.28 - Reflected Cross-Site Scripting",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6697",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiquidPoll – Advanced Polls for Creators and Brands \u003c= 3.3.77 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-poll",
    "type": "plugin",
    "affected_version": "* - 3.3.77",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.77",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-39655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39655",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetFormBuilder \u003c= 3.0.8 - Authenticated (Author+) Privilege Escalation",
    "slug": "jetformbuilder",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-37866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37866",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "StopBadBots \u003c= 7.31 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "stopbadbots",
    "type": "plugin",
    "affected_version": "* - 7.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32496",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PropertyHive \u003c= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58612",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.3.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Request a Quote \u003c= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "request-a-quote",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2239",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Collapsing Archives \u003c= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "collapsing-archives",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43934",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz and Survey Master \u003c= 8.1.4 - Unauthenticated SQL Injection",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-28787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28787",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletter - API v1 and v2 addon for Newsletter \u003c= 2.4.5 - Missing Authorization to Email Subscribers Management",
    "slug": "newsletter-api",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5674",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Testimonials Widget \u003c= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode",
    "slug": "testimonials-widget",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4705",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Map Plugin \u003c= 4.1.4 - Authenticated SQL Injection via Orderby",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24130",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Divi Torque Lite – Divi Theme and Extra Theme \u003c= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "addons-for-divi",
    "type": "plugin",
    "affected_version": "* - 3.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5892",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ALL In One Custom Login Page \u003c= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation",
    "slug": "login-page-styler",
    "type": "plugin",
    "affected_version": "* - 7.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12594",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Agency Toolkit \u003c= 1.0.24 - Missing Authorization",
    "slug": "agency-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31863",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPAMS - Apartment Management System for wordpress Theme \u003c 17-07-2019 - SQL Injection",
    "slug": "apartment-management",
    "type": "plugin",
    "affected_version": "[*, 17-07-2019)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17-07-2019",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-14847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14847",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PDF Image Generator \u003c= 1.5.6 - Reflected Cross-Site Scripting",
    "slug": "pdf-image-generator",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9241",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Top 10 \u003c= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "top-10",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47509",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Posts Scroll \u003c= 1.25 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "featured-posts-scroll",
    "type": "plugin",
    "affected_version": "* - 1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51647",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Automatic Plugin - AI content generator and auto poster plugin \u003c= 3.115.0 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "wp-automatic",
    "type": "plugin",
    "affected_version": "* - 3.115.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.115.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5395",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Raptive Ads \u003c= 3.6.3 - Reflected Cross-Site Scripting",
    "slug": "adthrive-ads",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13363",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 3.2.9 - Open Redirect",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50463",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Portfolio Gallery – Responsive Image Gallery \u003c= 1.4.5 - Missing Authorization to Arbitrary Gallery Deletion",
    "slug": "gallery-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32585",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Hide My WP \u003c= 6.2.3 - Authorization Bypass",
    "slug": "hide_my_wp",
    "type": "plugin",
    "affected_version": "* - 6.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36917",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "kontur Admin Style \u003c= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "kontur-admin-style",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60185",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LuckyWP Table of Contents \u003c= 2.1.5 - Reflected Cross-Site Scripting",
    "slug": "luckywp-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2119",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.23",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.21",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.20",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.17",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.12",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.11",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.3",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.23",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.20",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.13",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.8",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Menu Groups \u003c= 0.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "admin-menu-groups",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49035",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Edit \u003c= 4.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-edit",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53253",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ditty \u003c= 3.1.51 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13357",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Display Eventbrite Events \u003c= 6.2.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "widget-for-eventbrite-api",
    "type": "plugin",
    "affected_version": "* - 6.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47510",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fresh Framework \u003c= 1.70.0 - Unauthenticated Remote Code Execution",
    "slug": "fresh-framework",
    "type": "plugin",
    "affected_version": "* - 1.70.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.70.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26936",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads – Conditional Success Redirects \u003c 1.1.1 - Cross-Site Scripting",
    "slug": "edd-conditional-success-redirects",
    "type": "plugin",
    "affected_version": "[*, 1.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9511",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.85",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.85",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6954",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Header \u003c= 1.3 - Missing Authorization",
    "slug": "visual-header",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48275",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Clio Grow \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "clio-grow-form",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8802",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Flat rate shipping Woocommerce \u003c= 1.6.4.4 - Cross-Site Request Forgery via enableDisable and deletePost",
    "slug": "advanced-free-flat-shipping-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34015",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials \u003c= 3.3.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "stars-testimonials-with-slider-and-masonry-grid",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11429",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wishlist for WooCommerce \u003c= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wish-list-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48237",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Chrono \u003c= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-chrono",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IP2Location Country Blocker \u003c= 2.26.5 - Arbitrary Country Ban via Cross-Site Request Forgery",
    "slug": "ip2location-country-blocker",
    "type": "plugin",
    "affected_version": "* - 2.26.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.26.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25108",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Personizely \u003c= 0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via widgetId Parameter",
    "slug": "personizely",
    "type": "plugin",
    "affected_version": "* - 0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3779",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accept Stripe Donation – AidWP \u003c= 3.1.5 - Cross Site Request Forgery",
    "slug": "wp-stripe-donation",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47422",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FOMO Pay Chinese Payment Solution \u003c= 2.0.4 - Reflected Cross-Site Scripting",
    "slug": "fomo-payment-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23543",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opal Widgets For Elementor \u003c= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "opal-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33649",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Remote Content Shortcode \u003c= 1.5 - Authenticated(Contributor+) Local File Inclusion via shortcode",
    "slug": "remote-content-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45652",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File Upload \u003c= 1.6.56 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "shared-files",
    "type": "plugin",
    "affected_version": "[*, 1.6.57)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.57",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24736",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Forms by Cimatti Plugin \u003c= 1.9.8 - Cross-Site Request Forgery",
    "slug": "contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49069",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Electrician - Electrical Service WordPress \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "electrician",
    "type": "theme",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31055",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ELEX WooCommerce Dynamic Pricing and Discounts \u003c= 2.1.2 - Cross-Site Request Forgery",
    "slug": "elex-woocommerce-dynamic-pricing-and-discounts",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32105",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.6.1 - Cryptographic Weakness",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-3747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-3747",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Distance Based Shipping Calculator \u003c= 2.0.21 - Reflected Cross-Site Scripting",
    "slug": "distance-based-shipping-calculator",
    "type": "plugin",
    "affected_version": "* - 2.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56301",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "phpinfo() WP \u003c= 4.0 - Cross-Site Request Forgery",
    "slug": "phpinfo-wp",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26542",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Nearby Locations \u003c= 1.1.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "nearby-locations",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32128",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "NinjaTeam Chat for Telegram \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ninjateam-telegram",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11885",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Talkback \u003c= 1.0 - Unauthenticated PHP Object Injection",
    "slug": "talkback-secure-linkback-protocol",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-48033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48033",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Labels For Woocommerce \u003c= 1.5.3 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "aco-product-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24886",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Auto Poster \u003c= 5.3.14 - Missing Authorization via Multiple Functions",
    "slug": "social-auto-poster",
    "type": "plugin",
    "affected_version": "* - 5.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6750",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Vignette Ads \u003c= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "vignete-ads",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25071",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailerLite – Signup forms (official) 1.5.0 - 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "official-mailerlite-sign-up-forms",
    "type": "plugin",
    "affected_version": "1.5.0 - 1.7.6",
    "from_version": "1.5.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1386",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xelion Webchat \u003c= 9.1.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "xelion-webchat",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39542",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Owl carousel responsive \u003c= 1.9 - Authenticated (Contributor+) SQL Injection via id Parameter",
    "slug": "responsive-owl-carousel",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5590",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Twitter Follow Button \u003c= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter",
    "slug": "twitter-follow",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10116",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 4.0.1 - Unauthenticated SQL Injection",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-3197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3197",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ocean Extra \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24399",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress User Extra Fields \u003c= 16.5 - Unauthenticated Arbitrary File Upload",
    "slug": "wp-user-extra-fields",
    "type": "plugin",
    "affected_version": "* - 16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10801",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WOOCS – Currency Switcher for WooCommerce Professional Free \u003c= 1.3.7 - Authenticated Local File Inclusion",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24566",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shareaholic \u003c= 9.7.11 - Missing Authorization via accept_terms_of_service",
    "slug": "shareaholic",
    "type": "plugin",
    "affected_version": "* - 9.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24709",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TM Replace Howdy \u003c= 1.4.2 - Cross-Site Request Forgery",
    "slug": "tm-replace-howdy",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49972",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Postman SMTP \u003c= 1.7.2 -  Reflected Cross-Site Scripting",
    "slug": "postman-smtp",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18603",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fota WP \u003c= 1.4.1 - Missing Authorization via fotawp_install_and_activate_plugins()",
    "slug": "fotawp",
    "type": "theme",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43980",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Qi Addons For Elementor \u003c= 1.6.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "qi-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47679",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "qTranslate \u003c= 2.5.39 - Cross-Site Scripting",
    "slug": "qtranslate",
    "type": "plugin",
    "affected_version": "* - 2.5.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5535",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VSTEMPLATE Creator \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "vstemplate-creator",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23491",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Weblizar Pin Feeds \u003c 1.1.2 - Cross-Site Scripting",
    "slug": "weblizar-pinterest-feeds",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailPoet – emails and newsletters in WordPress \u003c= 3.23.1 - Reflected Cross-Site Scripting via URL parameter",
    "slug": "mailpoet",
    "type": "plugin",
    "affected_version": "[*, 3.23.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.23.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-11843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11843",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Editor \u003c= 1.1.1 - Local File Inclusion",
    "slug": "site-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-7422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-7422",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modern Events Calendar Lite \u003c 5.22.1 - Admin+ Stored Cross-Site Scripting",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 5.22.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.22.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24687",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.18",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.31",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.23",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.6",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.30",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.30",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.22",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.21",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.9",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.5",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.33",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.33",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.27",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.17",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.13",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.14",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4047",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"
  },
  {
    "title": "MStore API \u003c= 3.9.6 - Missing Authorization",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "[*, 3.9.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-3131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3131",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Simple Gmail Login \u003c 1.1.4 - Sensitive Information Disclosure",
    "slug": "simple-gmail-login",
    "type": "plugin",
    "affected_version": "[*, 1.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6313",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form Email \u003c= 1.2.65 - Reflected Cross-Site Scripting",
    "slug": "contact-form-to-email",
    "type": "plugin",
    "affected_version": "[*, 1.2.66)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.66",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-9646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9646",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.13",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.5",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.12",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.30",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.29",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.22",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.20",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.16",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.8",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.2",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.32",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.32",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.29",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.17",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.4",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.26",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Reflected Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.21",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11029",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "GTmetrix for WordPress \u003c= 0.4.6 - Reflected Cross-Site Scripting via 'report_id' and 'event_id'",
    "slug": "gtmetrix-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 0.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32503",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Bannerize Pro \u003c= 1.6.9 - Reflected Cross-Site Scripting",
    "slug": "wp-bannerize-pro",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41663",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tracking Code Manager \u003c= 2.1.0 - Missing Authorization via change_order()",
    "slug": "tracking-code-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31347",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Airin Blog \u003c= 1.6.2 - Unauthenticated PHP Object Injection",
    "slug": "airin-blog",
    "type": "theme",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52413",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 – PayPal \u0026 Stripe Add-on \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "contact-form-7-paypal-add-on",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29130",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Tickets with Ticket Scanner \u003c= 2.3.1 - Reflected Cross-Site Scripting",
    "slug": "event-tickets-with-ticket-scanner",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35652",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Registrations for the Events Calendar – Event Registration Plugin \u003c= 2.12.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "registrations-for-the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 2.12.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-39638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39638",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Slider by 10Web \u003c= 1.2.61 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget",
    "slug": "slider-wd",
    "type": "plugin",
    "affected_version": "* - 1.2.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10565",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Music Player for WooCommerce \u003c= 1.5.1 - Missing Authorization",
    "slug": "music-player-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47472",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elegant Themes Icons \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elegant-themes-icons",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37100",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.80 - Missing Authorization to Private/Password Protected Post Read",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.80",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5922",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Post Grid \u003c 2.1.16 - Reflected Cross-Site Scripting",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "[*, 2.1.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0447",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Replyable – Subscribe to Comments and Reply by Email \u003c= 2.2.9 - Authenticated (Subscriber+) PHP Object Injection via prompt_dismiss_notice",
    "slug": "postmatic",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4265",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Login Logger \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "login-logger",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28866",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Goodnex Responsive HTML5/CSS3 Site Template \u003c 1.1.3 - Sensitive Information Disclosure",
    "slug": "goodnex",
    "type": "theme",
    "affected_version": "[*, 1.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9489",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy \u003c= 2.1.1 - Missing Authorization",
    "slug": "woo-aliexpress-dropshipping",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49848",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video List Manager \u003c= 1.7 - Unauthenticated SQL Injection",
    "slug": "video-list-manager",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52831",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Greek Multi Tool – Fix peralinks, accents, auto create menus and more \u003c= 2.3.1 - Missing Authorization",
    "slug": "greek-multi-tool",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30797",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form by WPForms – Drag \u0026 Drop Form Builder for WordPress \u003c= 1.8.7.2 - Unauthenticated Price Manipulation",
    "slug": "wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 1.8.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3649",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stylish Price List \u003c= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stylish-price-list",
    "type": "plugin",
    "affected_version": "* - 7.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7758",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avirato hotels online booking engine \u003c= 5.0.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "avirato-calendar",
    "type": "plugin",
    "affected_version": "* - 5.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0768",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Link Whisper Free \u003c= 0.6.5 - Authenticated (Contributor+) SQL Injection",
    "slug": "link-whisper",
    "type": "plugin",
    "affected_version": "* - 0.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47852",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Service Payment Form With Authorize.net \u003c= 2.6.3 - Reflected Cross-Site Scripting",
    "slug": "wp-service-payment-form-with-authorizenet",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12258",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hotel Booking \u003c= 2.0.8 - Insufficient Authorization to Unauthorized Post Deletion",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5799",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2269",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder by AZEXO \u003c= 1.27.133 - Missing Authorization to Post Creation",
    "slug": "page-builder-by-azexo",
    "type": "plugin",
    "affected_version": "* - 1.27.133",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.133",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3053",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c 1.3.5 - Reflected Cross-Site Scripting via font-size",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "[*, 1.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36383",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PublishPress Capabilities \u003c= 2.5.1 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "capabilities-pro",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3366",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PublishPress Capabilities \u003c= 2.5.1 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "capability-manager-enhanced",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3366",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SiteOrigin Widgets Bundle \u003c= 1.58.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "so-widgets-bundle",
    "type": "plugin",
    "affected_version": "* - 1.58.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.58.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1723",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1585",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cliptakes \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cliptakes",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13389",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Membership Simplified \u003c= 1.58 Beta - SQL Injection",
    "slug": "membership-simplified-for-oap-members-only",
    "type": "plugin",
    "affected_version": "[*, 1.58)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.58",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-1002010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002010",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Gallery \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "simple-gallery-odihost",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23487",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar \u003c= 2.4.1 - Multiple Admin+ Cross Site Scripting",
    "slug": "mp3-music-player-by-sonaar",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24624",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VK Filter Search \u003c= 2.15.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "vk-filter-search",
    "type": "plugin",
    "affected_version": "* - 2.15.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32175",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin \u003c= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover",
    "slug": "timetics",
    "type": "plugin",
    "affected_version": "* - 1.0.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.25",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9263",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Backup Migration \u003c= 1.3.9 - Authenticated (Admin+) OS Command Injection via url",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7002",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Debug Info \u003c= 1.3.10 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "debug-info",
    "type": "plugin",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34565",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP JS \u003c= 2.0.6 - Reflected Cross-Site Scripting",
    "slug": "wp-js",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1567",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscription Form for Feedblitz \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "feedblitz-email-subscription",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31745",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Verification Code for Comments \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "verification-code-for-comments",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4565",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Order Delivery Date for WP e-Commerce \u003c= 1.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "order-delivery-date",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0678",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WD Instagram Feed \u003c= 1.3.0 - Cross-site scripting",
    "slug": "wd-instagram-feed",
    "type": "plugin",
    "affected_version": "[*, 1.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-10300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10300",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventer \u003c= 3.9.6 - Missing Authorization",
    "slug": "eventer",
    "type": "plugin",
    "affected_version": "* - 3.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39482",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Heateor Social Login \u003c= 1.1.30 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "heateor-social-login",
    "type": "plugin",
    "affected_version": "* - 1.1.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24712",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0708",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Blogroll \u003c= 2.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ultimate-blogroll",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9881",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit File Manager – 100% Free \u0026 Open Source File Manager and Code Editor for WordPress \u003c= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload",
    "slug": "file-manager",
    "type": "plugin",
    "affected_version": "* - 6.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8743",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "GS Insever Portfolio \u003c= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection",
    "slug": "gs-instagram-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12249",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery, Images, Slider in Rbs Image Gallery \u003c= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10144",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bonanza – WooCommerce Free Gifts Lite \u003c= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In Success",
    "slug": "bonanza-woocommerce-free-gifts-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6730",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WC Affiliate – A Complete WooCommerce Affiliate Plugin \u003c= 2.4 - Reflected Cross-Site Scripting",
    "slug": "wc-affiliate",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KiviCare – Clinic \u0026 Patient Management System (EHR) \u003c= 3.2.0 - Cross-Site Request Forgery",
    "slug": "kivicare-clinic-management-system",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2628",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Simple Dashboard \u003c= 2.0 - Unauthenticated Privilege Escalation",
    "slug": "simple-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56071",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Vik Rent Car \u003c= 1.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "vikrentcar",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24388",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Pop-Up banners \u003c= 1.8.4 - Missing Authorization",
    "slug": "cm-pop-up-banners",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54018",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Anti-Malware Security and Brute-Force Firewall \u003c= 4.20.93 - Reflected Cross-Site Scripting",
    "slug": "gotmls",
    "type": "plugin",
    "affected_version": "[*, 4.20.94)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.20.94",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25101",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form and Calls To Action by vcita \u003c= 4.10.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "contact-form-with-a-meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2303",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Page Widget \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "featured-page-widget",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22569",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Layouts for Elementor \u003c= 1.11 - Cross-Site Request Forgery",
    "slug": "layouts-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30948",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BP Social Connect \u003c= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bp-social-connect",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32493",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Upload Resume \u003c= 1.2.0 - Authenticated Sensitive Information Disclosure via resume_upload_form_list shortcode",
    "slug": "resume-upload-form",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25965",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Dark Mode \u003c= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-dark-mode",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPZOOM Portfolio Lite – Filterable Portfolio Plugin \u003c= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute",
    "slug": "wpzoom-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8276",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.6.5 - Unauthenticated Local File Inclusion",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1661",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12283",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3CX Free Live Chat \u003c= 6.2.03 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-live-chat-support",
    "type": "plugin",
    "affected_version": "* - 6.2.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10879",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restrict User Registration \u003c= 1.0.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "restrict-user-registration",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9892",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EZPZ One Click Backup \u003c= 12.03.10 - Unauthenticated Command Injection",
    "slug": "ezpz-one-click-backup",
    "type": "plugin",
    "affected_version": "* - 12.03.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.03.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-3114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3114",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YourMembership Single Sign On \u003c= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "login-with-yourmembership",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37986",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Post \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "custom-post-type-gui",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Word Spinner: CSS3 Animated Rotation \u003c= 5.6 - Cross-Site Request Forgery",
    "slug": "css3-rotating-words",
    "type": "plugin",
    "affected_version": "* - 5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38753",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ContentMX Content Publisher \u003c= 1.0.6 - Missing Authorization",
    "slug": "contentmx-content-publisher",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31555",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47630",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Baidu Tongji generator \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "baidu-tongji-generator",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-31233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31233",
    "auth_type": "Privileged",
    "cvss_score": 3.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Mobile Banner \u003c= 1.5 - Cross-Site Request Forgery leading to Plugin Settings Changes",
    "slug": "mobile-banner",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28930",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Behance Portfolio Manager \u003c= 1.7.4 - Missing Authorization",
    "slug": "portfolio-manager-powered-by-behance",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29010",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Groups and Communities \u003c= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6411",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smash Balloon Social Post Feed \u003c= 2.19.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "custom-facebook-feed",
    "type": "plugin",
    "affected_version": "[*, 2.19.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.19.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24508",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.11 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "[*, 1.5.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-24396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24396",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TAX SERVICE Electronic HDM \u003c= 1.1.2 - Unauthenticated SQL Injection",
    "slug": "virtual-hdm-for-taxservice-am",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54261",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Absolute Privacy \u003c= 2.1 - Cross-Site Request Forgery to User Email/Password Change",
    "slug": "absolute-privacy",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4276",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Element Pack Elementor Addons \u003c= 5.5.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30496",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "HUSKY – Products Filter for WooCommerce Professional \u003c= 1.3.1 - Authenticated (Admin+) PHP Object Injection",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4489",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Giveaway Boost \u003c= 2.1.4 - Unauthenticated PHP Object Injection",
    "slug": "giveaway-boost",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49332",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ActivityPub \u003c= 0.17.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Title Exposure",
    "slug": "activitypub",
    "type": "plugin",
    "affected_version": "* - 0.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3706",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "seekXL Snapr \u003c= 2.0.6 - Reflected Cross-Site Scripting",
    "slug": "seekxl-snapr",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25087",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Statify Widget \u003c= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "statify-widget",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48322",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.48 - Cross-Site Request Forgery",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.48",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36288",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Raptive Ads \u003c= 3.8.0 - Reflected Cross-Site Scripting",
    "slug": "adthrive-ads",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53319",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ditty – Responsive News Tickers, Sliders, and Lists \u003c= 3.1.31 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32569",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Partial Shipment \u003c= 3.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wc-partial-shipment",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48118",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Related Posts Line-up-Exactly by Milliard \u003c= 0.0.22 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "related-posts-line-up-exactry-by-milliard",
    "type": "plugin",
    "affected_version": "* - 0.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26545",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooLentor \u003c= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0231",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "One User Avatar \u003c= 2.3.6 - Cross-Site Request Forgery",
    "slug": "one-user-avatar",
    "type": "plugin",
    "affected_version": "[*, 2.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24675",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Contact Form 7 Database – CFDB7 \u003c= 1.0.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "advanced-cf7-database",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22351",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "UserPlus \u003c= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation",
    "slug": "userplus",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9519",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Connector \u003c 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "post-connector",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hostel \u003c= 1.1.5.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "hostel",
    "type": "plugin",
    "affected_version": "* - 1.1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6236",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tooltipy \u003c 5.1 - Cross-Site Request Forgery",
    "slug": "bluet-keywords-tooltip-generator",
    "type": "plugin",
    "affected_version": "[*, 5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-1000505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000505",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Admin Menu Organizer \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "admin-menu-organizer",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23686",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.971",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.971",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2798",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Gallery – YouTube Gallery \u003c= 1.7.6 - Missing Authorization",
    "slug": "gallery-videos",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25988",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Facebook for WordPress \u003c= 3.0.3 - Cross-site Request Forgery to Stored Cross-site Scripting and Settings Deletion via wp_ajax_(save|delete)_fbe_settings",
    "slug": "official-facebook-pixel",
    "type": "plugin",
    "affected_version": "[3.0.0, 3.0.4)",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24218",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All-In-One Security \u003c= 5.1.2 - Information Disclosure",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "* - 5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4346",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Site Reviews \u003c= 5.17.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "* - 5.17.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.17.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24973",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4445",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Current Menu Item for Custom Post Types \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "current-menu-item-for-custom-post-types",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46781",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons and Templates \u003c= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 8.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8100",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.5.34 - Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.35)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.35",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16117",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Off-Canvas Sidebars \u0026 Menus (Slidebars) \u003c= 0.5.8.4 - Reflected Cross-Site Scripting",
    "slug": "off-canvas-sidebars",
    "type": "plugin",
    "affected_version": "* - 0.5.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49290",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c 4.3.1 - Unauthenticated Blind SQL Injection",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-20361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20361",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Bit Integrations \u003c= 2.4.10 - Open Redirect",
    "slug": "bit-integrations",
    "type": "plugin",
    "affected_version": "* - 2.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30884",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nested Pages \u003c= 3.2.3 - Missing Authorization to Authenticated (Editor+) Plugin Settings Reset",
    "slug": "wp-nested-pages",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-2434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2434",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Sloth Logo Customizer \u003c= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "sloth-logo-customizer",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0603",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soccer Live Scores \u003c= 1.0.5 - Cross-Site Request Forgery",
    "slug": "soccer-live-scores",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47594",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "1 Click WordPress Migration \u003c= 2.2 - Unauthenticated Information Disclsoure",
    "slug": "1-click-migration",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32257",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.5.2 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2202",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter",
    "slug": "gravityforms",
    "type": "plugin",
    "affected_version": "2.9.0.1 - 2.9.1.3",
    "from_version": "2.9.0.1",
    "from_inclusive": true,
    "to_version": "2.9.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13378",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LawPress – Law Firm Website Management \u003c= 1.4.5 - Reflected Cross-Site Scripting",
    "slug": "lawpress",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23756",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Circles Gallery \u003c= 1.0.10 - Authenticated (Admin+) Stored Cross-Site Scripting via Admin Settings",
    "slug": "circles-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23881",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Tooltip Glossary \u003c= 4.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "enhanced-tooltipglossary",
    "type": "plugin",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Oliver POS – A WooCommerce Point of Sale (POS) \u003c= 2.4.1.8 - Cross-Site Request Forgery",
    "slug": "oliver-pos",
    "type": "plugin",
    "affected_version": "* - 2.4.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1954",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Import WP – Export and Import CSV and XML files to WordPress \u003c= 2.13.0 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "jc-importer",
    "type": "plugin",
    "affected_version": "* - 2.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7253",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Postie \u003c 1.4.10 - Cross-Site Scripting",
    "slug": "postie",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-2580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2580",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GutenKit \u003c= 2.1.0 - Unauthenticated Arbitrary File Upload",
    "slug": "gutenkit-blocks-addon",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9234",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Webinar and Video Conference with Jitsi Meet \u003c= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "webinar-and-video-conference-with-jitsi-meet",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30437",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Dashboard Tweeter \u003c= 1.3.2 - Missing Authorization",
    "slug": "wordpress-dashboard-twitter",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23906",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Forms by Pie Forms \u003c= 1.4.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pie-forms-for-wp",
    "type": "plugin",
    "affected_version": "[*, 1.4.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1569",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Smart Quick View for WooCommerce \u003c= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode",
    "slug": "woo-smart-quick-view",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8618",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Download Manager \u003c= 2.9.93 - Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "[*, 2.9.94)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.94",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15889",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Upload Files \u003c= 59.3 - Arbitrary File Upload",
    "slug": "woocommerce-upload-files",
    "type": "plugin",
    "affected_version": "[*, 59.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "59.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24171",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Broken Link Checker \u003c= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View",
    "slug": "broken-link-checker",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4047",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Maps – Display Google Maps Perfectly with Ease \u003c= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3504",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Random Redirect \u003c= 1.3.20 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "better-random-redirect",
    "type": "plugin",
    "affected_version": "* - 1.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50021",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eBay Product Feeds \u003c 1.1 - Cross-Site Scripting",
    "slug": "ebay-feeds-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4525",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Parts \u003c= 1.4.3 - Reflected Cross-Site Scripting",
    "slug": "page-parts",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11360",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Forms \u003c= 6.1.2 - Unauthenticated PHP Object Injection",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "* - 6.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-1405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1405",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple calendar for Elementor \u003c= 1.6.4 - Cross-Site Request Forgery",
    "slug": "simple-calendar-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46249",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AppMySite \u003c= 3.14.0 - Missing Authorization",
    "slug": "appmysite",
    "type": "plugin",
    "affected_version": "* - 3.14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58679",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts \u003c= 2.6.16 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12195",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ahime Image Printer \u003c= 1.0.0 - Unauthenticated Arbitrary File Download",
    "slug": "ahime-image-printer",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49245",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 2.1.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-1894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1894",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.1.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "2.1 - 2.1.2",
    "from_version": "2.1",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-1894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1894",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wise Forms \u003c= 1.2.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wise-forms",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13603",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPress Podcasting \u003c= 11.13.11 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 11.13.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.13.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49984",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Page Builder \u003c= 1.2.3 - Multiple Stored Cross-Site scripting",
    "slug": "wp-pagebuilder",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24208",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WP Testimonials  \u003c= 1.4.2 - Cross-Site Request Forgery to Widget Deletion",
    "slug": "testimonial-widgets",
    "type": "plugin",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2830",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AppMySite \u003c= 3.11.0 - Unauthenticated Information Disclsoure",
    "slug": "appmysite",
    "type": "plugin",
    "affected_version": "* - 3.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49762",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Accept SagePay Payments Using Contact Form 7 \u003c= 2.0 - Unauthenticated Information Exposure",
    "slug": "accept-sagepay-payments-using-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2883",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Light Messages \u003c= 1.0 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "light-messages",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24535",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recipe Card Blocks for Gutenberg \u0026 Elementor \u003c= 3.4.3 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Disclosure",
    "slug": "recipe-card-blocks-by-wpzoom",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26983",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Personal Favicon \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "personal-favicon",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28964",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Review Wave – Google Places Reviews \u003c=  1.4.7 - Cross-Site Request Forgery",
    "slug": "review-wave-google-places-reviews",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39442",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Last.fm Recent Album Artwork \u003c= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "lastfm-recent-album-artwork",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7684",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Bricks Addons for Elementor \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "webbricks-addons",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49665",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Indeed API \u003c= 0.5 - Cross-Site Request Forgery to Settings Update",
    "slug": "indeed-api",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25103",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slide Anything – Responsive Content / HTML Slider and Carousel \u003c= 2.3.43 - Editor+ Cross-Site Scripting",
    "slug": "slide-anything",
    "type": "plugin",
    "affected_version": "[*, 2.3.44)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.44",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1303",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yasr – Yet Another Stars Rating \u003c 0.9.1 - Authenticated SQL Injection",
    "slug": "yet-another-stars-rating",
    "type": "plugin",
    "affected_version": "[*, 0.9.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9465",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.1.7 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29760",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting via 'sms_prefix'",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 9.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2102",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Captivate Sync \u003c= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "captivatesync-trade",
    "type": "plugin",
    "affected_version": "* - 2.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53820",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TWB Woocommerce Reviews \u003c= 1.7.7 - Cross-Site Request Forgery",
    "slug": "twb-woocommerce-reviews",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30801",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Booking Calendar \u003c= 10.5 - Reflected Cross-Site Scripting",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8274",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixabay Images \u003c= 2.3 - Cross-Site Scripting",
    "slug": "pixabay-images",
    "type": "plugin",
    "affected_version": "[*, 2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-1366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1366",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Access Manager \u003c= 6.7.9 - Admin+ Stored Cross-Site Scripting",
    "slug": "advanced-access-manager",
    "type": "plugin",
    "affected_version": "[*, 6.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24830",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Duplicate Page and Post \u003c= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "duplicate-wp-page-post",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2152",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search with Typesense \u003c= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "search-with-typesense",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49304",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Menu \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-menu",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49436",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Marketplace \u003c= 2.4.0 - Path Traversal",
    "slug": "wpmarketplace",
    "type": "plugin",
    "affected_version": "[*, 2.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9014",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \u003c= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4580",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pootle button \u003c= 1.2.0 - Reflected Cross-Site Scripting",
    "slug": "pootle-button",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23758",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Personal Dictionary \u003c= 1.3.3 - Unauthenticated SQL Injection",
    "slug": "personal-dictionary",
    "type": "plugin",
    "affected_version": "[*, 1.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-1013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1013",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All in One SEO \u003c= 4.2.3.1 - Cross-Site Request Forgery",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "* - 4.2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38093",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Easy Gallery – WordPress Gallery Plugin \u003c= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation",
    "slug": "wp-easy-gallery",
    "type": "plugin",
    "affected_version": "* - 4.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8437",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks – Page Builder Features \u003c= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1541",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress MU \u003c= 1.0 - Cross-Site Scripting",
    "slug": "wpmu",
    "type": "core",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4544",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login/Signup Popup \u003c= 2.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-login-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50027",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nmedia MailChimp \u003c= 5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "nmedia-mailchimp-widget",
    "type": "plugin",
    "affected_version": "* - 5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30613",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPLMS  \u003c 4.900 - Cross-Site Request Forgery",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "[*, 4.900)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.900",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-36690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36690",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Docs \u003c= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-docs",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56288",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget Shortcode \u003c= 0.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "widget-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4473",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PB SEO Friendly Images \u003c= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pb-seo-friendly-images",
    "type": "plugin",
    "affected_version": "* - 4.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47434",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 2.73 - Cross-Site Scripting",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "[*, 2.7.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20982",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Marquee Style RSS News Ticker \u003c= 3.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "marquee-style-rss-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23424",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 – PayPal \u0026 Stripe Add-on \u003c= 1.9.3 - Cross-Site Request Forgery",
    "slug": "contact-form-7-paypal-add-on",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24405",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Import any XML or CSV File \u003c= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "[*, 3.7.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-7082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7082",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Autoptimize \u003c= 3.0.4 - Sensitive Information Disclosure",
    "slug": "autoptimize",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4057",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ultimate Dashboard \u003c= 3.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "ultimate-dashboard",
    "type": "plugin",
    "affected_version": "* - 3.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4726",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Carousel For WPBakery Page Builder \u003c= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ultimate-carousel-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0267",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SALESmanago \u003c= 3.2.4 - Log Injection via Weak Authentication Token",
    "slug": "salesmanago",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4939",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart PopUp Blaster \u003c= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-popup-blaster",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11339",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobBoardWP \u003c= 1.2.1 - Unauthenticated Arbitrary File Upload",
    "slug": "jobboardwp",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4061",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woo Viet \u003c= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "woo-viet",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29816",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LUNA RADIO PLAYER \u003c= 6.24.11.07 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "lu-radioplayer",
    "type": "plugin",
    "affected_version": "* - 6.24.11.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.24.11.07",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10881",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.135",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.135",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nested Pages \u003c= 3.1.15 - Cross-Site Request Forgery to Arbitrary Post Deletion and Modification",
    "slug": "wp-nested-pages",
    "type": "plugin",
    "affected_version": "* - 3.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-38342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38342",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Quiz And Survey Master \u003c= 8.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeoDirectory \u003c= 2.2.23 - Authenticated (Admin+) SQL Injection",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.2.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0278",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RSS Aggregator by Feedzy \u003c= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "feedzy-rss-feeds",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4667",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Today's Date Inserter \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "todays-date-inserter",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48103",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP2LEADS \u003c= 3.4.5 - Reflected Cross-Site Scripting",
    "slug": "wp2leads",
    "type": "plugin",
    "affected_version": "* - 3.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30827",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZIP Code Based Content Protection \u003c= 1.0.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "zip-code-based-content-protection",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59008",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Gutenberg PDF Viewer Block \u003c= 1.0 - Cross-Site Scripting",
    "slug": "pdf-viewer-block",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24760",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WishList Member X \u003c= 3.25.1 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wishlist-member-x",
    "type": "plugin",
    "affected_version": "* - 3.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37108",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Compact Admin \u003c= 1.3.0 - Cross-Site Request Forgery",
    "slug": "compact-admin",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58865",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Embed videos and respect privacy \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "video-embed-privacy",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9346",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print My Blog \u003c= 3.27.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "print-my-blog",
    "type": "plugin",
    "affected_version": "* - 3.27.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.27.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54740",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link Library \u003c= 7.2.7 - Cross-Site Request Forgery to Library Settings Reset",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25092",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GamiPress \u003c= 2.5.7 - Unauthenticated SQL Injection",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-24000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24000",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GmapsMania \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gmapsmania",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4131",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup contact form \u003c= 7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "popup-contact-form",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44265",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "QMean – WordPress Did You Mean and Search Suggestion Like Google \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "qmean",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23428",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Slider 3 \u003c= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter",
    "slug": "smart-slider-3",
    "type": "plugin",
    "affected_version": "* - 3.5.1.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6348",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP MediaTagger \u003c= 4.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-mediatagger",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13101",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Local SEO \u003c= 2.3 - Unauthenticated SQL Injection",
    "slug": "dh-local-seo",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23931",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider \u003c= 3.94.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ml-slider",
    "type": "plugin",
    "affected_version": "* - 3.94.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.94.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1062",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "weMail \u003c= 1.14.13 - Unauthenticated Sensitive Information Exposure",
    "slug": "wemail",
    "type": "plugin",
    "affected_version": "* - 1.14.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47540",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Testimonial Manager \u003c= 1.2.0 - Authenticated (Admin+) SQL Injection",
    "slug": "easy-testimonial-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24394",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MDC YouTube Downloader \u003c= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mdc-youtube-downloader",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51875",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download After Email  2.1.5 - 2.1.6 - Unauthorized Repeated Form Submissions",
    "slug": "download-after-email",
    "type": "plugin",
    "affected_version": "2.1.5 - 2.1.6",
    "from_version": "2.1.5",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54743",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pexels: Free Stock Photos \u003c= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "wp-pexels-free-stock-photos",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6132",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Settings \u003c= 3.1.1 - Cross-Site Request Forgery",
    "slug": "advanced-settings",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58975",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Pay Counter \u003c 2.731 - Arbitrary Settings Change",
    "slug": "post-pay-counter",
    "type": "plugin",
    "affected_version": "[*, 2.731)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.731",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18584",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "VidMov \u003c= 1.9.4 - Unauthenticated Local File Inclusion",
    "slug": "vidmov",
    "type": "theme",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-25172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25172",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Active Products Tables for WooCommerce \u003c= 1.0.6 - Unauthenticated PHP Object Injection",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51505",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Admin and Site Enhancements \u003c= 7.9.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "admin-site-enhancements",
    "type": "plugin",
    "affected_version": "* - 7.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9487",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BookingPress Appointment Booking \u003c= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6467",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.10.12 - Missing Authorization",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.10.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11852",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.14.1.3 - Cross-Site Request Forgery leading to attachment deletion \u0026 Path Traversal",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.14.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14683",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N"
  },
  {
    "title": "Document \u0026 Data Automation \u003c= 1.6.1 - Cross-Site Request Forgery",
    "slug": "document-data-automation",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52477",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Trust Form \u003c= 2.0.0 - Cross-Site Scripting",
    "slug": "trust-form",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18613",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multicons [ Multiple Favicons ] \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "multicons",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9424",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "BuddyPress \u003c= 14.1.0 - Authenticated (Subscriber+) Directory Traversal",
    "slug": "buddypress",
    "type": "plugin",
    "affected_version": "* - 14.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10011",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Official Integration for Billingo \u003c= 3.3.9 - Reflected Cross-Site Scripting",
    "slug": "billingo",
    "type": "plugin",
    "affected_version": "* - 3.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3420",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MoveTo \u003c= 6.2 - Unauthenticated Arbitrary File Upload",
    "slug": "moveto",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-25913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25913",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Menu 4.0 - 4.0.3 - Authenticated Arbitrary File Upload",
    "slug": "responsive-menu",
    "type": "plugin",
    "affected_version": "[4.0, 4.0.4)",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24160",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Melapress File Monitor \u003c= 2.0.2 - Authenticated (Admin+) Authenticated SQL Injection",
    "slug": "website-file-changes-monitor",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10009",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Database Reset \u003c= 3.1 - Privilege Escalation",
    "slug": "wordpress-database-reset",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-7047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7047",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Login-box \u003c= 2.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "login-box",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25149",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Folders Pro \u003c= 3.0.2 - Authenticated(Author+) Arbitrary File Upload via handle_folders_file_upload",
    "slug": "folders-pro",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2024",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Groundhogg \u003c= 3.7.3.3 - Reflected Cross-Site Scripting",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 3.7.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56289",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CubeWP – All-in-One Dynamic Content Framework \u003c= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "cubewp-framework",
    "type": "plugin",
    "affected_version": "* - 1.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4315",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Style Hover \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "image-content-show-hover",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46534",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exchange Rates \u003c= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "exchange-rates",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58624",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced WP Columns \u003c= 2.0.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-wp-columns",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3426",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Master \u003c= 3.4.14 - Missing Authorization",
    "slug": "ajax-filter-posts",
    "type": "plugin",
    "affected_version": "* - 3.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30974",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Espresso 4 Decaf \u003c= 5.0.28.decaf - Cross-Site Request Forgery",
    "slug": "event-espresso-decaf",
    "type": "plugin",
    "affected_version": "* - 5.0.28.decaf",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.28.decaf",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56251",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Availability Calendar \u003c 1.2.1 - SQL Injection",
    "slug": "availability-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24606",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import users from CSV with meta \u003c= 1.12 - Import Cross-Site Scripting",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "[*, 1.12.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20101",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookie Notice \u0026amp; Consent Banner for GDPR \u0026amp; CCPA Compliance \u003c= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cookie-notice-and-consent-banner",
    "type": "plugin",
    "affected_version": "* - 1.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58607",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spice Starter Sites \u003c= 1.2.5 - Reflected Cross-Site Scripting",
    "slug": "spice-starter-sites",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44003",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.8 - Reflected Cross-Site Scripting via selected_option",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8117",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Envo's Elementor Templates \u0026 Widgets for WooCommerce \u003c= 1.4.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "envo-elementor-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50447",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Image Plus – Quick \u0026 Bulk Edit with Unsplash \u003c= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "featured-image-plus",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5818",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thim Elementor Kit \u003c= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "thim-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22312",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.12.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter \u003c= 7.6.8 - Reflected Cross-Site Scripting",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "* - 7.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27922",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Diza \u003c= 1.3.9 - Unauthenticated Local File Inclusion",
    "slug": "diza",
    "type": "theme",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52729",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LuckyWP Scripts Control \u003c= 1.2.1  - Missing Authorization",
    "slug": "luckywp-scripts-control",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47778",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Legal Pages \u003c= 1.3.7 - Missing Authorization on 'deleteLegalTemplate'",
    "slug": "legal-pages",
    "type": "plugin",
    "affected_version": "[*, 1.3.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50886",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.5.68 - Reflected Cross-Site Scripting \u003c= 1.5.68 - Reflected Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.68",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.68",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-31693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-31693",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MP3 Sticky Player \u003c= 8.0 - Unauthenticated Arbitrary File Read/Download",
    "slug": "fwdmsp",
    "type": "plugin",
    "affected_version": "* - 8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10803",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Eleblog – Elementor Blog And Magazine Addons \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ele-blog",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33945",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Form by AYS \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-form",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32498",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.6 - Cross-Site Request Forgery",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-46816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46816",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DTracker \u003c= 1.5 - SQL Injection",
    "slug": "dtracker",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002004",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Statistics \u003c= 13.1.5 - Unauthenticated Blind SQL Injection via current_page_type",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 13.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0651",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPBifröst – Instant Passwordless Temporary Login Links \u003c= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "create-temporary-login",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10299",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Popular Posts \u003c= 5.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wordpress-popular-posts",
    "type": "plugin",
    "affected_version": "* - 5.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36872",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rezgo Online Booking \u003c= 4.17 - Unauthenticated Local File Inclusion",
    "slug": "rezgo",
    "type": "plugin",
    "affected_version": "* - 4.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-53800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53800",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Flickr Photostream \u003c= 3.1.8 - Reflected Cross-Site Scripting",
    "slug": "flickr-photostream",
    "type": "plugin",
    "affected_version": "* - 3.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31467",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue \u003c= 3.1.60 - Reflected Cross-Site Scripting via 'lang'",
    "slug": "mailin",
    "type": "plugin",
    "affected_version": "* - 3.1.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2472",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteSEO – SEO Simplified \u003c= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression",
    "slug": "siteseo",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9277",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anti Plagiarism \u003c= 3.60 - Reflected Cross-Site Scripting",
    "slug": "anti-plagiarism",
    "type": "plugin",
    "affected_version": "* - 3.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000128",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload for Contact Form 7 \u003c= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie",
    "slug": "drag-and-drop-multiple-file-upload-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8464",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Pack Elementor addon \u003c= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-pack-addon",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6550",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traffic Monitor \u003c= 3.2.2 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "traffic-monitor",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5815",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bang tinh vay \u003c= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bang-tinh-lai-suat",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26000",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Block Country \u003c= 7.1.4 - Cross-Site Request Forgery via admin_block_country_initial_page",
    "slug": "admin-block-country",
    "type": "plugin",
    "affected_version": "* - 7.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24007",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Spam protection, AntiSpam, FireWall by CleanTalk \u003c= 5.153.3 - Unauthenticated Blind SQL Injection",
    "slug": "cleantalk-spam-protect",
    "type": "plugin",
    "affected_version": "* - 5.153.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.153.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24295",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Easy Portfolio \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23796",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Hub - Startup \u0026 Technology WordPress Theme \u003c= 1.3.3 - Unauthenticated Arbitrary File Upload",
    "slug": "aihub",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26927",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz Expert – Easy Quiz Maker, Exam and Test Manager \u003c= 1.5.0 - Cross-Site Request Forgery",
    "slug": "quiz-expert",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36522",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Widgets for Google Reviews \u003c 9.8 - Authenticated (Contributor+) Stored XSS",
    "slug": "wp-reviews-plugin-for-google",
    "type": "plugin",
    "affected_version": "* - 9.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4470",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c= 3.6.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "[*, 3.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24714",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Postie \u003c= 1.9.70 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "postie",
    "type": "plugin",
    "affected_version": "* - 1.9.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5200",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder Addons by WPZOOM \u003c= 1.3.5 - Authenticated (Editor+) Local File Inclusion",
    "slug": "wpzoom-addons-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37464",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Interactive Regional Map of Africa \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "interactive-map-of-africa",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49449",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Avada \u003c= 5.1.4 - Cross-Site Request Forgery",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "[*, 5.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18607",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gixaw Chat \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "gixaw-chat",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7816",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Power: Complete AI Pack \u003c= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts",
    "slug": "gpt3-ai-content-generator",
    "type": "plugin",
    "affected_version": "* - 1.8.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.96",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0428",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Metrics \u003c= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "social-metrics",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44263",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPLMS \u003c= 1.9.9 - Unauthenticated Privilege Escalation",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56043",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Classified Listing – Classified ads \u0026 Business Directory Plugin \u003c= 3.0.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 3.0.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3893",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fence URL \u003c= 2.0.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "fence-url",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53733",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "School Management System for Wordpress \u003c= 93.0.0 - Reflected Cross-Site Scripting",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 93.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "93.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12611",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AP Pricing Tables Lite \u003c= 1.1.4 - Reflected Cross-Site Scripting",
    "slug": "ap-pricing-tables-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0640",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newspack Blocks \u003c= 3.0.8 - Missing Authorization",
    "slug": "newspack-blocks",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37425",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1498",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WSM Downloader \u003c= 1.4.0 - Arbitrary File Download",
    "slug": "wsm-downloader",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2357",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Contextual Related Posts \u003c= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "contextual-related-posts",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47506",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MonsterInsights Pro \u003c= 8.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-analytics-premium",
    "type": "plugin",
    "affected_version": "* - 8.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32291",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quizlord \u003c= 2.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "quizlord",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-17140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17140",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stackable – Page Builder Gutenberg Blocks \u003c= 3.13.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "stackable-ultimate-gutenberg-blocks",
    "type": "plugin",
    "affected_version": "* - 3.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6296",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Forum Server \u003c= 1.6.5 - SQL Injection",
    "slug": "forum-server",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2011-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-1047",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Meteor Slides \u003c= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meteor-slides",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12073",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management System – WPSchoolPress \u003c= 2.2.16 - Authenticated (Parent+) SQL Injection",
    "slug": "wpschoolpress",
    "type": "plugin",
    "affected_version": "* - 2.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1670",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Mollie for Contact Form 7 \u003c= 5.0.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "cf7-mollie",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-55990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55990",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventPrime – Events Calendar, Bookings and Tickets \u003c= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1127",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Smart Custom 404 Error Page \u003c= 11.4.7 - Reflected Cross-Site Scripting",
    "slug": "404page",
    "type": "plugin",
    "affected_version": "* - 11.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9204",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CDN Vote \u003c 0.4.2 - SQL Injection",
    "slug": "cdnvote",
    "type": "plugin",
    "affected_version": "[*, 0.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2011-5308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5308",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SW Kick Integration - Blocks and Shortcodes for Embedding Kick Streams \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-kick-embed Shortcode",
    "slug": "streamweasels-kick-integration",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10184",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Feature Box \u003c= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-feature-box",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51611",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.7.0 - Authenticated (Instructor+) SQL Injection",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4318",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Social Share Block \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-social-share-block",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51865",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RedLine \u003c 1.66 - Reflected Cross-Site Scripting",
    "slug": "redline",
    "type": "theme",
    "affected_version": "[*, 1.66)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.66",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-3863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3863",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hover Effects For WPBakery Page Builder \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "image-hover-effects-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46484",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AutomatorWP \u003c= 5.2.1.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "automatorwp",
    "type": "plugin",
    "affected_version": "* - 5.2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48280",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Private Google Calendars \u003c= 20231125 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "private-google-calendars",
    "type": "plugin",
    "affected_version": "* - 20231125",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20231125",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52198",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Lightbox \u0026 Gallery \u003c= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6870",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Links Page \u003c= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update",
    "slug": "wp-links-page",
    "type": "plugin",
    "affected_version": "* - 4.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6465",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AJAX Login and Registration modal popup + inline form \u003c= 2.24 - Reflected Cross-Site Scripting",
    "slug": "ajax-login-and-registration-modal-popup",
    "type": "plugin",
    "affected_version": "* - 2.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8874",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Button Generator – easily Button Builder \u003c= 2.3.2 - Cross-Site Request Forgery",
    "slug": "button-generation",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25052",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Font Fix \u003c= 2.3.1 - Reflected Cross-Site Scripting",
    "slug": "google-font-fix",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30614",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Captcha! \u003c= 2.5d - Cross-Site Scripting",
    "slug": "captcha-offrepo",
    "type": "plugin",
    "affected_version": "* - 2.5d",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5d",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-0206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0206",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Image URL",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.5.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2934",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial Slider \u003c= 2.3.6 - Missing Authorization to Authenticated (Author+) Settings Update",
    "slug": "testimonial-slider-and-showcase",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1745",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Survey Maker \u003c= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50426",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple Sitemap \u003c= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-simple-sitemap",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22342",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YellowPencil Visual CSS Style Editor \u003c= 7.6.1 - Reflected Cross-Site Scripting",
    "slug": "yellow-pencil-visual-theme-customizer",
    "type": "plugin",
    "affected_version": "* - 7.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43963",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Prune Posts \u003c= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "auto-prune-posts",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10639",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Userpro \u003c= 5.1.9 - Reflected Cross-Site Scripting",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56210",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Workreap - Freelance Marketplace and Directory WordPress Theme \u003c 2.2.2 - Arbitrary File Upload",
    "slug": "workreap",
    "type": "theme",
    "affected_version": "[*, 2.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24499",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rara Business \u003c= 1.2.5 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "rara-business",
    "type": "theme",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37937",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSS News Scroller \u003c= 2.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "rss-news-scroller",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23467",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Surveys \u003c= 1.01.8 -  SQL Injection",
    "slug": "surveys",
    "type": "plugin",
    "affected_version": "* - 1.01.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002021",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Contact Form Lite  \u003c= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "contact-form-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32147",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \u003c= 2.8.7 - Missing Authorization",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1158",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quick Event Manager \u003c= 9.7.4 - Unauthenticated Stored Cross Site Scripting",
    "slug": "quick-event-manager",
    "type": "plugin",
    "affected_version": "* - 9.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23979",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "People Lists \u003c= 1.3.10 - Missing Authorization",
    "slug": "people-lists",
    "type": "plugin",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24691",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Justified Gallery \u003c= 1.7.3 - Missing Authorization via 'dismiss_how_to_use_notice' and 'dismiss_notice'",
    "slug": "justified-gallery",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40213",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MACME \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "macme",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23683",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10646",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Single-user-chat \u003c= 0.5 - Authenticated (Subscriber+) Limited Options Update",
    "slug": "single-user-chat",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13646",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Geo Controller \u003c= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cf-geoplugin",
    "type": "plugin",
    "affected_version": "* - 8.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30451",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fast Total Search \u003c= 1.59.211 - Authenticated (Contributor+) Stored Cross-Site Scripting via WPFTS Live Search Widget",
    "slug": "fulltext-search",
    "type": "plugin",
    "affected_version": "* - 1.59.211",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.59.211",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29799",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management \u003c= 92.0.0 - Unauthenticated SQL Injection",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 92.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "92.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47573",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CP Blocks \u003c= 1.0.20 - Cross-Site Request Forgery to Settings Update",
    "slug": "cp-blocks",
    "type": "plugin",
    "affected_version": "* - 1.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41732",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Redirection Page \u003c= 1.2 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "redirection-page",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-1580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1580",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Feed Them Social \u003c= 3.0.2 - Cross-Site Request Forgery",
    "slug": "feed-them-social",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25056",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Full Stripe Free \u003c= 7.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-full-stripe-free",
    "type": "plugin",
    "affected_version": "* - 7.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46088",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hello Event Widgets For Elementor \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hello-event-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54338",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Access Manager \u003c= 6.9.20 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "advanced-access-manager",
    "type": "plugin",
    "affected_version": "* - 6.9.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29124",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.5 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-2068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-2068",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder \u003c= 2.1.3 - Missing Access Controls",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9337",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Seraphinite Accelerator \u003c= 2.20.28 - Reflected Cross-Site Scripting via 'rt'",
    "slug": "seraphinite-accelerator",
    "type": "plugin",
    "affected_version": "* - 2.20.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5609",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GNUCommerce \u003c 0.5.7-BETA - Cross-Site Scripting",
    "slug": "gnucommerce",
    "type": "plugin",
    "affected_version": "[*, 0.5.7-beta)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.7-beta",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10920",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carousel, Slider, Gallery by WP Carousel \u003c= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-carousel-free",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4482",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via MediaElement.js",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.7",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via MediaElement.js",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.3",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via MediaElement.js",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.1",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via MediaElement.js",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via MediaElement.js",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.13",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via MediaElement.js",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.10",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via MediaElement.js",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.10",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via MediaElement.js",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.2",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via MediaElement.js",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.13",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via MediaElement.js",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.11",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Block \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-block",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45646",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goto - Tour \u0026 Travel WordPress Theme \u003c 2.1 - SQL Injection",
    "slug": "goto",
    "type": "theme",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24314",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wibstats \u003c= 0.5.5 - Reflected Cross-Site Scripting",
    "slug": "wibstats-statistics-for-wordpress-mu",
    "type": "plugin",
    "affected_version": "* - 0.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23565",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZoxPress - The All-In-One WordPress News Theme \u003c= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "zoxpress",
    "type": "theme",
    "affected_version": "* - 2.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13653",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Database Backup and check Tables Automated With Scheduler 2024 \u003c= 2.32 - Authenticated (Admin+) Arbitrary File Read",
    "slug": "database-backup",
    "type": "plugin",
    "affected_version": "* - 2.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12850",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "wp tell a friend popup form \u003c= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-tell-a-friend-popup-form",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25465",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor \u003c= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "gutentor",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4685",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TweetScribe \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "tweetscribe",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9399",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "StreamWeasels Kick Integration \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via vodsChannel Parameter",
    "slug": "streamweasels-kick-integration",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9442",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management System for Wordpress \u003c= 93.0.0 - Authenticated (Student+) Account Takeover and Privilege Escalation",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 93.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "93.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9658",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Thim Core \u003c= 2.3.3 - Cross-Site Request Forgery",
    "slug": "thim-core",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53344",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WR Price List Manager For Woocommerce \u003c= 1.0.8 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wr-price-list-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22782",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Embed RSS \u003c= 3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "embed-rss",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25081",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Hero Mega Menu - Responsive WordPress Menu Plugin \u003c= 1.16.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "hmenu",
    "type": "plugin",
    "affected_version": "* - 1.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13778",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Peter’s Collaboration E-mails \u003c= 2.2.0 - Cross-Site Request Forgery",
    "slug": "peters-collaboration-e-mails",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1761",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wordpress Simple Share Plugin \u003c= 0.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "dts-simple-share",
    "type": "plugin",
    "affected_version": "* - 0.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7556",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-4029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4029",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "DSK \u003c= 2.2 - Unauthenticated Local File Inclusion",
    "slug": "dsk",
    "type": "theme",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-24761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24761",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Conference Scheduler \u003c= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter",
    "slug": "conference-scheduler",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5258",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ThirstyAffiliates Affiliate Link Manager \u003c= 3.9.2 - Stored Cross-Site Scripting",
    "slug": "thirstyaffiliates",
    "type": "plugin",
    "affected_version": "* - 3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24127",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adsmonetizer \u003c= 3.1.2 - Reflected Cross-Site Scripting",
    "slug": "adsensei-b30",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1437",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Top Bar  \u003c= 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "top-bar",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1660",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AA Cash Calculator \u003c= 1.0 - Reflected Cross-Site Scripting via invoice",
    "slug": "aa-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0848",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LH Copy Media File \u003c= 1.08 - Reflected Cross-Site Scripting",
    "slug": "lh-copy-media-file",
    "type": "plugin",
    "affected_version": "* - 1.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9220",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Abundatrade Plugin \u003c= 1.8.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "abundatrade-plugin",
    "type": "plugin",
    "affected_version": "* - 1.8.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4199",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Organization chart \u003c= 1.4.1 - Missing Authorization",
    "slug": "organization-chart",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45844",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UTM Tracker \u003c= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "utm-tracker",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-23822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23822",
    "auth_type": "Privileged",
    "cvss_score": 3.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Crowdsignal Dashboard \u003c= 3.0.9 - Authorization Bypass",
    "slug": "polldaddy",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45069",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPML \u003c= 3.1.9 - Arbitrary Deletion of Content",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2791",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.6.4 - Unauthenticated Local File Inclusion",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26890",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ACF Frontend Display \u003c= 2.0.6 - Unauthenticated Arbitrary File Upload",
    "slug": "acf-frontend-display",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9479",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletters \u003c= 4.9.7 - Cross-Site Request Forgery",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37227",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Pro \u003c= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3124",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "InstaWP Connect – 1-click WP Staging \u0026 Migration \u003c= 0.1.0.22 - Unauthenticated Arbitrary File Upload",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.22",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-2667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2667",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "XStore \u003c= 9.3.8 - Missing Authorization",
    "slug": "xstore",
    "type": "theme",
    "affected_version": "* - 9.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPComplete \u003c= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpcomplete",
    "type": "plugin",
    "affected_version": "* - 2.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50046",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Poll Maker \u003c= 4.7.1 - Missing Authorization",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45766",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FoodBakery | Delivery Restaurant Directory WordPress Theme \u003c= 4.7 - Cross-Site Request Forgery in Multiple Functions",
    "slug": "wp-foodbakery",
    "type": "theme",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13933",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cost Calculator Builder \u003c= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "* - 3.2.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.67",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2128",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Pocket News Generator \u003c= 0.2.0 -  Cross-Site Request Forgery to Settings Update",
    "slug": "pocket-news-generator",
    "type": "plugin",
    "affected_version": "* - 0.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2964",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Post Meta Data Manager \u003c= 1.2.1 - Cross-Site Request Forgery to Post, Term, and User Meta Deletion",
    "slug": "post-meta-data-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5776",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.3.8 - Reflected Cross-Site Scripting",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50901",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Campaign Monitor for WordPress \u003c= 2.8.15 - Unauthenticated Full Path Disclosure",
    "slug": "forms-for-campaign-monitor",
    "type": "plugin",
    "affected_version": "* - 2.8.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6569",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Social Share Buttons \u003c= 9.4 - Missing Authorization",
    "slug": "easy-social-share-buttons3",
    "type": "plugin",
    "affected_version": "* - 9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31307",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Badgearoo \u003c= 1.0.14 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "badgearoo",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1033",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dyn Business Panel \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "dyn-business-panel",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13057",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "underConstruction \u003c= 1.18 - Reflected Cross-Site Scripting",
    "slug": "underconstruction",
    "type": "plugin",
    "affected_version": "* - 1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Password Protected – Password Protect your WordPress Site, Pages, \u0026 WooCommerce Products \u003c= 2.7.7 - Unauthenticated Sensitive Information Exposure",
    "slug": "password-protected",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3453",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JobCareer | Job Board Responsive WordPress Theme \u003c= 7.1 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrative Actions",
    "slug": "jobcareer",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12810",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EazyDocs \u003c= 2.3.5 - Unauthenticated Stored Cross-Site Scripting via edit_doc_one_page",
    "slug": "eazydocs",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47549",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Store Kit Elementor Addons \u003c= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-store-kit",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43342",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Splitit \u003c= 4.2.8 - Missing Authorization to Multiple Administrative Actions",
    "slug": "splitit-installment-payments",
    "type": "plugin",
    "affected_version": "* - 4.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4105",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.8.4 - Authenticated (Subscriber+) Arbitrary File Read",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4236",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "On Page SEO + Whatsapp Chat Button \u003c= 2.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ops-robots-txt",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25138",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.13.0 - Missing Authorization to Limited Information Exposure",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5939",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Print-O-Matic \u003c= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "print-o-matic",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3671",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP \u003c= 4.25.3 - Reflected Cross-Site Scripting",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "* - 4.25.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.25.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-5714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5714",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "visualslider Sldier \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "visual-slider",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23448",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Better Permalinks \u003c 3.0.5 - Cross-Site Request Forgery",
    "slug": "wp-better-permalinks",
    "type": "plugin",
    "affected_version": "[*, 3.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15835",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "String Locator \u003c= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization",
    "slug": "string-locator",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2434",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "API Bearer Auth \u003c 20190907 - Cross-Site Scripting",
    "slug": "api-bearer-auth",
    "type": "plugin",
    "affected_version": "[*, 20190907)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20190907",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16332",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Full Auto Tags Manager \u003c= 2.2 - Cross-Site Request Forgery",
    "slug": "wp-full-auto-tags-manager",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34024",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LocateAndFilter \u003c= 1.6.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "locateandfilter",
    "type": "plugin",
    "affected_version": "* - 1.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9304",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Popup Images  \u003c= 1.0 - Cross-Site Scripting",
    "slug": "simple-popup-images",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-3921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3921",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Missing Authorization in 'wpfc_purgecache_varnish_callback'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1929",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy WP Tiles \u003c= 1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-wp-tiles",
    "type": "plugin",
    "affected_version": "* - 1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25073",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Tickets Plus \u003c= 5.9.0 - Missing Authorization to Information Exposure",
    "slug": "event-tickets-plus",
    "type": "plugin",
    "affected_version": "* - 5.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1319",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "SuperSaaS – online appointment scheduling \u003c= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "supersaas-appointment-scheduling",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37460",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Post \u003c= 4.10 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "dynamic-post",
    "type": "plugin",
    "affected_version": "* - 4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39522",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Beaver Builder \u003c= 2.8.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.8.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53797",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BulletProof Security \u003c= .48.9 - Cross-Site Scripting",
    "slug": "bulletproof-security",
    "type": "plugin",
    "affected_version": "* - .48.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": ".48.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-3487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3487",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Remote Content Shortcode \u003c= 1.5 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "remote-content-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2090",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Motors – Car Dealer \u0026 Classified Ads \u003c= 1.4.6 - Server Side Request Forgery",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46207",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AM LottiePlayer \u003c= 3.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Lottie File",
    "slug": "am-lottieplayer",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1529",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Paginate \u003c= 2.1.3 - Admin+ Stored Cross-Site Scripting",
    "slug": "wp-paginate",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4222",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BulletProof Security \u003c .51.1 - Server-Side Request Forgery",
    "slug": "bulletproof-security",
    "type": "plugin",
    "affected_version": "* - .51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": ".51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-8749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8749",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 1.8.2 - Authentication Bypass",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-4828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4828",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WHMCS Bridge \u003c= 6.3 - Reflected Cross-Site Scripting",
    "slug": "whmcs-bridge",
    "type": "plugin",
    "affected_version": "* - 6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25112",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Style Tweaker \u003c= 0.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "style-tweaker",
    "type": "plugin",
    "affected_version": "* - 0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25160",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetBlocks For Elementor \u003c= 1.3.16 - Missing Authorization",
    "slug": "jet-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39451",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All in One B2B for WooCommerce \u003c= 1.0.3 - Unauthenticated Privilege Escalation",
    "slug": "all-in-one-b2b-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-4703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4703",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25031",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.29",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.22",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.20",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.17",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.16",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.5",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.26",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.21",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.13",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.8",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.2",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.32",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.29",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.12",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.32",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.30",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.4",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11025",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Nemesis All-in-One \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nemesis-all-in-one",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31849",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextScripts: Social Networks Auto-Poster \u003c= 4.3.23 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "type": "plugin",
    "affected_version": "[*, 4.3.24)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.24",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24975",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GlobalPayments WooCommerce \u003c= 1.13.2 - Reflected Cross-Site Scripting",
    "slug": "global-payments-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22767",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login with phone number \u003c= 1.6.93 - Cross-Site Request Forgery",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "* - 1.6.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31424",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.2.40 - Reflected Cross-Site Scripting",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1822",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.2.40 - Reflected Cross-Site Scripting",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "3.2.40",
    "from_version": "3.2.40",
    "from_inclusive": true,
    "to_version": "3.2.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1822",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon Page, Under Construction \u0026 Maintenance Mode by SeedProd \u003c= 6.15.20 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "coming-soon",
    "type": "plugin",
    "affected_version": "* - 6.15.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.15.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32088",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bit Form – Contact Form Plugin \u003c= 2.18.0 - Open Redirect",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30885",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Estate Manager \u003c= 7.2 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "real-estate-manager",
    "type": "plugin",
    "affected_version": "* - 7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4239",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Sitemap \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpsitemap",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31733",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup and Restore WordPress \u003c= 1.50 - Missing Authorization",
    "slug": "wp-backitup",
    "type": "plugin",
    "affected_version": "* - 1.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43270",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Master Slider – Responsive Touch Slider \u003c= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4470",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventin \u003c= 4.0.28 - Reflected Cross-Site Scripting",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49321",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "F4 Improvements \u003c= 1.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "f4-improvements",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31925",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Captcha/Honeypot for Contact Form 7 \u003c= 1.11.3 - Captcha Bypass",
    "slug": "captcha-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45009",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP HTML Sitemap \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "wp-html-sitemap",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-2675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2675",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Cool Timeline (Horizontal \u0026 Vertical Timeline) \u003c= 2.0.2 - Cross-Site Request Forgery Bypass",
    "slug": "cool-timeline",
    "type": "plugin",
    "affected_version": "[*, 2.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36738",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "KiviCare – Clinic \u0026 Patient Management System (EHR) \u003c= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection",
    "slug": "kivicare-clinic-management-system",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11730",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "oik \u003c= 4.12.0 - Cross-Site Request Forgery",
    "slug": "oik",
    "type": "plugin",
    "affected_version": "* - 4.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43356",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Read More \u0026 Accordion \u003c= 3.4.7 - Cross-Site Request Forgery to Local File Inclusion",
    "slug": "expand-maker",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0810",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Property Listings \u003c= 3.5.3 - Cross-Site Request Forgery",
    "slug": "easy-property-listings",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3163",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Shockingly Big IE6 Warning \u003c= 1.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "shockingly-big-ie6-warning",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23442",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customizable Captcha and Contact Us \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "customizable-captcha-and-contact-us-form",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23503",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Wishlist \u003c= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file Function",
    "slug": "smart-wishlist-for-more-convert",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13694",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Charitable \u003c= 1.5.13 - Unauthorized Access to Information Disclosure",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "[*, 1.5.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-21011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-21011",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles \u0026 User Role Editor \u003c= 3.12.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6708",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FAQ Builder AYS \u003c= 1.7.1 - Reflected Cross-Site Scripting",
    "slug": "faq-builder-ays",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11458",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Plugin \u003c= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download",
    "slug": "download-plugin",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9829",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quttera Web Malware Scanner \u003c= 3.4.1.48 - Sensitive Data Exposure",
    "slug": "quttera-web-malware-scanner",
    "type": "plugin",
    "affected_version": "* - 3.4.1.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6065",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Mailrelay \u003c= 2.1.1 - Cross-Site Request Forgery via render_admin_page",
    "slug": "mailrelay",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45108",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rolo Slider \u003c= 1.0.9 - Missing Authorization to Authenticated(Subscriber+) Settings Change",
    "slug": "rolo-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1438",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.12.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5381",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Affiliate Platform \u003c 6.5.1 - Reflected Cross-Site Scripting via Affiliate Editing",
    "slug": "wp-affiliate-platform",
    "type": "plugin",
    "affected_version": "[*, 6.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-5281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5281",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cleaner \u003c= 1.1.5 - Reflected Cross-Site Scripting",
    "slug": "wpcleaner",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31446",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCOM Member \u003c= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta",
    "slug": "wpcom-member",
    "type": "plugin",
    "affected_version": "* - 1.5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-7493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7493",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.9.7 - Reflected Cross-Site-Scripting",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "[*, 2.9.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1910",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cleanup and Basic Functions \u003c= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "wp-cleanup-and-basic-functions",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9455",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.13 - Cross-Site Request Forgery to Plugin Data Removal in reinitialize",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1339",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11641",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Scriptless Social Sharing \u003c= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "scriptless-social-sharing",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39529",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "New User Approve \u003c= 2.5.1 - Cross-Site Request Forgery via admin_notices",
    "slug": "new-user-approve",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50902",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.5.1 - Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-0236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-0236",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Floating Content \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-floating-content-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Album and Image Gallery plus Lightbox \u003c= 1.6.2 - Missing Authorization",
    "slug": "album-and-image-gallery-plus-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.6.2.",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2.",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25060",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LeadSquared Suite \u003c= 0.7.4 - Cross-Site Request Forgery",
    "slug": "leadsquared-suite",
    "type": "plugin",
    "affected_version": "* - 0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45047",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Hestia \u003c= 3.1.2 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "hestia",
    "type": "theme",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37467",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – Old Dominion Edition \u003c= 4.2.10 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-odfl-edition",
    "type": "plugin",
    "affected_version": "* - 4.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13489",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Cart2Cart: Magento to WooCommerce Migration \u003c= 2.0.0 - Missing Authorization via setToken",
    "slug": "cart2cart-magento-to-woocommerce-migration",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-34379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34379",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
  },
  {
    "title": "Apus Framework \u003c= 2.3 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_options",
    "slug": "apus-framework",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12296",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Library Instruction Recorder \u003c= 1.1.4 - Reflected Cross-Site Scripting",
    "slug": "library-instruction-recorder",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23646",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Attach Gallery Posts \u003c= 1.6 - Reflected Cross-Site Scripting",
    "slug": "attach-gallery-posts",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23441",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_order",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4165",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_order",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4165",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EmailPress \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "emailpress",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23593",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Code Snippets \u003c= 2.13.3 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "code-snippets",
    "type": "plugin",
    "affected_version": "* - 2.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-8417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8417",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Amr Ical Events Lists \u003c= 6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "amr-ical-events-list",
    "type": "plugin",
    "affected_version": "* - 6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1021",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N"
  },
  {
    "title": "File Manager Pro – Filester \u003c= 1.8.2 - Authenticated Plugin Settings Update",
    "slug": "filester",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7031",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Custom Sidebar \u003c= 2.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "wordpress-custom-sidebar",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23912",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Social Media Share Buttons \u003c= 2.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ultimate-social-media-icons",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2118",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nioland \u003c= 1.2.6 - Reflected Cross-Site Scripting via s",
    "slug": "nioland",
    "type": "theme",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10250",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AppBanners \u003c= 1.5.14 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "appbanners",
    "type": "plugin",
    "affected_version": "* - 1.5.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30625",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My IDX Home Search \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "my-idx-home-search",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12502",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WatchTowerHQ \u003c= 3.6.16 - Type Juggling to Authentication Bypass in check_ota",
    "slug": "watchtowerhq",
    "type": "plugin",
    "affected_version": "* - 3.6.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-25701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25701",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Links \u003c= 1.0.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "social-links",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25137",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Short URL \u003c= 1.6.8 - Reflected Cross-Site Scripting",
    "slug": "shorten-url",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32138",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks \u003c= 4.0.6 - Missing Authorization via template_count",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2086",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "True Ranker \u003c= 2.2.2 - Directory Traversal/Arbitrary File Read",
    "slug": "seo-local-rank",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39312",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "drop in image slideshow gallery \u003c= 12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "drop-in-image-slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51914",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Classified Listings \u003c= 1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "ultimate-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52487",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO ALert \u003c= 1.5.9 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "seo-alert",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2225",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RS Elements Elementor Addon \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rselements-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26745",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Interactive World Maps \u003c= 2.4.14 - Reflected Cross-Site Scripting",
    "slug": "interactive-world-maps",
    "type": "plugin",
    "affected_version": "* - 2.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3681",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Loan Calculator \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "repayment-calculator",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46442",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Top 10  \u003c= 2.9.4 - Cross-Site Request Forgery Bypass",
    "slug": "top-10",
    "type": "plugin",
    "affected_version": "[*, 2.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36761",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MDx \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdx_list_item Shortcode",
    "slug": "MDx",
    "type": "theme",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6639",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Image from URL (FIFU) \u003c= 5.2.7 - Authenticated (Admin+) SQL Injection",
    "slug": "featured-image-from-url",
    "type": "plugin",
    "affected_version": "* - 5.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10037",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Social Media Share Buttons \u003c= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "mashsharer",
    "type": "plugin",
    "affected_version": "* - 3.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4544",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Revamp CRM for WooCommerce \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "revampcrm-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Resoto \u003c= 1.0.8 - Missing Authorization leading to Authenticated (Subscriber+) Arbitrary Plugin Activation",
    "slug": "resoto",
    "type": "theme",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28619",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.4 - Authenticated(Administrator+) Blind Server Side Request Forgery via check_url",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1938",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "RSS Feed Widget \u003c= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rss-feed-widget",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9836",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Edit Comments XT \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "edit-comments-xt",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38336",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Counters Block \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "counters-block",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26939",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend File Manager Plugin \u003c= 18.2 - Unauthenticated Arbitrary Post Deletion",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "[*, 18.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4359",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Events Manager \u003c= 5.5.7.1 - Code Injection",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "[*, 5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9298",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) \u003c= 1.1.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect Widget",
    "slug": "magical-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2923",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rise Blocks – A Complete Gutenberg Page Builder \u003c= 3.1 - Cross-Site Request Forgery",
    "slug": "rise-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51378",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShiftController Employee Shift Scheduling \u003c= 4.9.57 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "shiftcontroller",
    "type": "plugin",
    "affected_version": "* - 4.9.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.57",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4733",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NewsCard \u003c= 1.3 - Unauthenticated Local File Inclusion",
    "slug": "newscard",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50434",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bonjour Bar \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bonjour-bar",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22262",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Loginizer \u003c= 1.7.5 - Cross-Site Request Forgery",
    "slug": "loginizer",
    "type": "plugin",
    "affected_version": "[*, 1.7.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-45079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45079",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Access Manager \u003c 1.2 - Cross-Site Request Forgery",
    "slug": "user-access-manager",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2011-5328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5328",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.0.1 - Missing Authorization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2010-5297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-5297",
    "auth_type": "Privileged",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Tiles \u003c= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "wp-tiles",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4827",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shipment Tracking, Tracking, and Order Tracking for WooCommerce – ParcelPanel (Free to install) \u003c= 3.8.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "parcelpanel",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-34412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34412",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Analytify Dashboard \u003c= 5.1.0 - Missing Authorization to Opt-In",
    "slug": "wp-analytify",
    "type": "plugin",
    "affected_version": "[*, 5.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-41695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41695",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Premium Packages \u003c= 6.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpdm-premium-packages",
    "type": "plugin",
    "affected_version": "* - 6.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30991",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yahoo Updates For WordPress \u003c= 1.0 - Cross-Site Scripting",
    "slug": "yahoo-updates-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4603",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "GraceMedia Media Player \u003c= 1.0 - Local File Inclusion",
    "slug": "gracemedia-media-player",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9618",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cards for Beaver Builder \u003c= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard link",
    "slug": "bb-bootstrap-cards",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2305",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All in One SEO Pack \u003c= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "* - 4.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0585",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chameleon HTML5 Audio Player With/Without Playlist \u003c= 3.5.6 - Authenticated (Contributor+) SQL Injection",
    "slug": "lbg-audio1-html5",
    "type": "plugin",
    "affected_version": "* - 3.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32307",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SEOPress for MainWP \u003c= 1.4 - Unauthenticated Local File Inclusion",
    "slug": "seopress-for-mainwp",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48298",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Catalog Simple \u003c= 1.5.13 - Cross-Site Request Forgery Bypass",
    "slug": "post-type-x",
    "type": "plugin",
    "affected_version": "[*, 1.5.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36743",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bookly \u003c= 21.7.1 - Arbitrary File Deletion",
    "slug": "bookly-responsive-appointment-booking-tool",
    "type": "plugin",
    "affected_version": "* - 21.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-26526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26526",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Marketing Optimizer \u003c= 20200925 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "marketing-optimizer",
    "type": "plugin",
    "affected_version": "* - 20200925",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20200925",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1976",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Master Addons \u003c= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9618",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MakeStories (for Google Web Stories) \u003c= 3.0.4 - Authenticated (Author+) Server-Side Request Forgery",
    "slug": "makestories-helper",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57984",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mortgage Calculators WP \u003c= 1.56 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mortgage-calculators-wp",
    "type": "plugin",
    "affected_version": "* - 1.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.56",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32581",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Form Builder \u003c= 1.0 - Arbitrary File Upload",
    "slug": "easy-form-builder-by-bitware",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24224",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "KKProgressbar2 Free \u003c= 1.1.4.2 - Cross-Site Request Forgery to Progress Bar Deletion",
    "slug": "kkprogressbar",
    "type": "plugin",
    "affected_version": "* - 1.1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4535",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post List With Featured Image \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "post-list-with-featured-image",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37997",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPAdverts – Classifieds Plugin \u003c= 2.1.2 - Cross-Site Request Forgery",
    "slug": "wpadverts",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37238",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EasyAzon – Amazon Associates Affiliate \u003c= 5.1.0 - Missing Authorization on AJAX actions",
    "slug": "easyazon",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47780",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wp-championship \u003c= 9.2 - Multiple Cross-Site Request Forgery Vulnerabilities",
    "slug": "wp-championship",
    "type": "plugin",
    "affected_version": "* - 9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1967",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPKoi Templates for Elementor \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpkoi-templates-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49679",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ClickBank Affiliate Ads \u003c 1.31 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "clickbank-ads-clickbank-widget",
    "type": "plugin",
    "affected_version": "[*, 1.31)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-20105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-20105",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ibtana \u003c= 1.2.5.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion",
    "slug": "ibtana-visual-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59581",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Blocks \u003c= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 5.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11361",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Service Area Postcode Checker \u003c= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "service-area-postcode-checker",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25782",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 6.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 6.5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-47374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47374",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Joy Of Text Lite \u003c= 2.3.1 - Missing Authorization",
    "slug": "joy-of-text",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47337",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.78 - Unauthenticated Arbitrary File Upload",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.78",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.78",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5360",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LetsRecover \u003c= 1.1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "letsrecover-woocommerce-abandoned-cart",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4356",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zox News \u003c= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification",
    "slug": "zox-news",
    "type": "plugin",
    "affected_version": "* - 3.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.17.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13643",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simplebooklet PDF Viewer and Embedder \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simplebooklet",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30922",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery, Images, Slider in Rbs Image Gallery \u003c= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Private Gallery Title Disclosure",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8431",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ElementsKit Elementor addons 3.0.7 - 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "3.0.7 - 3.1.2",
    "from_version": "3.0.7",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3650",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapPress Maps for WordPress \u003c=2.53.8 - Authenticated Map Creation/Deletion to Stored Cross-Site Scripting \u0026 Remote Code Execution",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 2.53.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.53.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-12077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12077",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Responsive Lightbox \u0026 Gallery \u003c= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FireStats \u003c 1.6.2 - Remote File Inclusion",
    "slug": "firestats",
    "type": "plugin",
    "affected_version": "[*, 1.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2009-2143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2143",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booster for WooCommerce (Free \u003c= 5.6.6, Premium \u003c= 5.6.4) - Cross-Site Request Forgery to File Deletion",
    "slug": "booster-plus-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3763",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booster for WooCommerce (Free \u003c= 5.6.6, Premium \u003c= 5.6.4) - Cross-Site Request Forgery to File Deletion",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 5.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3763",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "tagDiv Composer \u003c= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3888",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple Shopping Cart \u003c= 4.6.3 - Information Disclosure",
    "slug": "wordpress-simple-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "4.6.3",
    "from_version": "4.6.3",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1431",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 5.10 - Missing Authorization to Information Disclosure",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "[*, 5.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-20866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20866",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 5.10 - Missing Authorization to Information Disclosure",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "[*, 5.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-20866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20866",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ivory Search \u003c= 4.6.6 - Reflected Cross-Site Scripting",
    "slug": "add-search-to-menu",
    "type": "plugin",
    "affected_version": "* - 4.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36869",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search Everything \u003c= 7.0.2 - SQL Injection",
    "slug": "search-everything",
    "type": "plugin",
    "affected_version": "[*, 7.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-2316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2316",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4218",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-ecommerce-cvs-importer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-image-news-slider",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "apptha-banner",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "mac-dock-photogallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "comment-extra-field",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "sprapid",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wysija-newsletters",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "power-zoomer",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "dm-albums",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-powerplaygallery",
    "type": "plugin",
    "affected_version": "[*, 3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-dreamworkgallery",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-levoslideshow",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "apptha-slider-gallery",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "smart-slide-show",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "mac-dock-gallery",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "slide-show-pro",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "fluid-accessible-ui-options",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "spotlightyour",
    "type": "plugin",
    "affected_version": "[*, 4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "blaze-slide-show-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "fresh-page",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-3dbanner-rotator",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-bliss-gallery",
    "type": "plugin",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-carouselslideshow",
    "type": "plugin",
    "affected_version": "* - 3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-matrix-gallery",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-royal-gallery",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-extended",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-3dflick-slideshow",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-superb-slideshow",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-flipslideshow",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-vertical-gallery",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "fluid-accessible-uploader",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "pdw-file-browser",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-homepage-slideshow",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "wp-yasslideshow",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "flash-album-gallery",
    "type": "plugin",
    "affected_version": "[*, 2.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "fluid-accessible-pager",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "ultimate-tinymce",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "fluid-accessible-rich-inline-edit",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SWFUpload \u003c= 2.2.0.1 - Cross-Site Scripting",
    "slug": "pica-photo-gallery",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goodlayers Core \u003c= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "goodlayers-core",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11357",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP YouTube Lyte \u003c= 1.7.15 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "wp-youtube-lyte",
    "type": "plugin",
    "affected_version": "[*, 1.7.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.16",
    "to_inclusive": false,
    "severity": "low",
    "cve": "CVE-2021-24419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24419",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Kali Forms \u003c= 2.1.1 - Missing Authorization to Settings Update",
    "slug": "kali-forms",
    "type": "plugin",
    "affected_version": "[*, 2.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36720",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "CURCY \u003c= 2.1.25 - Missing Authorization to Currency Exchange Retrieval",
    "slug": "woo-multi-currency",
    "type": "plugin",
    "affected_version": "* - 2.1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46796",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Mail \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-mail",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58822",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Herd Effects \u003c= 6.2.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "mwp-herd-effect",
    "type": "plugin",
    "affected_version": "* - 6.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24716",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tagesteller / Mittagsmenü \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "tagesteller",
    "type": "plugin",
    "affected_version": "* - v.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "v.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23609",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CF7 Google Sheets Connector \u003c= 5.0.5 - Unauthenticated Sensitive Information Exposure via Debug Log",
    "slug": "cf7-google-sheets-connector",
    "type": "plugin",
    "affected_version": "* - 5.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-44989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44989",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPQA - Builder forms Addon For WordPress plugin \u003c= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpqa",
    "type": "plugin",
    "affected_version": "* - 6.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2375",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.248 - Missing Authorization",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.248",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.248",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-28004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-28004",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Registration \u003c= 4.1.5 - Reflected Cross-Site Scripting",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39400",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEOPress – On-site SEO \u003c= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 7.5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1134",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blue Triad EZAnalytics \u003c= 1.0 - Reflected Cross-Site Scripting via 'bt_webid'",
    "slug": "blue-triad-ezanalytics",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1782",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery – Photo Contest Plugin for WordPress \u003c= 13.1.0.5 - SQL Injection",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 13.1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24915",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Emoji Shortcode \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "emoji-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51609",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clearfy Cache \u003c= 2.3.2 - Cross-Site Request Forgery",
    "slug": "clearfy",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34806",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Ads – Ad Manager \u0026 AdSense \u003c= 1.52.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Ad Widget",
    "slug": "advanced-ads",
    "type": "plugin",
    "affected_version": "* - 1.52.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.52.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3952",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "teachPress \u003c= 8.1.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "teachpress",
    "type": "plugin",
    "affected_version": "* - 8.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-22704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22704",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StoryChief \u003c= 1.0.42 - Unauthenticated Arbitrary File Upload",
    "slug": "story-chief",
    "type": "plugin",
    "affected_version": "* - 1.0.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.42",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7441",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Prime Slider – Addons For Elementor \u003c= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widget",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1506",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aparat \u003c= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "aparat",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48770",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Smart Tooltip \u003c= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-smart-tool-tip",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23669",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 2.9.25 - Insecure Direct Object Reference to Order Manipulation",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 2.9.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41796",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Advertising System \u003c= 1.3.1 - Unauthenticated PHP Object Injection",
    "slug": "advanced-advertising-system",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49624",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Atarim \u003c= 4.0 - Missing Authorization",
    "slug": "atarim-visual-collaboration",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38771",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Grid Master \u003c= 3.4.7 - Missing Authorization",
    "slug": "ajax-filter-posts",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34372",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Leaflet Maps Marker \u003c 3.12.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "leaflet-maps-marker",
    "type": "plugin",
    "affected_version": "* - 3.12.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4677",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Rotating Tweets (Twitter widget and shortcode) \u003c= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "rotatingtweets",
    "type": "plugin",
    "affected_version": "* - 1.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5141",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom post types \u003c= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "custom-post-types",
    "type": "plugin",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32116",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4656",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Delisho \u003c= 1.1.3 - Missing Authorization",
    "slug": "dr-widgets-blocks",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60128",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.16.4 - Missing Authorization to Arbitrary Attachment Read",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47504",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Subaccounts for WooCommerce \u003c= 1.6.6 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover",
    "slug": "subaccounts-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47461",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Recapture for WooCommerce \u003c= 1.0.43 - Cross-Site Request Forgery to Settings Update",
    "slug": "recapture-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26899",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dash \u003c= 1.3 - Unauthenticated PHP Object Injection",
    "slug": "dash",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31049",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LoginPress Pro \u003c= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider",
    "slug": "loginpress-pro",
    "type": "plugin",
    "affected_version": "* - 5.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7444",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GoogleDrive folder list \u003c= 2.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "googledrive-folder-list",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49335",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Csv2WPeC Coupon \u003c= 1.1 - Arbitrary File Upload",
    "slug": "csv2wpec-coupon",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-1000013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000013",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MIPL WC Multisite Sync \u003c= 1.1.5 - Unauthenticated Arbitrary File Download",
    "slug": "mipl-wc-multisite-sync",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12152",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Lyrics \u003c= 0.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wplyrics",
    "type": "plugin",
    "affected_version": "* - 0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23533",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.2.6 - Authenticated (Administrator+) Arbitrary File Deletion",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4347",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Crawlomatic Multisite Scraper Post Generator \u003c= 2.6.8.2 - Unauthenticated Information Exposure via Log Files",
    "slug": "crawlomatic-multipage-scraper-post-generator",
    "type": "plugin",
    "affected_version": "* - 2.6.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49294",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GDPR Cookie Compliance \u003c= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gdpr-cookie-compliance",
    "type": "plugin",
    "affected_version": "* - 4.15.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2205",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soundcloud Is Gold \u003c= 2.2 - Cross-Site Scripting",
    "slug": "soundcloud-is-gold",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-6624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6624",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Geotagged Media \u003c= 0.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "geotagged-media",
    "type": "plugin",
    "affected_version": "* - 0.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23558",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arya Multipurpose Pro \u003c= 1.0.8 - Reflected Cross-Site Scripting",
    "slug": "arya-multipurpose-pro",
    "type": "theme",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41237",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add infos to the events calendar \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "add-infos-to-the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11875",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.35 - Regular Expressions Denial of Service",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.35",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-6434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6434",
    "auth_type": "Auth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Export WP Page to Static HTML/CSS \u003c= 2.2.2 - Open Redirect",
    "slug": "export-wp-page-to-static-html",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3597",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks – Page Builder Features \u003c= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4057",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery and Lightbox \u003c= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gallery-and-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22797",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "1 Decembrie 1918 \u003c= 1.dec.2012 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "1-decembrie-1918",
    "type": "plugin",
    "affected_version": "* - 1.dec.2012",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.dec.2012",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3870",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Blocks \u003c= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8536",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Very Simple Google Maps \u003c= 2.8.4 - Authenticated (Contributor+) Stored Cross Site Scripting",
    "slug": "very-simple-google-maps",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23864",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Customers Manager \u003c 30.1 - Cross-Site Request Forgery to Customer Deletion",
    "slug": "woocommerce-customers-manager",
    "type": "plugin",
    "affected_version": "[*, 30.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "30.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-3983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3983",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Arena.IM – Live Blogging for real-time events \u003c= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "arena-liveblog-and-chat-tool",
    "type": "plugin",
    "affected_version": "* - 0.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11384",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adventure Journal \u003c= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "adventure-journal",
    "type": "theme",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33953",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeproDev Ultimate Invoice \u003c= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pepro-ultimate-invoice",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49298",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.4",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.16",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.14",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.6",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.1",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.16",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.13",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.13",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.10",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.5",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5491",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WP Custom Cursors \u003c 3.2 - Cross-Site Request Forgery",
    "slug": "wp-custom-cursors",
    "type": "plugin",
    "affected_version": "[*, 3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-32739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32739",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All in One Time Clock Lite \u003c= 1.3.325 - Cross-Site Request Forgery",
    "slug": "aio-time-clock-lite",
    "type": "plugin",
    "affected_version": "* - 1.3.325",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.325",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46513",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7778",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Compact WP Audio Player \u003c= 1.9.6 - Setting Change via Cross-Site Request Forgery",
    "slug": "compact-wp-audio-player",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24735",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TCBD Popover \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tcbd-popover",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11751",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Breeze Display \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size Parameter",
    "slug": "wt-display-breeze",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3749",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Generator For Fluent Forms \u003c= 1.1.7 - Cross-Site Scripting",
    "slug": "fluentforms-pdf",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6953",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tube Video Ads Lite \u003c= 1.5.7 - Reflected Cross-Site Scripting",
    "slug": "tube-video-ads-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13625",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Table by Supsystic \u003c= 1.9.12 - Authenticated (Admin+) Content Injection",
    "slug": "pricing-table-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.12",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32790",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spambam \u003c= 2.1 - Authorization Bypass",
    "slug": "spambam",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-4616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-4616",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Team Members Showcase \u003c= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dazzlersoft-teams",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32957",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rizzi Guestbook \u003c= 4.0.1 - Reflected Cross-Site Scripting",
    "slug": "rizzi-guestbook",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26573",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smush – Lazy Load Images, Optimize \u0026 Compress Images \u003c= 2.7.5 - Directory Traversal",
    "slug": "wp-smushit",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-15079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-15079",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Cashtomer \u003c= 1.0.0 - Authenticated (Admin+) SQL Injection",
    "slug": "cashtomer",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24391",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.29",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.29",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.20",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.2",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.32",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.26",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.16",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.13",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.8",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.4",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.17",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.32",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.30",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.22",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.21",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.12",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.5",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-11026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Courses LMS \u003c 2.0.44 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-courses",
    "type": "plugin",
    "affected_version": "[*, 2.0.44)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.44",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24621",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module",
    "slug": "ultimate-addons-for-contact-form-7",
    "type": "plugin",
    "affected_version": "3.5.11 - 3.5.19",
    "from_version": "3.5.11",
    "from_inclusive": true,
    "to_version": "3.5.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6212",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Umberto \u003c= 1.2.8 - Unauthenticated PHP Object Injection",
    "slug": "umberto",
    "type": "theme",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31423",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Groundhogg \u003c= 2.7.9.3 - Authenticated (Administrator)+ SQL Injection",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 2.7.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1425",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Job Board Manager \u003c= 2.1.60 - Reflected Cross-Site Scripting",
    "slug": "job-board-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22679",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inline Google Maps \u003c= 5.11 - Cross-Site Request Forgery",
    "slug": "google-maps-advanced",
    "type": "plugin",
    "affected_version": "* - 5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1829",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Exquisite - Ultimate Newspaper Theme \u003c= 1.3.3 - Cross-Site Scripting",
    "slug": "exquisite-wp",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9500",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Blocks \u003c= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10678",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c= 1.1 - SQL Injection",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-0939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0939",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Enter Addons – Ultimate Template Builder for Elementor \u003c= 2.1.9 - Authenticated (Contributor+) Post Disclosure",
    "slug": "enteraddons",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10868",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Motors – Car Dealer, Classifieds \u0026 Listing \u003c= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.57",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13737",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.8.2 - Missing Authorization to Unauthenticated Password Protected Event Disclosure",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5333",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Display custom fields in the frontend – Post and User Profile Fields \u003c= 1.2.0 - Missing Authorization via vg_display_data shortcode",
    "slug": "shortcode-to-display-post-and-user-data",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31073",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Zip Recipes \u003c= 8.0.6 - Reflected Cross-Site Scripting via 's' parameter",
    "slug": "zip-recipes",
    "type": "plugin",
    "affected_version": "[*, 8.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-31076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31076",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Autocompleter \u003c= 1.3.5.2 - Cross-Site Request Forgery",
    "slug": "autocompleter",
    "type": "plugin",
    "affected_version": "* - 1.3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22325",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conversios.io \u003c= 6.5.3 - Reflected Cross-Site Scripting",
    "slug": "enhanced-e-commerce-for-woocommerce-store",
    "type": "plugin",
    "affected_version": "* - 6.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi Step Form \u003c= 1.7.25 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "multi-step-form",
    "type": "plugin",
    "affected_version": "* - 1.7.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9515",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Analytify \u003c= 5.3.1 - Cross-Site Request Forgery to Opt-out",
    "slug": "wp-analytify",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43265",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Realty by BestWebSoft \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "realty",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51786",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "We’re Open! \u003c= 1.46 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "opening-hours",
    "type": "plugin",
    "affected_version": "* - 1.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25964",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Front End Users \u003c= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "front-end-only-users",
    "type": "plugin",
    "affected_version": "* - 3.2.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26877",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Frontend \u003c= 3.6.8 - Missing Authorization via AJAX actions",
    "slug": "wp-user-frontend",
    "type": "plugin",
    "affected_version": "* - 3.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45002",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zass - WooCommerce Theme for Handmade Artists and Artisans \u003c= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo Import",
    "slug": "zass",
    "type": "theme",
    "affected_version": "* - 3.9.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13810",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Weather Widget Pro \u003c= 1.1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "weather-in-any-city-widget",
    "type": "plugin",
    "affected_version": "* - 1.1.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35755",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sync Feedly \u003c= 1.0.1 - Cross-Site Request Forgery to Sync Trigger",
    "slug": "sync-feedly",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9894",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Members Import \u003c= 1.4.2 - Self Cross-Site Scripting",
    "slug": "members-import",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4663",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relocate Upload \u003c 0.20 - Remote File Inclusion",
    "slug": "relocate-upload",
    "type": "plugin",
    "affected_version": "[*, 0.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.20",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-1205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-1205",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Basic Interactive World Map \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "basic-interactive-world-map",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47223",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12205",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Smart Linked Products - Upsells \u0026 Cross-sells for WooCommerce \u003c= 1.3.5 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "wpc-smart-linked-products",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30825",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Grand Restaurant WordPress \u003c= 7.0 - Missing Authorization to Unauthenticated Arbitrary Options Deletion",
    "slug": "grandrestaurant",
    "type": "theme",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39352",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.87 - Cross-Site Request Forgery via remove_from_compare",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0515",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "which template file \u003c= 5.0.0 - Unauthenticated Cross-Site Scripting",
    "slug": "which-template-file",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49177",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.29",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.23",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.1",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.12",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.9",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.10",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.29",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.26",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.26",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.19",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.18",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.27",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.17",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.13",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.5",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.2",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16219",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetFormBuilder \u003c= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation",
    "slug": "jetformbuilder",
    "type": "plugin",
    "affected_version": "* - 3.3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7291",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booking Calendar \u003c= 9.4.2 - Authenticated (Admin+) SQL Injection",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 9.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23991",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photography \u003c= 7.5.2 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "photography",
    "type": "theme",
    "affected_version": "* - 7.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47584",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OpenBook Book Data \u003c= 3.5.2 - Cross-Site Request Forgery",
    "slug": "openbook-book-data",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1842",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP GeoNames \u003c= 1.8 - Reflected Cross-Site Scripting",
    "slug": "wp-geonames",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53812",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Learning Pro \u003c= 3.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "indeed-learning-pro",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22350",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "School Management System – WPSchoolPress \u003c= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover",
    "slug": "wpschoolpress",
    "type": "plugin",
    "affected_version": "* - 2.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1667",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.5.44.7212 - Authenticated (Contributor+) Arbitrary Redirect",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.44.7212",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.44.7212",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32078",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bbPress API \u003c= 1.0.14 - Missing Authorization",
    "slug": "bbp-api",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24763",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Google Adsense \u0026 Banner Ads by AdsforWP \u003c= 1.9.28 - Cross-Site Request Forgery",
    "slug": "ads-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.9.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38751",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Xagio SEO \u003c= 7.0.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xagio-seo",
    "type": "plugin",
    "affected_version": "* - 7.0.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24702",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ocean Extra \u003c= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LoginWP - Pro \u003c= 4.0.8.5 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "loginwp-pro",
    "type": "plugin",
    "affected_version": "* - 4.0.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46255",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link to URL / Post \u003c= 1.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "link-to-url-post",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25116",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Easy Affiliate Links \u003c= 3.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 3.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34441",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.1.2 - Missing Authorization to Product Creation/Modification",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48747",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Software License Manager \u003c= 4.5.0 - Cross-Site Request Forgery leading to Arbitrary Domain Deletion",
    "slug": "software-license-manager",
    "type": "plugin",
    "affected_version": "[*, 4.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24711",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Video Player with Analytics \u003c= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-video-player-with-analytics",
    "type": "plugin",
    "affected_version": "* - 1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51824",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yumpu ePaper publishing \u003c= 2.0.24 - Missing Authorization to PDF Upload, Publishing, and API Key Modification",
    "slug": "yumpu-epaper-publishing",
    "type": "plugin",
    "affected_version": "* - 2.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3277",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_timeline' Shortcode",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.15.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1357",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Gravity Forms Dynamics CRM \u003c= 1.1.4 - Open Redirect",
    "slug": "gf-dynamics-crm",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47454",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "chatplusjp \u003c= 1.02 - Reflected Cross-Site Scripting",
    "slug": "chatplusjp",
    "type": "plugin",
    "affected_version": "* - 1.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49664",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Audio Editor \u0026 Recorder \u003c= 2.2.1 - Missing Authorization",
    "slug": "audio-editor-recorder",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49509",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 1.6.5 - Cross-Site Scripting via s parameter",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19110",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGYM \u003c= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "gym-management",
    "type": "plugin",
    "affected_version": "* - 67.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "67.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9941",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email Before Download \u003c= 6.7 - Admin+ SQL Injection",
    "slug": "email-before-download",
    "type": "plugin",
    "affected_version": "* - 6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24748",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfilePress \u003c= 3.2.2 - Reflected Cross-Site Scripting via ppress_cc_data Parameter",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "[*, 3.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24954",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profiler - What Slowing Down Your WP \u003c= 1.0.0 - Missing Authorization",
    "slug": "profiler-what-slowing-down",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48339",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Organization chart \u003c= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameters",
    "slug": "organization-chart",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7355",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Extra Fields \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "wp-extra-fields",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13632",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tabs Maker \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tabs-maker",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11865",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lazy load videos and sticky control \u003c= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lazy-load-videos-and-sticky-control",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11428",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime – Events Calendar, Bookings and Tickets \u003c= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1125",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.0.12 - Authenticated (Contributor+) SQL Injection",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32139",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Delete All Posts \u003c= 1.1.1 - Missing Authorization",
    "slug": "delele-all",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23773",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Translation.Pro \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "translation-pro",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23498",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kento Ads Rotator \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kento-ads-rotator",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51583",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 6.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1287",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSS3 Accordions for WordPress \u003c= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "css3_accordions",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31922",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Related Posts \u003c= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "easy-related-posts",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25123",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCafe \u003c= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery",
    "slug": "wp-cafe",
    "type": "plugin",
    "affected_version": "* - 2.2.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1855",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MemberSpace \u003c= 2.1.13 - Reflected Cross-Site Scripting",
    "slug": "memberspace",
    "type": "plugin",
    "affected_version": "* - 2.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26874",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gift Vouchers \u003c= 4.4.0 - Cross-Site Request Forgery",
    "slug": "gift-voucher",
    "type": "plugin",
    "affected_version": "* - 4.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32436",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Frontend Submit \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-frontend-submit",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25133",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cab Grid \u003c= 1.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cab-grid",
    "type": "plugin",
    "affected_version": "* - 1.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28533",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Missing Authorization on ajax_edit_folder",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0716",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Scraper \u003c= 5.8 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "wp-scraper",
    "type": "plugin",
    "affected_version": "* - 5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37208",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Books \u0026 Papers \u003c= 0.20210223 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "books-papers",
    "type": "plugin",
    "affected_version": "* - 0.20210223",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.20210223",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1156",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c= 13.7 - Unauthenticated Arbitrary Block \u0026 Shortcode Execution",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "* - 13.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10075",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Rescue Shortcodes \u003c= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "rescue-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9696",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI ChatBot for WordPress – WPBot \u003c= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 5.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6669",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \u003c= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1990",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LifterLMS Wordpress Plugin \u003c= 3.37.14 - Arbitrary File Write",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "[*, 3.37.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.37.15",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-6008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-6008",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sliced Invoices \u003c= 3.9.2 - Missing Authorization",
    "slug": "sliced-invoices",
    "type": "plugin",
    "affected_version": "* - 3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30517",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advance Search \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "advance-search",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38348",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Membership Subscriptions – Effortless Memberships, Recurring Payments \u0026 Content Restriction \u003c= 2.11.0 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32728",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Realtyna Organic IDX plugin \u003c= 4.14.13 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "real-estate-listing-realtyna-wpl",
    "type": "plugin",
    "affected_version": "* - 4.14.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-38736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38736",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Magic Buttons for Elementor \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode",
    "slug": "magic-buttons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6686",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobify \u003c= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via keyword Parameter",
    "slug": "jobify",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8318",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Word Count Column \u003c= 2.2 - Unauthenticated Arbitrary File Read",
    "slug": "admin-word-count-column",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1390",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Integration for WooCommerce and QuickBooks \u003c= 1.2.3 - Open Redirect via setup_plugin",
    "slug": "wp-woocommerce-quickbooks",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38478",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \u003c= 6.0.3.3 - Reflected Cross-Site Scripting",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 6.0.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24686",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "News Announcement Scroll \u003c= 9.0.0 -  Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "news-announcement-scroll",
    "type": "plugin",
    "affected_version": "* - 9.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5663",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multi-page Toolkit \u003c= 2.6 - Cross-Site Request Forgery",
    "slug": "multi-page-toolkit",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1818",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Builder: Live Composer \u003c= 1.5.35 - Cross-Site Request Forgery",
    "slug": "live-composer-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31933",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pretty Simple Popup Builder \u003c= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pretty-simple-popup-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56298",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Generator Addon for Elementor Page Builder \u003c= 2.0.0 - Unauthenticated Arbitrary File Download",
    "slug": "pdf-generator-addon-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9935",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Travel Engine \u003c= 6.5.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 6.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49308",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced iFrame \u003c= 2024.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 2024.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32079",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Backpack \u003c= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-backpack",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4756",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiMailer \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "scand-multi-mailer",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32517",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin \u003c= 3.1.2 - Remote Code Execution",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "[*, 3.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-4338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4338",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AnyTrack Affiliate Link Manager \u003c= 1.0.4 - Missing Authorization",
    "slug": "anytrack-affiliate-link-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31041",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Sort and Display for WooCommerce \u003c= 2.4.1 - Missing Authorization",
    "slug": "woocommerce-product-sort-and-display",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1807",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE \u003c= 2.6.11 - Authenticated (Subscriber+) Information Exposure",
    "slug": "otter-pro",
    "type": "plugin",
    "affected_version": "* - 2.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35682",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce Easy Duplicate Product \u003c= 0.3.0.0 - Reflected Cross-Site Scripting via wedp_duplicated",
    "slug": "woo-easy-duplicate-product",
    "type": "plugin",
    "affected_version": "* - 0.3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30747",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Video Posts \u003c= 3.5.1 - Reflected Cross-Site Scripting",
    "slug": "wp-video-posts",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27308",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UserPro - Community and User Profile WordPress Plugin \u003c= 5.1.10 - Unauthenticated Arbitrary File Read",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4187",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Localize My Post \u003c= 1.0 - Directory Traversal",
    "slug": "localize-my-post",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-16299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16299",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP jQuery Pager \u003c= 1.4.0 - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "wp-jquery-pdf-paged",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10575",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "DX-auto-publish \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "dx-auto-publish",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26577",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simplified Plugin \u003c= 1.0.6 - Unauthenticated Arbitrary File Upload",
    "slug": "simplified",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-22654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22654",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Tabs \u003c= 2.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "my-wp-tabs",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11503",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Forms \u003c= 2.2.8.3 - Authenticated(Subscriber+) Sensitive Information Disclosure",
    "slug": "forms-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45803",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CM FAQ  – Simplify support with an intuitive FAQ management tool \u003c= 1.2.5 - Reflected Cross-Site Scripting",
    "slug": "cm-faq",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2166",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c= 3.2.6 - Authenticated (Administrator+) SQL Injection via *_selected",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47428",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hubbub Lite \u003c= 1.31.0 - Unauthenticated Information Exposure",
    "slug": "social-pug",
    "type": "plugin",
    "affected_version": "* - 1.33.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1526",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce CVR Payment Gateway \u003c 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update",
    "slug": "woocommerce-cvr-payment-gateway",
    "type": "plugin",
    "affected_version": "[*, 6.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4948",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MemeOne \u003c= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "memeone",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Poll, Survey \u0026 Quiz Maker Plugin by Opinion Stage \u003c= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update",
    "slug": "social-polls-by-opinionstage",
    "type": "plugin",
    "affected_version": "* - 19.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3880",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ebook Store \u003c= 5.8001 - Unauthenticated Full Path Disclosure",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.8001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8001",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6567",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SeedProd Pro \u003c= 6.18.12 - Authenticated (Administrator+) SQL Injection",
    "slug": "seedprod-coming-soon-pro-5",
    "type": "plugin",
    "affected_version": "* - 6.18.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.18.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54284",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Uptime Robot Plugin for WordPress \u003c= 2.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "uptime-robot-monitor",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31547",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.15.0 - Authenticated (Contributor+) Stored Cross-site Scripting",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7590",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Playlist for Youtube \u003c= 1.32 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "playlist-for-youtube",
    "type": "plugin",
    "affected_version": "* - 1.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3937",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon Page \u003c= 1.5.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-46849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46849",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AWSM Team \u003c= 1.3.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "awsm-team",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37454",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Admin and Customer Messages After Order for WooCommerce \u003c= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting",
    "slug": "admin-and-client-message-after-order-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13355",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 4.5.3 - Denial of Service",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-6896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-6896",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "JetReviews \u003c= 2.3.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "jet-reviews",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39396",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WpEvently \u003c= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5568",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks for Gutenberg \u003c= 4.2.0 - Incorrect Authorization Checks",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51359",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Integrations of Zoho CRM with Elementor form \u003c= 1.0.7 - Open Redirect",
    "slug": "integrations-of-zoho-crm-with-elementor-form",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47644",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4360",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Timeline \u003c= 2.3.9 - Reflected Cross-Site Scripting",
    "slug": "post-timeline",
    "type": "plugin",
    "affected_version": "* - 2.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24614",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chartify – WordPress Chart Plugin \u003c= 2.9.5 - Unauthenticated Local File Inclusion via source",
    "slug": "chart-builder",
    "type": "plugin",
    "affected_version": "* - 2.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10571",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Asgaros Forum \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "asgaros-forum",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39514",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailPoet Newsletters (Previous) \u003c= 2.6.10 - Cross-Site Request Forgery",
    "slug": "wysija-newsletters",
    "type": "plugin",
    "affected_version": "[*, 2.6.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-3907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3907",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "LearnPress \u003c= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10010",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 5.9.7.3 - Admin+ SQL Injection",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 5.9.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35012",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Prayer \u003c= 1.9.6 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "wp-prayer",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25705",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "rng-refresh \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "rng-refresh",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23488",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Replace Image \u003c= 3.5.0 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "easy-replace-image",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47483",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dropshipping \u0026 Affiliation with Amazon \u003c= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-amazon-shop",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-31215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31215",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Authorize.net Payment Gateway For WooCommerce \u003c= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass",
    "slug": "authorizenet-payment-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2382",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4796",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JS Help Desk – Best Help Desk \u0026 Support Plugin \u003c= 2.0.5 - Cross-Site Request Forgery",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-21002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-21002",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Recurring PayPal Donations \u003c= 1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "recurring-donation",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57891",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bimber - Viral Magazine WordPress Theme \u003c= 9.2.5 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "bimber",
    "type": "theme",
    "affected_version": "* - 9.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47576",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Minimum and Maximum Quantity for WooCommerce \u003c= 2.0.0 - Missing Authorization",
    "slug": "min-and-max-quantity-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54227",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Companion Sitemap Generator \u003c= 4.5.1.1 - Reflected Cross-Site Scripting",
    "slug": "companion-sitemap-generator",
    "type": "plugin",
    "affected_version": "* - 4.5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Startklar Elementor Addons \u003c= 1.7.13 - Unauthenticated Arbitrary File Deletion",
    "slug": "startklar-elmentor-forms-extwidgets",
    "type": "plugin",
    "affected_version": "* - 1.7.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4346",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.6.7 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22723",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Share Buttons for WordPress \u003c= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "share-buttons",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12807",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial Rotator \u003c= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "testimonial-rotator",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24156",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextGen Gallery \u003c= 2.1.9 - Cross-Site Scripting",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9537",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restore Permanently delete Post or Page Data \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "restore-permanently-delete-post-or-page-data",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7839",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Simple HTML Sitemap \u003c= 2.8 - Reflected Cross-Site Scripting",
    "slug": "wp-simple-html-sitemap",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32574",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Directory Kit \u003c= 1.4.0 - Missing Authorization",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60120",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SEO Slider \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "seo-slider",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5707",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Social Invitations – Lite \u003c= 1.4.4.2 - Reflected Cross-Site Scripting",
    "slug": "wp-social-invitations",
    "type": "plugin",
    "affected_version": "* - 1.4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4597",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modern \u003c= 1.4.1 - Cross-Site Scripting",
    "slug": "modern",
    "type": "theme",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9503",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YML for Yandex Market \u003c= 4.2.3 - Reflected Cross-Site Scripting",
    "slug": "yml-for-yandex-market",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1365",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.12.7 - Cross-Site Request Forgery",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4689",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "BuddyPress \u003c= 5.1.1 - Sensitive Information Disclosure",
    "slug": "buddypress",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-5244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5244",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "File Manager Pro \u003c= 8.3.9 - Unauthenticated Backup File Download and Upload",
    "slug": "wp-file-manager-pro",
    "type": "plugin",
    "affected_version": "* - 8.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8746",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Amazing service box Addons For WPBakery Page Builder \u003c= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "amazing-service-box-visual-composer-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2573",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.4.22 - Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.4.23)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.23",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-8594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8594",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Coming Soon \u003c= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "easy-coming-soon",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25483",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WishList Member X \u003c= 3.25.1 - Missing Authorization to Information Disclosure",
    "slug": "wishlist-member-x",
    "type": "plugin",
    "affected_version": "* - 3.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37110",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WHOIS  \u003c= 1.4.2.2 - Reflected Cross Site Scripting",
    "slug": "wordpress-whois-search",
    "type": "plugin",
    "affected_version": "* - 1.4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-5194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5194",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extensions For CF7 \u003c= 2.0.8 - Cross-Site Request Forgery",
    "slug": "extensions-for-cf7",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23899",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quran multilanguage Text \u0026 Audio \u003c= 2.3.23 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "quran-text-multilanguage",
    "type": "plugin",
    "affected_version": "* - 2.3.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47524",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Get Youtube Subs \u003c= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att Function",
    "slug": "get-youtube-subs",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7966",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Posts and Products Views for WooCommerce \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "posts-and-products-views",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12448",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Top 25 Social Icons \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "top-25-social-icons",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47229",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spam protection, AntiSpam, FireWall by CleanTalk \u003c= 5.127.3 - Reflected Cross-Site Scripting",
    "slug": "cleantalk-spam-protect",
    "type": "plugin",
    "affected_version": "* - 5.127.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.127.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17515",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Narnoo Commerce Manager \u003c= 1.6.0 - Reflected Cross-Site Scripting",
    "slug": "narnoo-commerce-manager",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51708",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quizzin \u003c= 1.01.4 - Reflected Cross-Site Scripting",
    "slug": "quizzin",
    "type": "plugin",
    "affected_version": "* - 1.01.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23494",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WIP Custom Login \u003c= 1.2.7 - Missing Authorization",
    "slug": "wip-custom-login",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-42884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42884",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Já-Já Pagamentos for WooCommerce \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "wc-ja-ja-pagamentos-multicaixa-express",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51624",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Property Listings \u003c= 3.3.3 - Cross-Site Scripting",
    "slug": "easy-property-listings",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15817",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget Logic \u003c= 6.0.5 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "widget-logic",
    "type": "plugin",
    "affected_version": "* - 6.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32222",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fancy Product Designer \u003c= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "fancy-product-designer",
    "type": "plugin",
    "affected_version": "* - 4.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4096",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ShortcodeHub \u003c= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via author_link_target Parameter",
    "slug": "shortcodehub",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7957",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada \u003c= 7.11.10 - Cross-Site Request Forgery",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54357",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cart tracking for WooCommerce \u003c= 1.0.16 - Authenticated (Administrator+) SQL Injection",
    "slug": "cart-tracking-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30791",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "IP Based Login \u003c= 2.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ip-based-login",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58960",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Manager Advanced Shortcode \u003c= Multiple Versions - Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode",
    "slug": "file-manager-advanced-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13914",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "File Manager Advanced Shortcode \u003c= Multiple Versions - Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode",
    "slug": "advanced-file-manager-pro-premium",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13914",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BetterDocs – Best Documentation, FAQ \u0026 Knowledge Base Plugin with AI Support \u0026 Instant Answer for Elementor \u0026 Gutenberg \u003c= 3.3.3 - Unauthenticated PHP Object Injection",
    "slug": "betterdocs",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30226",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rankie - Wordpress Rank Tracker Plugin \u003c 1.8.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "valvepress-rankie",
    "type": "plugin",
    "affected_version": "[*, 1.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-39486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39486",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Amazon Affiliates - Wordpress Plugin \u003c= 14.0.10 - Missing Authorization",
    "slug": "woozone",
    "type": "plugin",
    "affected_version": "* - 14.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33545",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ClickBank Affiliate Ads \u003c= 1.20 - Cross-Site Scripting",
    "slug": "clickbank-ads-clickbank-widget",
    "type": "plugin",
    "affected_version": "* - 1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-20106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-20106",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Connections Business Directory \u003c 0.7.1.6 - Authorization Bypass",
    "slug": "connections",
    "type": "plugin",
    "affected_version": "* - 0.7.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-5254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5254",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 2.9.13 - Cross-Site Request Forgery",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 2.9.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40692",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hotscot Contact Form \u003c 1.3 - SQL Injection",
    "slug": "hotscot-contact-form",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24777",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "External Database Based Actions \u003c= 0.1 - Authenticated (Subscriber+) Authentication Bypass",
    "slug": "external-database-based-actions",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10311",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Cross-Site Request Forgery on ajax_move_object",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0723",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder Pro \u003c= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.21.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4107",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StyleAI \u003c= 1.0.4 - Missing Authorization",
    "slug": "relentlosoftware",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48139",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Branda \u003c= 3.4.17 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "branda-white-labeling",
    "type": "plugin",
    "affected_version": "* - 3.4.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37239",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor \u0026 Gutenberg Blocks! – TemplateSpare \u003c= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Theme Update",
    "slug": "templatespare",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6872",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Firelight Lightbox \u003c= 2.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-fancybox",
    "type": "plugin",
    "affected_version": "* - 2.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5035",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Optimizer, Resizer and CDN – Sirv \u003c= 7.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "* - 7.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8964",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kodex Posts likes \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kodex-posts-likes",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50464",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPML \u003c= 4.5.10 - Missing Authorization to Translation Job Status Change",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "* - 4.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38974",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Link Whisper Free \u003c= 0.7.8 - Unauthenticated Sensitive Information Exposure",
    "slug": "link-whisper",
    "type": "plugin",
    "affected_version": "* - 0.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22306",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Car Repair Services \u003c= 5.0 - Unauthenticated Server-Side Request Forgery",
    "slug": "car-repair-services",
    "type": "theme",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30997",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TeploBot - Telegram Bot for WP \u003c= 1.3 - Telegram Bot Token Disclosure",
    "slug": "green-wp-telegram-bot-by-teplitsa",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9627",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
  },
  {
    "title": "Sell Media \u003c= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sell-media",
    "type": "plugin",
    "affected_version": "* - 2.5.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Minify HTML \u003c= 2.1.7 - Cross-Site Request Forgery in minify_html_menu_options",
    "slug": "minify-html-markup",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26014",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Configurable Tag Cloud \u003c= 5.2 - Cross-Site Request Forgery via ctc_options_page()",
    "slug": "configurable-tag-cloud-widget",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28995",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Menu Widget \u003c= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "advanced-menu-widget",
    "type": "plugin",
    "affected_version": "* - 0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5085",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Beaver Builder – Lite \u003c= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget",
    "slug": "ultimate-addons-for-beaver-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2140",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP All Import Pro \u003c= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion",
    "slug": "wp-all-import-pro",
    "type": "plugin",
    "affected_version": "* - 4.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9661",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Quick FrontEnd Editor \u003c= 5.5 - Authenticated Settings Change",
    "slug": "wp-quick-front-end-editor",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4371",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Acerola \u003c= 1.6.5 - Unauthenticated PHP Object Injection",
    "slug": "acerola",
    "type": "theme",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31927",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Acerola \u003c= 1.6.5 - Unauthenticated PHP Object Injection",
    "slug": "rozario",
    "type": "theme",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31927",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Price Table \u003c= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pricetable",
    "type": "plugin",
    "affected_version": "* - 0.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25604",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nova Blocks by Pixelgrade \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute",
    "slug": "nova-blocks",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8241",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Tooltips \u003c= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-tooltips",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4826",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Envíos Coordinadora Woocommerce \u003c= 1.1.31 - Unauthenticated Sensitive Information Exposure",
    "slug": "coordinadora",
    "type": "plugin",
    "affected_version": "* - 1.1.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57922",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Lenix Elementor Leads addon \u003c= 1.8.2 - Unauthenticated Stored Cross-Site Scripting via URL Form Field",
    "slug": "lenix-elementor-leads-addon",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1039",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress \u003c= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "buddypress",
    "type": "plugin",
    "affected_version": "* - 12.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3974",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Reroute Email \u003c= 1.4.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-reroute-email",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-27605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27605",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Client Logo Carousel \u003c= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-client-logo-carousel",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0073",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Webba Booking \u003c= 5.1.20 - Cross-Site Request Forgery",
    "slug": "webba-booking-lite",
    "type": "plugin",
    "affected_version": "* - 5.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54036",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fiverr.com Official Search Box \u003c= 1.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "fiverr-official-search-box",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28885",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TS Webfonts for さくらのレンタルサーバ \u003c= 3.1.1 - Cross-Site Request Forgery",
    "slug": "ts-webfonts-for-sakura",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34169",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sky Addons for Elementor \u003c= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sky-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46260",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eID Easy \u003c= 4.6 - Reflected Cross-Site Scripting",
    "slug": "smart-id",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34650",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block \u0026 Elementor \u003c= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11203",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Obfuscate Email \u003c= 3.8.1 - Unauthenticated Full Path Disclosure",
    "slug": "obfuscate-email",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7413",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Testimonial Carousel For Elementor \u003c= 10.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "testimonials-carousel-elementor",
    "type": "plugin",
    "affected_version": "* - 10.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4698",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.8",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.3",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.23",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.23",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.17",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.12",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.21",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.20",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.20",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.13",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.11",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "I Recommend This \u003c 3.7.3 - SQL Injection",
    "slug": "i-recommend-this",
    "type": "plugin",
    "affected_version": "[*, 3.7.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-10376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10376",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Plus Addons for Elementor Page Builder Lite \u003c= 6.3.13 - Missing Authorization",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 6.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-55712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-55712",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 2.81 - Local File Inclusion",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 2.81",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.81",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-11732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11732",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MStore API \u003c= 3.9.6 - Cross-Site Request Forgery to Order Status Update",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3198",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Site Protector \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "wp-site-protector",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44237",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SEUR Oficial \u003c= 2.2.23 - Unauthenticated Local File Inclusion",
    "slug": "seur",
    "type": "plugin",
    "affected_version": "* - 2.2.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.23",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-46474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46474",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Avada \u003c= 7.11.1 - Authenticated(Contributor+) Arbitrary File Upload via 'ajax_import_options'",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-39307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39307",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kwayy HTML Sitemap \u003c= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scipting",
    "slug": "kwayy-html-sitemap",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3835",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c=  2.9.1 - SQL Injection",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-10017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10017",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Survey Maker \u003c 3.1.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23490",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Click to Chat – WP Support All-in-One Floating Widget \u003c= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "support-chat",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Poll Maker Plugin \u003c= 5.4.6 - Authenticated (Administrator+) Time-Based SQL Injection",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9874",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Create by Mediavine \u003c= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Schema Meta Shortcode",
    "slug": "mediavine-create",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5601",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conversios.io - All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce \u003c= 7.1.0 - Reflected Cross-Site Scripting",
    "slug": "enhanced-e-commerce-for-woocommerce-store",
    "type": "plugin",
    "affected_version": "* - 7.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6288",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "kvCORE IDX \u003c= 2.3.35 - Reflected Cross-Site Scripting",
    "slug": "kvcore-idx",
    "type": "plugin",
    "affected_version": "* - 2.3.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11723",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Contact Form, Drag and Drop Form Builder Plugin – Live Forms \u003c 3.2.0 - SQL Injection",
    "slug": "liveforms",
    "type": "plugin",
    "affected_version": "[*, 3.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9301",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.2.1 - Authenticated (Contributor+) Information Exposure",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8516",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "NextScripts: Social Networks Auto-Poster \u003c= 4.4.3 - Cross-Site Request Forgery to Arbitrary Post Deletion",
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "type": "plugin",
    "affected_version": "* - 4.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1446",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Smaily for WP \u003c= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smaily-for-wp",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54286",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GD Security Headers \u003c= 1.6.1 - Reflected Cross-Site Scripting",
    "slug": "gd-security-headers",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40330",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ContentStudio \u003c= 1.2.5 - Authorization Bypass",
    "slug": "contentstudio",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0558",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "Accordions \u003c= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Several Parameters",
    "slug": "accordions-or-faqs",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25962",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-tagMaker \u003c= 0.2.2 - Reflected Cross-Site Scripting",
    "slug": "tagmaker",
    "type": "plugin",
    "affected_version": "* - 0.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22338",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Giveaways \u003c= 2.46 - Cross-Site Request Forgery",
    "slug": "giveasap",
    "type": "plugin",
    "affected_version": "* - 2.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31086",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Memberlite Shortcodes \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "memberlite-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10125",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Bank – Contact Form Builder for WordPress \u003c= 2.0.69 - Stored Cross-Site Scripting",
    "slug": "contact-bank",
    "type": "plugin",
    "affected_version": "* - 2.0.69",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.69",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-8807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8807",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Vendors \u003c= 2.1.78 - Authenticated (Shop manager+) SQL Injection",
    "slug": "woocommerce-product-vendors",
    "type": "plugin",
    "affected_version": "* - 2.1.78",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.78",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35879",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Live Stream Badger \u003c= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "live-stream-badger",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7655",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by Ays \u003c= 5.5.2 - Reflected Cross-Site Scripting",
    "slug": "gallery-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 5.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29919",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simply Schedule Appointments \u003c= 1.6.6.20 - Reflected Cross-Site Scripting",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.6.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22311",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Addons \u0026 Fields for WooCommerce \u003c= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file",
    "slug": "woocommerce-product-addon",
    "type": "plugin",
    "affected_version": "* - 32.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "32.0.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3962",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeMakers PayPal Express Checkout \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "tmm_paypal_checkout",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1689",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PWA for WP – Progressive Web Apps Made Simple \u003c= 1.7.71 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pwa-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.7.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7759",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Notes \u003c= 2.0.0 - Cross-Site Request Forgery to Admin Note Deletion",
    "slug": "site-notes",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6633",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Poll \u003c= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "simple-poll",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49044",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP BASE Booking of Appointments, Services and Events \u003c= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db",
    "slug": "wp-base-booking-of-appointments-services-and-events",
    "type": "plugin",
    "affected_version": "* - 4.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12558",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Restrict for Elementor \u003c= 1.0.7 - Protection Mechanism Bypass",
    "slug": "restrict-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0910",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "My Calendar \u003c= 3.3.16 - Open Redirect",
    "slug": "my-calendar",
    "type": "plugin",
    "affected_version": "* - 3.3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36371",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "No Future Posts \u003c= 1.4 - Stored Cross-Site Scripting",
    "slug": "no-future-posts",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1387",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Referrer Detector \u003c= 4.2.1.0 - Unauthenticated PHP Object Injection",
    "slug": "referrer-detector",
    "type": "plugin",
    "affected_version": "* - 4.2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52410",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 2.1.3 - Sensitive Information Disclosure",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1442",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Form Maker \u003c= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8633",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iTwitter \u003c= 0.04 - Cross-Site Scripting",
    "slug": "itwitter",
    "type": "plugin",
    "affected_version": "* - 0.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9336",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AllWebMenus WordPress Menu Plugin \u003c= 1.1.8 - Arbitrary File Upload",
    "slug": "allwebmenus-wordpress-menu-plugin",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-1011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-1011",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "myStickymenu \u003c= 2.5.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "mystickymenu",
    "type": "plugin",
    "affected_version": "[*, 2.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24425",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "scrollup \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "scrollup",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51921",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FG Drupal to WordPress \u003c= 3.90.0 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "fg-drupal-to-wp",
    "type": "plugin",
    "affected_version": "* - 3.90.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.90.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48294",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clean Login \u003c= 1.5 - Reflected Cross-Site Scripting",
    "slug": "clean-login",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9336",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-5833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.14",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.14",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.12",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.11",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.3",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.11",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.8",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.4",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Cross-Site Scripting via Attachment Name #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.2",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reusable Text Blocks \u003c= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode",
    "slug": "reusable-text-blocks",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5745",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime \u003c= 3.3.9 - Improper Input Validation via save_event_booking",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24832",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "C9 Admin Dashboard \u003c= 1.3.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "c9-admin-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13379",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fusion Builder \u003c= 3.6.1 \u0026 Avada \u003c= 7.6.1  - Unauthenticated Server-Side Request Forgery",
    "slug": "fusion-builder",
    "type": "plugin",
    "affected_version": "[*, 3.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1386",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Fusion Builder \u003c= 3.6.1 \u0026 Avada \u003c= 7.6.1  - Unauthenticated Server-Side Request Forgery",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "[*, 7.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1386",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WP Content Copy Protection \u0026 No Right Click (PRO) \u003c= 15.0 - Open Redirect",
    "slug": "wccp-pro",
    "type": "plugin",
    "affected_version": "* - 15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6690",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fathom Analytics \u003c= 3.0.4 - Stored Cross-Site Scripting",
    "slug": "fathom-analytics",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-41836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-41836",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-PManager \u003c= 1.2 - Cross-Site Request Forgery to Category Deletion",
    "slug": "wp-programmmanager",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2247",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Logo Manager For Enamad \u003c= 0.7.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "logo-manager-for-enamad",
    "type": "plugin",
    "affected_version": "* - 0.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5170",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File Upload \u003c= 1.6.60 - Cross-Site Scripting",
    "slug": "shared-files",
    "type": "plugin",
    "affected_version": "[*, 1.6.61)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.61",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24856",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BoldGrid Easy SEO – Simple and Effective SEO \u003c= 1.6.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Description",
    "slug": "boldgrid-easy-seo",
    "type": "plugin",
    "affected_version": "* - 1.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1692",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DoFollow Case by Case \u003c= 3.4.2 Cross-Site Request Forgery via getEmail and getUrl",
    "slug": "dofollow-case-by-case",
    "type": "plugin",
    "affected_version": "[*, 3.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-49197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49197",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iframe Wrapper \u003c= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "iframe-wrapper",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49422",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GD Rating System \u003c= 3.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-38709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38709",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BxSlider WP \u003c= 2.0.0 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "bxslider-wp",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-33943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33943",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KBucket \u003c= 4.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "kbucket",
    "type": "plugin",
    "affected_version": "* - 4.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24562",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schema App Structured Data \u003c= 2.2.4 - Reflected Cross-Site Scripting",
    "slug": "schema-app-structured-data-for-schemaorg",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11279",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 3.2.9 - Missing Authorization",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44038",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CF7 Spreadsheets \u003c= 2.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "cf7-spreadsheets",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50040",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ravpage \u003c= 2.31 - PHP Object Injection",
    "slug": "ravpage",
    "type": "plugin",
    "affected_version": "* - 2.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.31",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13789",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 2.1.10 - Missing Authorization",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32260",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Work The Flow File Upload \u003c= 2.5.2 - Arbitrary File Upload",
    "slug": "work-the-flow-file-upload",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-10138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10138",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product page shipping calculator for WooCommerce \u003c= 1.3.20 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "product-page-shipping-calculator-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29094",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simply Schedule Appointments \u003c= 1.5.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.5.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2374",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Educenter \u003c= 1.5.7 - Missing Authorization via activate_plugin",
    "slug": "educenter",
    "type": "theme",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30480",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "What Would Seth Godin Do \u003c= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "what-would-seth-godin-do",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51900",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Organization chart \u003c= 1.4.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "organization-chart",
    "type": "plugin",
    "affected_version": "[*, 1.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-24387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24387",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WxSync \u003c= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wxsync",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39988",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c 5.5 - Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "[*, 5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-7478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7478",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Table Builder – WordPress Table Plugin \u003c= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-table-builder",
    "type": "plugin",
    "affected_version": "* - 1.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4700",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Admin Menu \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-admin-menu",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51618",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SOPA Blackout \u003c= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "sopa-blackout",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54410",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Check \u0026 Log Email \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "check-email",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24908",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Database Cleaner \u003c= 1.0.5 - Authenticated (Admin+) Arbitrary File Read",
    "slug": "database-cleaner",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35712",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BERTHA AI \u003c= 1.12.11 - Missing Authorization",
    "slug": "bertha-ai-free",
    "type": "plugin",
    "affected_version": "* - 1.12.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48138",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor \u003c= 1.3.7 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wte-elementor-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12272",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Integration for Contact Form 7 and Salesforce \u003c= \u003c=1.3.9 - Cross-Site Request Forgery",
    "slug": "cf7-salesforce",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34755",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iFrame \u003c= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via srcdoc",
    "slug": "iframe",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52125",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Workreap \u003c 2.6.3 - Insecure Direct Objection Reference to Private Message Disclosure",
    "slug": "workreap",
    "type": "theme",
    "affected_version": "[*, 2.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-3846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3846",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.2.14 - Parameter Tampering",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.2.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.15",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-20980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20980",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "SEO Plugin by Squirrly SEO \u003c= 12.1.10 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "squirrly-seo",
    "type": "plugin",
    "affected_version": "* - 12.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.1.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38140",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Additional Order Filters for WooCommerce \u003c= 1.21 - Reflected Cross-Site Scripting",
    "slug": "additional-order-filters-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11418",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slimstat Analytics \u003c= 3.5.5 - Stored Cross-Site Scripting",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "[*, 3.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-100027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-100027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Search \u003c= 3.3.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "better-search",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-29142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29142",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Announcement \u0026 Notification Banner – Bulletin \u003c= 3.7.0 - Cross-Site Request Forgery",
    "slug": "bulletin-announcements",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2067",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Photo Gallery Slideshow \u0026 Masonry Tiled Gallery \u003c= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgery",
    "slug": "wp-responsive-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12237",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Elementor \u003c= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.19.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-24934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24934",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mobile Detector \u003c= 3.5 - Arbitrary File Upload",
    "slug": "wp-mobile-detector",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-15043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-15043",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multivendor Marketplace Solution for WooCommerce – WC Marketplace \u003c= 3.8.11.8 - Cross-Site Request Forgery",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 3.8.11.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.11.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2657",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Enquiry for WooCommerce \u003c= 3.1 - Unauthenticated Stored Cross-Site Scripting via name",
    "slug": "gm-woocommerce-quote-popup",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp EMember \u003c= 10.6.5 - Cross-Site Request Forgery",
    "slug": "wp-eMember",
    "type": "plugin",
    "affected_version": "* - 10.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5077",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Easy Gallery – WordPress Gallery Plugin \u003c= 4.8.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-easy-gallery",
    "type": "plugin",
    "affected_version": "* - 4.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8436",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Maximum Products per User for WooCommerce \u003c= 4.2.8 - Reflected Cross-Site Scripting",
    "slug": "maximum-products-per-user-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9205",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "hmd \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "hmd",
    "type": "theme",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54350",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobSearch \u003c= 2.5.9 - Reflected Cross-Site Scripting",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47394",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iPanorama 360 WordPress Virtual Tour Builder \u003c= 1.8.3 - Missing Authorization",
    "slug": "ipanorama-360-virtual-tour-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38690",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24729",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tabbed Login Widget \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tabbed-login",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28929",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kimili Flash Embed \u003c= 2.5.3 - Cross-Site Request Forgery",
    "slug": "kimili-flash-embed",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32092",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quick Event Calendar \u003c= 1.4.9 - Cross-Site Request Forgery",
    "slug": "quick-event-calendar",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58861",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Featured Image from URL (FIFU) \u003c= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text",
    "slug": "featured-image-from-url",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6561",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Resize at Upload Plus \u003c= 1.3 - Cross-Site Request Forgery",
    "slug": "resize-at-upload-plus",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25467",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Load More \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "easy-load-more",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8728",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Preview E-Mails for WooCommerce \u003c= 1.6.8 - Reflected Cross-Site Scripting",
    "slug": "woo-preview-emails",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-42363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42363",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Socializer – Simple \u0026 Easy Social Media Share Icons \u003c= 7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-socializer",
    "type": "plugin",
    "affected_version": "* - 7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2763",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Penci Filter Everything \u003c 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "penci-filter-everything",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-59583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59583",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Comments Fields \u003c= 4.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-comment-fields",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2398",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Branding \u003c= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "branding",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9452",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Felan Framework \u003c= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions",
    "slug": "felan-framework",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10849",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP JobHunt \u003c= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover",
    "slug": "wp-jobhunt",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11285",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Saoshyant Slider \u003c= 3.0 - Unauthenticated PHP Object Injection",
    "slug": "saoshyant-slider",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-27286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27286",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Matomo Integration (WP-Piwik) \u003c 1.0.5 - Cross-Site Scripting",
    "slug": "wp-piwik",
    "type": "plugin",
    "affected_version": "[*, 1.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9405",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.263",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.263",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2839",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SupportCandy \u003c= 2.2.6 - Cross-Site Request Forgery to Arbitrary Ticket Deletion",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "[*, 2.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24843",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Social Share Buttons by Supsystic \u003c= 2.2.3 - Cross-Site Request Forgery to Settings Update",
    "slug": "social-share-buttons-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1653",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Contact Us Form Builder for WordPress \u003c= 4.0.5 - Reflected Cross-Site Scripting",
    "slug": "contact-form-plugin",
    "type": "plugin",
    "affected_version": "[*, 4.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18491",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPJobBoard \u003c 5.11.1 - Authenticated (Subscriber+) Path Traversal",
    "slug": "wpjobboard",
    "type": "plugin",
    "affected_version": "[*, 5.11.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-30966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30966",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Amely \u003c= 3.1.4 - Unauthenticated SQL Injection",
    "slug": "amely",
    "type": "theme",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39474",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.9.1.1 - Reflected Cross-Site Scripting",
    "slug": "happy-elementor-addons-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6632",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.9.1.1 - Reflected Cross-Site Scripting",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.9.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6632",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCafe \u003c= 2.2.27 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-cafe",
    "type": "plugin",
    "affected_version": "* - 2.2.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37513",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Image Hover Effects \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-image-hover-effects",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22585",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Taxonomy filter \u003c= 2.2.9 - Cross-Site Request Forgery via taxonomy_filter_save_main_settings()",
    "slug": "taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48282",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sendit WP Newsletter \u003c= 2.5.1 - Authenticated (Admin+) SQL Injection",
    "slug": "sendit",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24345",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Forms by CaptainForm \u003c= 2.5.3 - Cross-Site Request Forgery",
    "slug": "captainform",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43459",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Temporarily Hidden Content \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "temporarily-hidden-content",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7658",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DoLogin Security \u003c= 3.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "dologin",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4549",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Manager for WooCommerce \u003c= 3.7.7 - Cross-Site Request Forgery leading to Uninstall Form Submission",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 3.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47164",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Activity Reactions For Buddypress \u003c= 1.0.22 - Reflected Cross-Site Scripting",
    "slug": "activity-reactions-for-buddypress",
    "type": "plugin",
    "affected_version": "* - 1.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31006",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Market 360 Viewer \u003c= 1.01 - Authenticated (Contributor+) SQL Injection",
    "slug": "market-360-viewer",
    "type": "plugin",
    "affected_version": "* - 1.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51619",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Google CSE \u003c= 1.0.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "google-cse",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4755",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeoDirectory \u003c= 2.3.84 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.3.84",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.84",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56259",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hack me if you can \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "hack-me-if-you-can",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23713",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accept Donations with PayPal \u0026 Stripe \u003c= 1.4.4 - Reflected Cross-Site Scripting",
    "slug": "easy-paypal-donation",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13728",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 6.3.4 - Reflected Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 6.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visitor Traffic Real Time Statistics \u003c= 1.13 - Cross-Site Request Forgery",
    "slug": "visitors-traffic-real-time-statistics",
    "type": "plugin",
    "affected_version": "* - 1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15832",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Neon Product Designer \u003c= 2.1.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "neon-product-designer-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22799",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BuddyPress Greeting Message \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "bp-greeting-message",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49650",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Constant Contact for WordPress \u003c= 4.1.1 - Unauthenticated PHP Object Injection",
    "slug": "constant-contact-api",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48101",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LifterLMS – WP LMS for eLearning, Online Courses, \u0026 Quizzes \u003c= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "* - 7.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12596",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.6.18 - Cross-Site Scripting via contentarea Parameter",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "[*, 4.6.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-14787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14787",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infility Global \u003c= 2.13.4 - Reflected Cross-Site Scripting",
    "slug": "infility-global",
    "type": "plugin",
    "affected_version": "* - 2.13.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52774",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 0.72 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 0.72)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.72",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2003-1598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2003-1598",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Rating and Review \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter",
    "slug": "post-rating-and-review",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6538",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freshdesk (official) \u003c= 2.3.6 - Open Redirect",
    "slug": "freshdesk-support",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32129",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Assistant \u003c= 1.5.1 - Authenticated (Editor+) PHP Object Injection",
    "slug": "assistant",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26885",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BadgeOS \u003c= 3.7.1.6 - Cross-Site Request Forgery",
    "slug": "badgeos",
    "type": "plugin",
    "affected_version": "* - 3.7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41987",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unify \u003c= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode",
    "slug": "unify",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9130",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eShop \u003c= 6.3.14 - Multiple SQL Injections",
    "slug": "eshop",
    "type": "plugin",
    "affected_version": "* - 6.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-0769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-0769",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Missing Authorization via ajax_save_state",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0711",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile \u0026 User signup \u003c= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10681",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Landing Pages \u003c= 1.9.0 - Unauthenticated Remote Command Execution",
    "slug": "landing-pages",
    "type": "plugin",
    "affected_version": "[*, 1.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-5227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5227",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FormCraft \u003c= 1.2.7 - Missing Authorization via formcraft_nag_update",
    "slug": "formcraft-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47823",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Event Manager \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-event-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53721",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iubenda \u003c= 3.3.2 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "iubenda-cookie-law-solution",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3911",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Book a Room \u003c= 2.9 - Cross-Site Request Forgery to Settings Update",
    "slug": "book-a-room",
    "type": "plugin",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13437",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Infinite Scroll – Ajax Load More \u003c= 2.8.1.1 - Arbitrary File Upload",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 2.8.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-10140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10140",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Marketplace Items \u003c= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marketplace' Shortcode",
    "slug": "marketplace-items",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12439",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Insert PHP Code Snippet \u003c= 1.3.6 - Cross-Site Request Forgery to Code Snippet Activate/Deactivate/Deletion",
    "slug": "insert-php-code-snippet",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7420",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Stripe Gateway \u003c= 7.6.0 - Cross-Site Request Forgery",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "[*, 7.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44999",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WOOEXIM \u003c= 5.0.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "wooexim",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22533",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Master Slider Pro \u003c= 3.6.5 - Authenticated (Editor+) SQL Injection",
    "slug": "masterslider",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47506",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Twitter Feeds – A Tweets Widget or X Feed Widget \u003c= 2.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "custom-twitter-feeds",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8983",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "prettyPhoto \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "prettyphoto",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58808",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Piraeus Bank WooCommerce Payment Gateway \u003c= 1.6.5.1 - Unauthenticated SQL Injection",
    "slug": "woo-payment-gateway-for-piraeus-bank",
    "type": "plugin",
    "affected_version": "* - 1.6.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-0610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0610",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Crony Cronjob Manager \u003c= 0.5.0 - Cross-Site Request Forgery",
    "slug": "crony",
    "type": "plugin",
    "affected_version": "* - 0.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32102",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Message Filter for Contact Form 7 \u003c= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions",
    "slug": "cf7-message-filter",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12027",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Broken Link Checker \u003c= 1.11.16 - Authenticated (Admin+) PHAR Deserialization",
    "slug": "broken-link-checker",
    "type": "plugin",
    "affected_version": "* - 1.11.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2438",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-2771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2771",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 6.1.6 - Subscriber+ Category Add Leading to Stored Cross-Site Scripting",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 6.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link Fixer \u003c= 3.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "permalink-finder",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0809",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Recall \u003c= 16.26.14 - Reflected Cross-Site Scripting",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52796",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Critical Site Intel \u003c= 1.0 - Unauthenticated SQL Injection",
    "slug": "critical-site-intel-stats",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-55976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55976",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wp-mpdf \u003c= 3.5.1 - Cross-Site Request Forgery Bypass",
    "slug": "wp-mpdf",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4416",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SVG Sanitizer library \u003c= 0.15.4 - Cross-Site Scripting Bypass",
    "slug": "safe-svg",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28426",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comment Blacklist Updater \u003c= 1.1.0 - Cross-Site Request Forgery via update_blacklist_manual",
    "slug": "comment-blacklist-updater",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44147",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Drop Caps \u003c= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "drop-caps",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46495",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SpeedSize Image \u0026 Video AI-Optimizer \u003c= 1.5.1 - Cross-Site Request Forgery to Clear Cache",
    "slug": "speedsize-ai-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13438",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PayU CommercePro Plugin \u003c= 3.8.7 - Authentication Bypass",
    "slug": "payu-india",
    "type": "plugin",
    "affected_version": "* - 3.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31022",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Continue Shopping From Cart \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "continue-shopping-from-cart-page",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53714",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Bitcoin and Altcoin Wallet \u003c= 6.3.1 - Reflected Cross-Site Scripting",
    "slug": "wallets",
    "type": "plugin",
    "affected_version": "* - 6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24544",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "QQWorld Auto Save Images \u003c= 1.9.8 - Missing Authorization to Arbitrary Post Content Retrieval",
    "slug": "qqworld-auto-save-images",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1324",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "LWS Affiliation \u003c= 2.3.6 - Cross-Site Request Forgery",
    "slug": "lws-affiliation",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57934",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Ship to Multiple Addresses \u003c= 3.8.3 - Insecure Direct Object Reference",
    "slug": "woocommerce-shipping-multiple-addresses",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32799",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Protected wp-login \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "protected-wp-login",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27333",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue \u003c= 1.5 - Missing Authorization to Authenticated (Editor+) Settings Update",
    "slug": "revenueflex-easy-ads",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-27296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27296",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Post Popup \u003c= 3.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-post-modal",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4808",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteOrigin Widgets Bundle \u003c= 1.58.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "so-widgets-bundle",
    "type": "plugin",
    "affected_version": "* - 1.58.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.58.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1070",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FunnelCockpit \u003c= 1.4.3 - Reflected Cross-Site Scripting via `error` Parameter",
    "slug": "funnelcockpit",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6588",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rich Reviews by Starfish \u003c= 1.9.5 - SQL Injection",
    "slug": "rich-reviews",
    "type": "plugin",
    "affected_version": "[*, 1.9.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24753",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shariff Wrapper \u003c= 4.6.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "shariff",
    "type": "plugin",
    "affected_version": "* - 4.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1106",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BMLT Meeting Map \u003c= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bmlt-meeting-map",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12494",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.5.3 - Missing Authorization",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33565",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multi Video Box \u003c= 1.5.2 - Reflected Cross-Site Scripting via video_id and group_id Parameters",
    "slug": "multi-video-box",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2484",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TNC FlipBook \u003c= 12.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-viewer-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 12.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39509",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPAMS \u003c= 44.0 (17-08-2023) - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "apartment-management",
    "type": "plugin",
    "affected_version": "[*, 44.0 (17-08-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "44.0 (17-08-2023)",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39402",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Everest Backup \u003c= 2.3.3 - Cross-Site Request Forgery",
    "slug": "everest-backup",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49238",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Footnotes \u003c= 2.2 - Multiple Cross-Site Scripting",
    "slug": "wp-footnotes",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-0691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0691",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gift Certificate Creator \u003c= 1.0 - Stored Cross-Site Scripting",
    "slug": "gift-certificate-creator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1002017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002017",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "sidebarTabs \u003c= 3.1 - Reflected Cross-Site Scripting",
    "slug": "sidebartabs",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26587",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login Screen Manager \u003c= 3.5.2 - Cross-Site Request Forgery",
    "slug": "login-screen-manager",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47182",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eStore \u003c= 8.5.5 - Reflected Cross-Site Scripting via Customer Search",
    "slug": "wp-cart-for-digital-products",
    "type": "plugin",
    "affected_version": "* - 8.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6133",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comment Highlighter \u003c= 0.13 - Authenticated (Admin+) SQL Injection",
    "slug": "comment-highlighter",
    "type": "plugin",
    "affected_version": "* - 0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24393",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tiktok Feed \u003c= 1.0.21 - Missing Authorization",
    "slug": "b-tiktok-feed",
    "type": "plugin",
    "affected_version": "* - 1.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54710",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AdForest - Classified Ads WordPress Theme \u003c= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion",
    "slug": "adforest",
    "type": "theme",
    "affected_version": "* - 5.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12855",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.4.7 - DOM-based Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "0.1.0 - 3.4.7",
    "from_version": "0.1.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24891",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aviary Image Editor Add-on For Gravity Forms \u003c= 3.0 (Beta r7) - Arbitrary File Upload",
    "slug": "aviary-image-editor-add-on-for-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 3.0 (Beta r7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0 (Beta r7)",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-4455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4455",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "bbPress Move Topics \u003c= 1.1.4 - Cross-Site Request Forgery",
    "slug": "bbp-move-topics",
    "type": "plugin",
    "affected_version": "[*, 1.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-21006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-21006",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-WebAuthn \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode",
    "slug": "wp-webauthn",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9023",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FreshMail For WordPress \u003c= 2.3.2 - Reflected Cross-Site Scripting",
    "slug": "freshmail-integration",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46074",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Encoder – Protect Email Addresses and Phone Numbers \u003c= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "email-encoder-bundle",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7070",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3199",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Youtube Shortcode \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-youtube-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11811",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 3.9.1 - Authentication Bypass",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2734",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Share This Image \u003c 1.04 - Cross-Site Scripting",
    "slug": "share-this-image",
    "type": "plugin",
    "affected_version": "[*, 1.04)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.04",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18015",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Variable Inspector \u003c= 2.6.2 - Reflected Cross-Site Scripting",
    "slug": "variable-inspector",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26914",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Author URL \u003c= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "author-slug",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51655",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anant Addons for Elementor \u003c= 1.1.8 - Cross-Site Request Forgery to Arbitrary Plugin Installation",
    "slug": "anant-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32641",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tatsu \u003c= 3.3.12 - Unauthenticated Remote Code Execution",
    "slug": "tatsu",
    "type": "plugin",
    "affected_version": "* - 3.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25094",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \u003c= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3997",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inventory Presser \u003c= 15.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "inventory-presser",
    "type": "plugin",
    "affected_version": "* - 15.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50012",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Currency WP \u003c= 1.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via Currency Converter Form Shortcode",
    "slug": "mastercurrency-wp",
    "type": "plugin",
    "affected_version": "* - 1.1.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6634",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "活动链接推广插件 \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yr-activity-link",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Product Designer \u003c= 4.3.3 - Cross-Site Request Forgery",
    "slug": "woocommerce-products-designer",
    "type": "plugin",
    "affected_version": "* - 4.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46856",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) \u003c= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slingblocks",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8607",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Headless CMS \u003c= 2.0.3 - Missing Authorization",
    "slug": "headless-cms",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34186",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "KiotViet Sync \u003c= 1.8.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "kiotvietsync",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39381",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.6.5 - Reflected Cross-Site Scripting",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "[*, 2.6.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24979",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH PayPal Express Checkout for WooCommerce \u003c= 1.49.0 - Cross-Site Request Forgery",
    "slug": "yith-paypal-express-checkout-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.49.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.49.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48111",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Login or Logout Menu Item \u003c= 1.1.1 - Unauthenticated Settings Update",
    "slug": "login-or-logout-menu-item",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15820",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery – Upload, Vote \u0026 Sell with PayPal and Stripe \u003c= 27.0.3 - Unauthenticated CSV Injection",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 27.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "27.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11254",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Estatik Real Estate Plugin \u003c= 4.1.0 - Missing Authorization to Limited Arbitrary Options Update",
    "slug": "estatik",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6048",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Image Source Control Lite – Show Image Credits and Captions \u003c= 2.28.0 - Reflected Cross-Site Scripting",
    "slug": "image-source-control-isc",
    "type": "plugin",
    "affected_version": "* - 2.28.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.28.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13515",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2092",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Side Menu – add fixed side buttons \u003c= 3.1.3 - SQL Injection",
    "slug": "side-menu",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24348",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Presto Player \u003c= 3.0.2 - Missing Authorization",
    "slug": "presto-player",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43285",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Oxygen Builder \u003c= 4.8.2 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "oxygenbuilder",
    "type": "plugin",
    "affected_version": "* - 4.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4662",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dynamic Product Category Grid, Slider for WooCommerce \u003c= 1.1.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "dynamic-product-categories-design",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56230",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker \u003c= 9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 9.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4934",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.8.3 - Missing Authorization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2009-2854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2854",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Slickstream: Engagement and Conversions \u003c= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid Shortcode",
    "slug": "slick-engagement",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10179",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "illi Link Party! \u003c= 1.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "link-party",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7228",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.5.34 -  Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16118",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blocksy \u003c= 2.0.97 - Missing Authorization",
    "slug": "blocksy",
    "type": "theme",
    "affected_version": "* - 2.0.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.97",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-47465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47465",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Export and Import Users and Customers \u003c= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter",
    "slug": "users-customers-import-export-for-wp-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1971",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Worthy – VG WORT Integration für WordPress \u003c= 1.6.5-6497609 - Cross-Site Request Forgery",
    "slug": "wp-worthy",
    "type": "plugin",
    "affected_version": "[*, 1.6.5-6497609]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5-6497609",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24417",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Everest Forms (Pro) \u003c= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion",
    "slug": "everest-forms-pro",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5927",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "addWeather \u003c= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "myweather",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54389",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Preview Link Generator \u003c= 1.0.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "preview-link-generator",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1086",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Beek Widget Extention \u003c= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "beek-widget-extention",
    "type": "plugin",
    "affected_version": "* - 0.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10343",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paytium \u003c= 4.4.11 - Unauthenticated Full Path Disclosure",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24552",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 3.4.0 - Authenticated (Subscriber+) HTML Injection",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32230",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpView \u003c= 1.3.0 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "wpview",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33213",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Molongui \u003c= 4.6.19 - Reflected Cross-Site Scripting",
    "slug": "molongui-authorship",
    "type": "plugin",
    "affected_version": "* - 4.6.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39164",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 5.2.5.9 - Cross-Site Request Forgery",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25935",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "E2Pdf \u003c= 1.16.44 - Stored Cross-Site Scripting",
    "slug": "e2pdf",
    "type": "plugin",
    "affected_version": "* - 1.16.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0535",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WDesignKit – Elementor \u0026 Gutenberg Starter Templates, Patterns, Cloud Workspace \u0026 Widget Builder \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wdesignkit",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12189",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sp*tify Play Button for WordPress \u003c= 2.07 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "spotify-play-button-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.07",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1840",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WhyDonate – FREE Donate button – Crowdfunding – Fundraising \u003c= 4.0.15 - Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletion",
    "slug": "wp-whydonate",
    "type": "plugin",
    "affected_version": "* - 4.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10186",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Compact WP Audio Player \u003c= 1.9.14 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "compact-wp-audio-player",
    "type": "plugin",
    "affected_version": "* - 1.9.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56279",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Comments \u003c 1.2.5 - Cross-Site Request Forgery",
    "slug": "feature-comments",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-4163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4163",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c 1.3.5 - Reflected Cross-Site Scripting via Color Settings",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "[*, 1.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36384",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeneratePress Premium \u003c= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta",
    "slug": "generatepress-premium",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6807",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Password Reset with Code for WordPress REST API \u003c= 0.0.15 - Weak Password Recovery Mechanism",
    "slug": "bdvs-password-reset",
    "type": "plugin",
    "affected_version": "* - 0.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-35039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35039",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPC Smart Compare for WooCommerce \u003c= 6.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woo-smart-compare",
    "type": "plugin",
    "affected_version": "* - 6.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5530",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "hCaptcha for WordPress \u003c= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode",
    "slug": "hcaptcha-for-forms-and-more",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4014",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Read More \u0026 Accordion \u003c= 3.2.6.1 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "expand-maker",
    "type": "plugin",
    "affected_version": "* - 3.2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3392",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "iQ Block Country \u003c= 1.2.18 - Country Blocking Bypass",
    "slug": "iq-block-country",
    "type": "plugin",
    "affected_version": "* - 1.2.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41155",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Accept Authorize.NET Payments Using Contact Form 7 \u003c= 2.2 - Unauthenticated Information Exposure",
    "slug": "accept-authorize-net-payments-using-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12250",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Pending Order Bot \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pending-order-bot",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49892",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Scroll Styler \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "scroll-styler",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23990",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "4ECPS Web Forms \u003c= 0.2.17 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "4ecps-webforms",
    "type": "plugin",
    "affected_version": "* - 0.2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44628",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Author Discussion \u003c= 0.2.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "author-discussion",
    "type": "plugin",
    "affected_version": "* - 0.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49609",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "User Registration \u0026 Membership \u003c= 4.1.1 - Unauthenticated Privilege Escalation",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2563",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfileGrid  \u003c= 5.7.8 - Unauthenticated SQL Injection",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30490",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Master Addons for Elementor \u003c= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3134",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Digital Publications by Supsystic \u003c= 1.7.7 - Cross-Site Request Forgery",
    "slug": "digital-publications-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32089",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Missing Authorization in 'uucss_update_rule'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1339",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BadgeOS \u003c= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion",
    "slug": "badgeos",
    "type": "plugin",
    "affected_version": "* - 3.7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2173",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Simple Ajax Chat \u003c= 20220115 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "simple-ajax-chat",
    "type": "plugin",
    "affected_version": "* - 20220115",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20220115",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25610",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Realty by BestWebSoft \u003c 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "realty",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18532",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print My Blog \u003c= 1.6.6 - Server-Side Request Forgery",
    "slug": "print-my-blog",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-11565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11565",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Logo \u003c= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "easylogo",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32083",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.239",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.239",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6988",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Showcase \u003c= 1.22.15 - Stored Cross-Site Scripting",
    "slug": "team",
    "type": "plugin",
    "affected_version": "[*, 1.22.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-35937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35937",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quantity Plus Minus Button for WooCommerce by CodeAstrology \u003c= 1.1.9 - Cross-Site Request Forgery via wqpmb_form_submit",
    "slug": "wc-quantity-plus-minus-button",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48768",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "AccessPress Anonymous Post \u003c= 2.8.4 - Authenticated (Contributor+) Arbitrary Redirect",
    "slug": "accesspress-anonymous-post",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4946",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post to Twitter \u003c= 0.7 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "post-to-twitter",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9393",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate NoFollow \u003c= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nofollow",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24817",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebinarIgnition \u003c= 3.05.0 - Missing Authorization to Unauthenticated Privilege Escalation",
    "slug": "webinar-ignition",
    "type": "plugin",
    "affected_version": "* - 3.05.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.05.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51424",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Preferred Languages \u003c= 2.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "preferred-languages",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35644",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Claudio Sanches – Checkout Cielo for WooCommerce \u003c= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status Update",
    "slug": "woocommerce-checkout-cielo",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1718",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.1.5 - Cross-Site Request Forgery",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43488",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPLMS \u003c 1.9.9.5.2 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "[*, 1.9.9.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-56049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56049",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
  },
  {
    "title": "TableOn – WordPress Posts Table Filterable \u003c= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tableon_popup_iframe_button Shortcode",
    "slug": "posts-table-filterable",
    "type": "plugin",
    "affected_version": "* - 1.0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5143",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery \u003c= 1.8.2 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4058",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shariff Wrapper \u003c= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shariff",
    "type": "plugin",
    "affected_version": "* - 4.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0966",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VK Block Patterns \u003c= 1.31.1.1 - Cross-Site Request Forgery",
    "slug": "vk-block-patterns",
    "type": "plugin",
    "affected_version": "* - 1.31.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0623",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress User Extra Fields \u003c= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wp-user-extra-fields",
    "type": "plugin",
    "affected_version": "* - 16.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10800",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mobile Contact Line \u003c= 2.4.0 - Missing Authorization",
    "slug": "mobile-contact-line",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58622",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Formsite | Embed online forms to collect orders, registrations, leads, and surveys \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "formsite",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31257",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Delicate \u003c= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode",
    "slug": "delicate",
    "type": "theme",
    "affected_version": "* - 3.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5867",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Animator \u003c= 3.0.15 - Reflected Cross-Site Scripting",
    "slug": "scroll-triggered-animations",
    "type": "plugin",
    "affected_version": "* - 3.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49308",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP FPO \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-fpo",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23496",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iPages Flipbook \u003c 1.5.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "ipages-flipbook",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-47236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47236",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "iFlyChat – WordPress Chat \u003c= 4.6.4 - Admin+ Stored Cross-Site Scripting",
    "slug": "iflychat",
    "type": "plugin",
    "affected_version": "[*, 4.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24343",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Academist Membership \u003c= 1.1.6 - Authentication Bypass via Account Takeover",
    "slug": "academist-membership",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1671",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MP3 jPlayer \u003c= 2.7.3 - Cross-Site Request Forgery",
    "slug": "mp3-jplayer",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36373",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Blocks \u003c= 2.4 - Missing Authorization",
    "slug": "smart-blocks",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59561",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "stripShow Plugin \u003c= 2.5.2 - SQL Injection",
    "slug": "stripshow",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5184",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5554",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GuCherry Blog \u003c= 1.1.8 - Reflected Cross-Site Scripting",
    "slug": "gucherry-blog",
    "type": "theme",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32531",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hacklog Remote Attachment \u003c= 1.3.2 - Cross-Site Request Forgery",
    "slug": "hacklog-remote-attachment",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46530",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BP Profile as Homepage \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "bp-profile-as-homepage",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49453",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VK Filter Search \u003c= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "vk-filter-search",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5705",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VK Blocks \u003c= 1.57.0.5 - Authenticated(Contributor+) Settings Update",
    "slug": "vk-blocks",
    "type": "plugin",
    "affected_version": "* - 1.57.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.57.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0583",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Upload File \u003c= 1.0.4 - Arbitrary File Upload/Deletion",
    "slug": "edd-upload-file",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9530",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booking for Appointments and Events Calendar – Amelia \u003c= 1.0.85 - Stored Cross-Site Scripting via Shortcode",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.0.85",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.85",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50860",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Query Blocks \u003c= 5.2.0 - Missing Authorization via REST Routes",
    "slug": "post-type-archive-mapping",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38794",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPSmartContracts \u003c= 1.3.11 - Authenticated (Author+) SQL Injection",
    "slug": "wp-smart-contracts",
    "type": "plugin",
    "affected_version": "* - 1.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3768",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.2.5 - Open Redirect",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58204",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leadinfo \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "leadinfo",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32112",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OwnerRez \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "ownerrez",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31814",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Daily Image \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "daily-image",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51776",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Dashboard 1.5.10 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via ajax_request Function",
    "slug": "frontend-dashboard",
    "type": "plugin",
    "affected_version": "1.5.10 - 2.2.7",
    "from_version": "1.5.10",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4473",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LaunchPage.app Importer \u003c= 1.1 - Unauthenticated SQL Injection",
    "slug": "launchpage-app-importer",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-55977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55977",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Profile Extra Fields by BestWebSoft \u003c= 1.2.7 - Missing Authorization to Sensitive Information Exposure",
    "slug": "profile-extra-fields",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4469",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Scanventory \u003c= 1.1.3 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-inventory-management",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22588",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Album Reviewer \u003c= 2.0.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "albumreviewer",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-25070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25070",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AnyRoad \u003c= 1.3.2 - Cross-Site Request Forgery",
    "slug": "anyguide",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23996",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bookify \u003c= 1.0.9 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "bookify",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48142",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce \u003c= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form Shortcode",
    "slug": "wp-cafe",
    "type": "plugin",
    "affected_version": "* - 2.2.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5427",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Project Manager \u003c= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13500",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Reset PRO 5.00-5.98 - Cross-Site Request Forgery",
    "slug": "wp-reset",
    "type": "plugin",
    "affected_version": "5.00 - 5.98",
    "from_version": "5.00",
    "from_inclusive": true,
    "to_version": "5.98",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36908",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Exchange Rates \u003c= 1.2.2 - Missing Authorization",
    "slug": "exchange-rates",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30864",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bulk Page Stub Creator \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "bulk-page-stub-creator",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enhanced YouTube Shortcode \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "enhanced-youtube-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23946",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Microsoft Clarity \u003c= 0.9.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "microsoft-clarity",
    "type": "plugin",
    "affected_version": "* - 0.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0590",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.5.1.4 - Cross-Site Request Forgery via action_restore_events",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37518",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SpiderVPlayer \u003c= 2.1 - SQL Injection",
    "slug": "player",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-3532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3532",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VS Contact Form \u003c= 14.7 - CAPTCHA Bypass",
    "slug": "very-simple-contact-form",
    "type": "plugin",
    "affected_version": "* - 14.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30540",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TeraWallet – For WooCommerce \u003c= 1.4.3 - Insecure Direct Object Reference",
    "slug": "woo-wallet",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3995",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Enquiry for WooCommerce \u003c= 3.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "gm-woocommerce-quote-popup",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47696",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AmpedSense – AdSense Split Tester \u003c= 4.68 - Unauthenticated Cross-Site Scripting",
    "slug": "ampedsense-adsense-split-tester",
    "type": "plugin",
    "affected_version": "* - 4.68",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.68",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25476",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cookie Consent \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46525",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Newsletter Subscription \u003c= 1.1 - Unauthenticated Local File Inclusion",
    "slug": "wp-newsletter-subscription",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-44012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44012",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Groundhogg \u003c= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 2.7.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2717",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Starter Templates \u003c= 4.4.9 - Cross-Site Request Forgery",
    "slug": "astra-sites",
    "type": "plugin",
    "affected_version": "* - 4.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24568",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Beautiful Link Preview \u003c= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "beautiful-link-preview",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30536",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qards (Unspecified Version) - Stored Cross-Site Scripting",
    "slug": "qards",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18598",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dropdown Menu Widget \u003c= 1.9.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "dropdown-menu-widget",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25113",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Workreap \u003c= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media'",
    "slug": "workreap",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5012",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE \u003c= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2226",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ECT Home Page Products \u003c= 1.9 - Reflected Cross-Site Scripting",
    "slug": "ect-homepage-products",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13225",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2944",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Loading Page with Loading Screen \u003c= 1.0.82 - Cross-Site Scripting",
    "slug": "loading-page",
    "type": "plugin",
    "affected_version": "* - 1.0.82",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.82",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2169",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEOPress \u003c= 7.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 7.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4899",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mesmerize Companion \u003c= 1.6.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "mesmerize-companion",
    "type": "plugin",
    "affected_version": "* - 1.6.133",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.133",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4481",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iFrame Block \u003c= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "iframe-block",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49411",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complianz – GDPR/CCPA Cookie Consent \u003c= 6.5.6 - Cross-Site Request Forgery to Data Request Deletion",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1592",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Blocks for Gutenberg \u003c= 4.8.3 - Missing Authorization",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26871",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woocommerce Social Media Share Buttons \u003c= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "woocommerce-social-media-share-buttons",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31109",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hash Elements \u003c= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure",
    "slug": "hash-elements",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10802",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Advanced PDF \u003c= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-advanced-pdf",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57945",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UserFeedback Lite \u003c= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter",
    "slug": "userfeedback-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5902",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Profile Avatar \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-user-profile-avatar",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52118",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Customer Area \u003c= 8.2.5 - Missing Authorization",
    "slug": "customer-area",
    "type": "plugin",
    "affected_version": "* - 8.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49982",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Plugin for Google Maps – WP MAPS \u003c= 4.6.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2386",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Widget Options - Extended \u003c= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "extended-widget-options",
    "type": "plugin",
    "affected_version": "* - 5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8902",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 2.3.3 - Authenticated Arbitrary Plugin Installation",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "[*, 2.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24279",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.3.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-2400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2400",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Post Series \u003c= 2.4.4 - Reflected Cross-Site Scripting",
    "slug": "simple-post-series",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28934",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Email \u003c= 1.3.52 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "contact-form-to-email",
    "type": "plugin",
    "affected_version": "* - 1.3.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24727",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Maintenance \u003c= 6.1.9.2 - IP Spoofing to Maintenance Mode Bypass",
    "slug": "wp-maintenance",
    "type": "plugin",
    "affected_version": "* - 6.1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0789",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Archives Calendar Widget \u003c= 1.0.15 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "archives-calendar-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33950",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Tables \u003c= 4.1.7 - Admin+ Stored Cross-Site Cross-Site Scripting",
    "slug": "ninja-tables",
    "type": "plugin",
    "affected_version": "* - 4.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24900",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formality \u003c= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter",
    "slug": "formality",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3858",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RapidLoad \u003c= 2.4.4 - Missing Authorization",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22665",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Sentinel \u003c= 1.0.0 - Cross-Site Scripting",
    "slug": "wordpress-sentinel",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-5225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5225",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Quick FrontEnd Editor \u003c= 5.5 - Authenticated (Subscriber+) Content Injection",
    "slug": "wp-quick-front-end-editor",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4383",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Slimstat Analytics \u003c= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "* - 5.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4598",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Smart Import : Import any XML File to WordPress \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "wp-smart-import",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12701",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Redirection Plugin \u003c= 8.9 - Cross-Site Request Forgery",
    "slug": "seo-redirection",
    "type": "plugin",
    "affected_version": "* - 8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40695",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booking Calendar \u003c= 9.1 - PHP Object Injection via Shortcode",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1463",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Timing Side-Channel Attack",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.6",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Timing Side-Channel Attack",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.3",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Timing Side-Channel Attack",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Timing Side-Channel Attack",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.9",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Timing Side-Channel Attack",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.9",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Timing Side-Channel Attack",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.7",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Timing Side-Channel Attack",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.6",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MyCSS \u003c= 1.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "mycss",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1960",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Automatic YouTube Gallery \u003c= 2.3.3 - Missing Authorization via AJAX actions",
    "slug": "automatic-youtube-gallery",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41866",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form \u0026 Custom Form Builder \u003c= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "* - 6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9768",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "2kb Amazon Affiliates Store \u003c= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "2kb-amazon-affiliates-store",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40968",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Return Refund and Exchange For WooCommerce \u003c= 4.0.8 - Arbitrary File Upload",
    "slug": "woo-refund-and-exchange-lite",
    "type": "plugin",
    "affected_version": "* - 4.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4047",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kadence WooCommerce Email Designer \u003c= 1.5.6 - PHP Object Injection",
    "slug": "kadence-woocommerce-email-designer",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3335",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Notes Tab \u0026 Private Admin Notes for WooCommerce \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "product-notes-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48239",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CF7 Invisible reCAPTCHA \u003c 1.3.2 - Cross-Site Scripting",
    "slug": "cf7-invisible-recaptcha",
    "type": "plugin",
    "affected_version": "[*, 1.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-21012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-21012",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download canvasio3D Light \u003c= 2.5.0 - Missing Authorization",
    "slug": "canvasio3d-light",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48776",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "SearchIQ \u003c= 4.4 - Missing Authorization via getSIQPluginSettings",
    "slug": "searchiq",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47832",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Video Gallery for WooCommerce \u003c= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion",
    "slug": "video-wc-gallery",
    "type": "plugin",
    "affected_version": "* - 1.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10535",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Seo By 10Web \u003c= 1.2.9 - Reflected Cross-Site Scripting",
    "slug": "seo-by-10web",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34375",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "140+ Widgets | Best Addons For Elementor – FREE \u003c= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4440",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Tools \u003c= 5.24 - Cross-Site Request Forgery",
    "slug": "wptools",
    "type": "plugin",
    "affected_version": "* - 5.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49273",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcodes Blocks Creator Ultimate \u003c= 2.2.0 - Reflected Cross-Site Scripting via _wpnonce",
    "slug": "ultimate-shortcodes-creator",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12167",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Coupons for WooCommerce \u003c= 3.0.14 - Reflected Cross-Site Scripting",
    "slug": "woo-auto-coupons",
    "type": "plugin",
    "affected_version": "* - 3.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35733",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "W3 Total Cache \u003c= 0.9.4 - Cross-Site Scripting",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-8724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8724",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP RSS Images \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "wp-rss-images",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36693",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Snap Pixel \u003c= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "snap-pixel",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41242",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Caldera Forms \u003c= 1.9.6 - Reflected Cross-Site Scripting via cf-api",
    "slug": "caldera-forms",
    "type": "plugin",
    "affected_version": "[*, 1.9.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0879",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackupGuard \u003c= 1.1.46 - Reflected Cross-Site Scripting",
    "slug": "backup",
    "type": "plugin",
    "affected_version": "* - 1.1.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-10837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-10837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Widget Classes \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "custom-widget-classes",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23844",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Social Login \u003c= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wordpress-social-login",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34172",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zita Elementor Site Library \u003c= 1.6.2 - Missing Authorization to Page Creation and Options Modification",
    "slug": "zita-site-library",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3249",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IP2Location Country Blocker \u003c= 2.26.4 - Ban Bypass",
    "slug": "ip2location-country-blocker",
    "type": "plugin",
    "affected_version": "* - 2.26.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.26.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25096",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Exchange Addon Table Rate Shipping \u003c 1.1.0 - Cross-Site Scripting",
    "slug": "exchange-addon-table-rate-shipping",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9375",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapSVG \u003c= 8.5.32 - Missing Authorization",
    "slug": "mapsvg",
    "type": "plugin",
    "affected_version": "* - 8.5.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47560",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2765",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "UpdraftPlus: WP Backup \u0026 Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection",
    "slug": "updraftplus",
    "type": "plugin",
    "affected_version": "1.23.8 - 1.24.11",
    "from_version": "1.23.8",
    "from_inclusive": true,
    "to_version": "1.24.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10957",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wpCommentTwit Plugin \u003c= 0.5 - Cross-Site Scripting",
    "slug": "wpcommenttwit",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9340",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster Plus for WooCommerce \u003c 7.1.2 - Missing Authorization to Order Information Disclosure",
    "slug": "booster-plus-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 7.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-52231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52231",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AgreeMe Checkboxes For WooCommerce \u003c= 1.1.3 - Cross-Site Request Forgery",
    "slug": "agreeme-checkboxes-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57905",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Storely \u003c= 18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "storely",
    "type": "theme",
    "affected_version": "* - 18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51794",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate SMS Notifications for WooCommerce \u003c= 1.4.1 - CSV Injection",
    "slug": "ultimate-sms-notifications",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2429",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Relocate Upload \u003c= 0.24.1 - Cross-Site Request Forgery",
    "slug": "relocate-upload",
    "type": "plugin",
    "affected_version": "* - 0.24.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.24.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53315",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wp-login customizer \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-login-customizer",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52424",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OTP-less one tap Sign in \u003c= 2.0.58 - Reflected Cross-Site Scripting",
    "slug": "otpless",
    "type": "plugin",
    "affected_version": "* - 2.0.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32622",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – eCommerce Payments and Subscriptions made easy \u003c= 3.3.6.1 - Unauthenticated Private Post Title Disclosure",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2252",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "EazyDocs \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "eazydocs",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Send Users Email \u003c= 1.4.3 - Sensitive Information Exposure via Error Logs",
    "slug": "send-users-email",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52126",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Language Field \u003c=  0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "language-field",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31382",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP jQuery DataTable \u003c= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-jquery-datatable",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12499",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login as User or Customer \u003c 1.8 - Missing Authorization to Arbitrary Plugin Installation/Activation",
    "slug": "login-as-customer-or-user",
    "type": "plugin",
    "affected_version": "[*, 1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24195",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pinterest Pinboard Widget \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pinterest-pinboard-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58248",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bamboo Columns \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bamboo-columns",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47812",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4716",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more \u003c= 1.4.0 - Cross-Site Request Forgery",
    "slug": "embed-extended",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31784",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Amazon Affiliate \u003c= 1.0.9 - Reflected Cross-Site Scripting",
    "slug": "simple-amazon-affiliate",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2077",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Matomo Analytics \u003c= 5.1.0 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "matomo",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38766",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Members Membership Plugin \u003c= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.4.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1852",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Estate Manager \u003c= 7.3 - Cross-Site Request Forgery",
    "slug": "real-estate-manager",
    "type": "plugin",
    "affected_version": "* - 7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50044",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DB Backup \u003c 5.0 - Directory Traversal",
    "slug": "db-backup",
    "type": "plugin",
    "affected_version": "[*, 5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9119",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.2.12 - Missing Authorization",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37094",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.3.14.727 - Sensitive Information Exposure",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.3.14.727",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.14.727",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14800",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Gumroad \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gumroad",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45059",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "T(-) Countdown \u003c= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "t-countdown",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9884",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy FAQs \u003c= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-faqs",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23795",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Tag Links \u003c= 1.0.13 - Cross-Site Request Forgery",
    "slug": "auto-tag-links",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27335",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElegantThemes \u003c= 1.2.3 - Privilege Escalation",
    "slug": "extra",
    "type": "theme",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-11002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11002",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Affiliates Manager \u003c= 2.9.34 - Cross-Site Request Forgery",
    "slug": "affiliates-manager",
    "type": "plugin",
    "affected_version": "* - 2.9.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0859",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Addons, Widgets and Enhancements – Stax \u003c= 1.4.3 - Missing Authorization in toggle_widget",
    "slug": "stax-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2189",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 2.9.13 - Authenticated Stored Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "[*, 2.9.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-15020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-15020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Webcraftic Clearfy – WordPress optimization plugin \u003c= 2.3.2 - Cross-Site Request Forgery to Plugin Settings Update via 'setup-wbcr_clearfy'",
    "slug": "clearfy",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13337",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SpiderDisplay \u003c= 1.9.1 - Reflected Cross-Site Scripting",
    "slug": "spiderdisplay",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23855",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Slider For Elementor \u003c= 1.3.9 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "ht-slider-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0495",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UpdraftPlus WordPress Backup Plugin \u003c= 1.16.65 - Reflected Cross-Site Scripting",
    "slug": "updraftplus",
    "type": "plugin",
    "affected_version": "[*, 1.16.66)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.66",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25022",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Productive Style \u003c= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_productive_breadcrumb Shortcode",
    "slug": "productive-style",
    "type": "plugin",
    "affected_version": "* - 1.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8394",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GigPress \u003c= 2.3.28 - Authenticated (Subscriber+) SQL Injection",
    "slug": "gigpress",
    "type": "plugin",
    "affected_version": "* - 2.3.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0381",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "InstaWP Connect \u003c= 0.1.0.38 - Unauthenticated Arbitrary File Upload",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.38",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37228",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps \u0026 One Click Upsells \u003c= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update",
    "slug": "funnel-builder",
    "type": "plugin",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6836",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Plugin Logic \u003c= 1.0.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "plugin-logic",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4268",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Restrict User Access – Membership Plugin with Force \u003c= 2.5 - Reflected Cross-Site Scripting",
    "slug": "restrict-user-access",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29138",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vision Interactive \u003c= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "vision",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4391",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restrict File Access \u003c= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Read",
    "slug": "restrict-file-access",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6070",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.4 - Cross-Site Request Forgery to Arbitrary Post Duplication",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5383",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 5.9.26 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39649",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Wallcreeper \u003c= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disable",
    "slug": "wp-wallcreeper",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7822",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cart66 Lite :: WordPress Ecommerce \u003c 1.5.2 -  SQL Injection",
    "slug": "cart66-lite",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9305",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Notice Bar \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "notice-bar",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49389",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Misiek Photo Album \u003c= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "misiek-photo-album",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7818",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "UltimateAI \u003c= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check",
    "slug": "Ultimate_AI",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9104",
    "auth_type": "Unauth",
    "cvss_score": 5.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Contact Form 7 Campaign Monitor Extension \u003c= 0.4.67 - Missing Authorization to Unauthenticated Arbitrary File Deletion",
    "slug": "contact-form-7-campaign-monitor-extension",
    "type": "plugin",
    "affected_version": "* - 0.4.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.67",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-44019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44019",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Total Donations \u003c= 2.0.5 - Missing Authorization to Arbitrary Options Update",
    "slug": "total-donations",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-6703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6703",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AnimateGL Animations for WordPress – Elementor \u0026 Gutenberg Blocks Animations \u003c= 1.4.23 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "animategl",
    "type": "plugin",
    "affected_version": "* - 1.4.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12620",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quick Paypal Payments \u003c= 5.7.25 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "quick-paypal-payments",
    "type": "plugin",
    "affected_version": "* - 5.7.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25702",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Maintenance Mode \u003c= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameter",
    "slug": "smart-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1490",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Squeeze \u003c= 1.4 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "squeeze",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-35767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35767",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "RumbleTalk Live Group Chat \u003c= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rumbletalk-chat-a-chat-with-themes",
    "type": "plugin",
    "affected_version": "* - 6.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58626",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BZScore – Live Score \u003c= 1.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "bzscore-live-score",
    "type": "plugin",
    "affected_version": "* - 1.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47654",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orchid Store \u003c= 1.5.6 -  Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation",
    "slug": "orchid-store",
    "type": "theme",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6987",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PDF Generator Addon for Elementor Page Builder \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-generator-addon-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31850",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PlusCaptcha \u003c= 2.0.6 - Reflected Cross-Site Scripting",
    "slug": "pluscaptcha",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10127",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magic Post Thumbnail \u003c= 4.1.10 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "magic-post-thumbnail",
    "type": "plugin",
    "affected_version": "* - 4.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-29171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29171",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Menu \u003c= 4.0.3 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "responsive-menu",
    "type": "plugin",
    "affected_version": "[*, 4.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24161",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Meta SEO \u003c= 4.4.8 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-30337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-30337",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Adminify \u003c= 3.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "adminify",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4060",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Wall \u003c= 1.7.3 - Reflected Cross-Site Scripting",
    "slug": "wp-wall",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28968",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SMS \u003c= 6.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-sms",
    "type": "plugin",
    "affected_version": "* - 6.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34811",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FancyBox \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "fancy-box",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28935",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ActiveCampaign \u003c= 8.1.16 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "activecampaign-subscription-forms",
    "type": "plugin",
    "affected_version": "* - 8.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32136",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery from files \u003c= 1.60 - Reflected Cross-Site Scripting",
    "slug": "gallery-from-files",
    "type": "plugin",
    "affected_version": "* - 1.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24349",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hustle \u003c= 7.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wordpress-popup",
    "type": "plugin",
    "affected_version": "* - 7.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8492",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TCBD Tooltip \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tcbd-tooltip",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13388",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Coder \u003c= 2.5.1 - Remote File Inclusion leading to Remote Code Execution via Cross-Site Request Forgery",
    "slug": "wp-coder",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25053",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Database Cleaner \u003c= 3.1.0 - Reflected Cross-Site Scripting",
    "slug": "advanced-database-cleaner",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2173",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi Purpose Mail Form \u003c= 1.0.2 - Unauthenticated Arbitrary File Upload",
    "slug": "multi-purpose-mail-form",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50484",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gs-woo-brands",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11746",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.5.1.1 - Missing Authorization",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-21743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-21743",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "3D Flipbook \u003c= 1.15.2 - Authenticated (Contributor+) Cross-Site Scripting via Ready Function",
    "slug": "interactive-3d-flipbook-powered-physics-engine",
    "type": "plugin",
    "affected_version": "* - 1.15.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates \u003c= 1.6.8 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "responsive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2228",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Poll Maker – Versus Polls, Anonymous Polls, Image Polls \u003c= 5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll Settings",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9462",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Masteriyo - LMS \u003c= 1.7.3 - Insecure Direct Object Reference",
    "slug": "learning-management-system",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33939",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Discount Rules for WooCommerce – Create Smart WooCommerce Coupons \u0026 Discounts, Bulk Discount, BOGO Coupons \u003c= 2.6.5 - Reflected Cross-Site Scripting",
    "slug": "woo-discount-rules",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8541",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon_color",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0255",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WS Form LITE and PRO \u003c= 1.10.13 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "ws-form",
    "type": "plugin",
    "affected_version": "* - 1.10.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13509",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WS Form LITE and PRO \u003c= 1.10.13 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "ws-form-pro",
    "type": "plugin",
    "affected_version": "* - 1.10.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13509",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ERP \u003c= 1.12.3 - Reflected Cross-Site Scripting",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "[*, 1.12.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2743",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "S3Bubble Cloud Video with Adverts and Analytics \u003c 4.8  - Arbitrary File Download",
    "slug": "s3bubble-amazon-s3-audio-streaming",
    "type": "plugin",
    "affected_version": "[*, 4.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9463",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Time Slots Booking Form \u003c= 1.2.06 - Unauthenticated Price Manipulation",
    "slug": "wp-time-slots-booking-form",
    "type": "plugin",
    "affected_version": "* - 1.2.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33543",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Forminator \u003c= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.29.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7389",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.4 - Missing Authorization via Several Functions",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24835",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PlanSo Forms \u003c= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "planso-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24516",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product XML Feed Manager for WooCommerce \u003c= 2.9.2 - Missing Authorization",
    "slug": "product-xml-feeds-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.1.3 -  Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-1893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1893",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager  \u003c= 4.23 - Subscriber+ Arbitrary File Upload",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "[*, 4.24)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4225",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Download Monitor \u003c= 4.8.1 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 4.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31219",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom 404 Pro \u003c= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` Parameter",
    "slug": "custom-404-pro",
    "type": "plugin",
    "affected_version": "* - 3.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9947",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BerqWP \u003c= 1.7.6 - Unauthenticated Arbitrary File Uplaod",
    "slug": "searchpro",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43160",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Website price calculator \u003c= 4.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "price-calculator-to-your-website",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51601",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Job Board Manager \u003c= 2.1.60 - Missing Authorization",
    "slug": "job-board-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49324",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Community Events \u003c= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "community-events",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6270",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid \u003c= 2.1.7 - Reflected Cross-Site Scripting",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24488",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Designer Pro \u003c= 1.9.24 - Unauthenticated Arbitrary File Upload",
    "slug": "wc-designer-pro",
    "type": "plugin",
    "affected_version": "* - 1.9.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.24",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-60219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60219",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Next-Cart Store to WooCommerce Migration \u003c= 3.9.2 - Reflected Cross-Site Scripting",
    "slug": "nextcart-woocommerce-migration",
    "type": "plugin",
    "affected_version": "* - 3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export WP Page to Static HTML/CSS \u003c= 4.1.0 - Missing Authorization",
    "slug": "export-wp-page-to-static-html",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58980",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WDS Multisite Aggregate \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "wds-multisite-aggregate",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10120",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Shortcodes \u003c= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "themify-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4787",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.1",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.12",
    "from_version": "1.12",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.16",
    "from_version": "1.16",
    "from_inclusive": true,
    "to_version": "1.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.21",
    "from_version": "1.21",
    "from_inclusive": true,
    "to_version": "1.21",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.23",
    "from_version": "1.23",
    "from_inclusive": true,
    "to_version": "1.23",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.6",
    "from_version": "1.6",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.7",
    "from_version": "1.7",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.9",
    "from_version": "1.9",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.15",
    "from_version": "1.15",
    "from_inclusive": true,
    "to_version": "1.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.18",
    "from_version": "1.18",
    "from_inclusive": true,
    "to_version": "1.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.2",
    "from_version": "1.2",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.27",
    "from_version": "1.27",
    "from_inclusive": true,
    "to_version": "1.27",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.29",
    "from_version": "1.29",
    "from_inclusive": true,
    "to_version": "1.29",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.32",
    "from_version": "1.32",
    "from_inclusive": true,
    "to_version": "1.32",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.33",
    "from_version": "1.33",
    "from_inclusive": true,
    "to_version": "1.33",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.19",
    "from_version": "1.19",
    "from_inclusive": true,
    "to_version": "1.19",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.11",
    "from_version": "1.11",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.25",
    "from_version": "1.25",
    "from_inclusive": true,
    "to_version": "1.25",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.28",
    "from_version": "1.28",
    "from_inclusive": true,
    "to_version": "1.28",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.3",
    "from_version": "1.3",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.10",
    "from_version": "1.10",
    "from_inclusive": true,
    "to_version": "1.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.26",
    "from_version": "1.26",
    "from_inclusive": true,
    "to_version": "1.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.4",
    "from_version": "1.4",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.8",
    "from_version": "1.8",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.13",
    "from_version": "1.13",
    "from_inclusive": true,
    "to_version": "1.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.17",
    "from_version": "1.17",
    "from_inclusive": true,
    "to_version": "1.17",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.30",
    "from_version": "1.30",
    "from_inclusive": true,
    "to_version": "1.30",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.5",
    "from_version": "1.5",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.20",
    "from_version": "1.20",
    "from_inclusive": true,
    "to_version": "1.20",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.22",
    "from_version": "1.22",
    "from_inclusive": true,
    "to_version": "1.22",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.14",
    "from_version": "1.14",
    "from_inclusive": true,
    "to_version": "1.14",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.24",
    "from_version": "1.24",
    "from_inclusive": true,
    "to_version": "1.24",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.33 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "1.31",
    "from_version": "1.31",
    "from_inclusive": true,
    "to_version": "1.31",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45355",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "weDocs \u003c= 2.1.4 - Missing Authorization",
    "slug": "wedocs",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34442",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CRM Perks Forms \u003c= 1.1.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "crm-perks-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30499",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "SP Project \u0026 Document Manager \u003c= 4.21 - Authenticated Shell Upload",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "[*, 4.22)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.22",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24347",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SodaHead Polls \u003c 2.0.4 - Multiple Cross-Site Scripting",
    "slug": "sodahead-polls",
    "type": "plugin",
    "affected_version": "[*, 2.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-5304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5304",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPAvatar \u003c= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpavatar",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48312",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IMDB Profile Widget \u003c 1.0.9 - Local File Inclusion",
    "slug": "imdb-widget",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10991",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simply Static \u003c= 3.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simply-static",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30178",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Corona Virus (COVID-19) Banner \u0026 Live Data \u003c= 1.8.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "corona-virus-covid-19-banner",
    "type": "plugin",
    "affected_version": "* - 1.8.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34429",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FastDup \u003c= 2.1.7 - Sensitive Information Exposure via Log File",
    "slug": "fastdup",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51406",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "RestroPress \u003c= 3.1.2 - Cross-Site Request Forgery via rpress_orders_list_table_process_bulk_actions",
    "slug": "restropress",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32449",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Roles and Capabilities \u003c= 1.2.6 - Missing Authorization",
    "slug": "user-roles-and-capabilities",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49981",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Auto FTP \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "auto-ftp",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23793",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteOrigin Widgets Bundle \u003c= 1.64.0 - Missing Authorization",
    "slug": "so-widgets-bundle",
    "type": "plugin",
    "affected_version": "* - 1.64.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.64.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54268",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CozyStay \u003c 1.7.1 - Unauthenticated Local File Inclusion",
    "slug": "cozystay",
    "type": "theme",
    "affected_version": "[*, 1.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-49508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49508",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Edumall \u003c= 4.2.4 - Unauthenticated Local File Inclusion",
    "slug": "edumall",
    "type": "theme",
    "affected_version": "* - 4.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2101",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tourmaster \u003c= 5.3.8 - Unauthenticated Local File Inclusion",
    "slug": "tourmaster",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48292",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Jet Engine \u003c= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter",
    "slug": "jet-engine",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0369",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Manager - Resume Manager \u003c= 2.1.0 - Missing Authorization",
    "slug": "wp-job-manager-resumes",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37443",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Ship to Multiple Addresses \u003c= 3.8.9 - Missing Authorization",
    "slug": "woocommerce-shipping-multiple-addresses",
    "type": "plugin",
    "affected_version": "* - 3.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51497",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inline Click To Tweet \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "inline-click-to-tweet",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51803",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radius Blocks – WordPress Gutenberg Blocks \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "radius-blocks",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54272",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Submitted Posts \u003c= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "user-submitted-posts",
    "type": "plugin",
    "affected_version": "* - 20241026",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20241026",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2874",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sina Extension for Elementor \u003c= 3.3.11 - Stored Cross-Site Scripting",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 3.3.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24269",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "coreActivity: Activity Logging for WordPress \u003c= 2.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "coreactivity",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3436",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MX Time Zone Clocks \u003c= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mx-time-zone-clocks",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31801",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-search",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-tabs",
    "type": "plugin",
    "affected_version": "* - 2.1.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-blog",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-theme-core",
    "type": "plugin",
    "affected_version": "* - 2.1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-compare-wishlist",
    "type": "plugin",
    "affected_version": "* - 1.5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-popup",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-woo-builder",
    "type": "plugin",
    "affected_version": "* - 2.1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-reviews",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-engine",
    "type": "plugin",
    "affected_version": "* - 3.2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-tricks",
    "type": "plugin",
    "affected_version": "* - 1.4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-menu",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-woo-product-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Crocoblock \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "jet-smart-filters",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tithe.ly Giving Button \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-tithely",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11841",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Make Connector \u003c= 1.5.10 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "integromat-connector",
    "type": "plugin",
    "affected_version": "* - 1.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6085",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "1003 Mortgage Application \u003c= 1.87 - Missing Authorization",
    "slug": "1003-mortgage-application",
    "type": "plugin",
    "affected_version": "* - 1.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22592",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blocksy Companion \u003c= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads",
    "slug": "blocksy-companion",
    "type": "plugin",
    "affected_version": "* - 2.0.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4487",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM Perks Forms \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "crm-perks-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38467",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hospital Management System \u003c= 47.0(20-11-2023) - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "hospital-management",
    "type": "plugin",
    "affected_version": "[*, 47.0(20-11-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "47.0(20-11-2023)",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47663",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Maintenance \u0026 Coming Soon Redirect Animation \u003c= 2.1.3 - Missing Authorization to Settings Update",
    "slug": "maintenance-coming-soon-redirect-animation",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9503",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tourmaster \u003c 5.4.1 - Reflected Cross-Site Scripting",
    "slug": "tourmaster",
    "type": "plugin",
    "affected_version": "[*, 5.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-32923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32923",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Starter Templates \u003c= 3.2.4 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "astra-sites",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41804",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Starter Templates \u003c= 3.2.4 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "astra-pro-sites",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41804",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Permalink Translator \u003c= 1.7.6 - Cross-Site Request Forgery",
    "slug": "wp-permalink-translator",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53274",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DX-Watermark \u003c= 1.0.4 - Cross-Site Request Forgery",
    "slug": "dx-watermark",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30560",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gutenify \u003c= 1.5.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "gutenify",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53324",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jquery news ticker \u003c= 3.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "jquery-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5430",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ITERAS \u003c= 1.8.0 - Cross-Site Request Forgery",
    "slug": "iteras",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53710",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FS Poster \u003c= 6.5.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "fs-poster",
    "type": "plugin",
    "affected_version": "* - 6.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26978",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Maps for WP \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "maps-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32179",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "404 Page by SeedProd \u003c= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "404-page",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49322",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LGPD Framework \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "lgpd-framework",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52465",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot \u003c= 1.6.2 - Cross-Site Request Forgery via update_integration_option",
    "slug": "ai-seo-translator",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54306",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Betheme \u003c= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 28.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "28.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3077",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directory Pro \u003c= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "directory-pro",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57948",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.0.6 - Incorrect Authorization Checks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-5270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5270",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Striking \u003c= 2.3.4 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "striking-r",
    "type": "theme",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37268",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WebP Converter for Media \u003c= 4.0.2 - Unauthenticated Open Redirect",
    "slug": "webp-converter-for-media",
    "type": "plugin",
    "affected_version": "[*, 4.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25074",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Free Downloads WooCommerce \u003c= 3.5.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "download-now-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27969",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 3.2.6.7 - SQL Injection",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 3.2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-6010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-6010",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Theme Duplicator \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "theme-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31845",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sign-up Sheets \u003c= 2.2.11.1 - Cross-Site Request Forgery",
    "slug": "sign-up-sheets",
    "type": "plugin",
    "affected_version": "* - 2.2.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31303",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Horizontal scrolling announcement \u003c= 9.2 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "horizontal-scrolling-announcement",
    "type": "plugin",
    "affected_version": "* - 9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4999",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Job Portal – A Complete Recruitment System for Company or Job Board website \u003c= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12132",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Content Snippet Manager \u003c= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "content-snippet-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26759",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FAT Cooming Soon \u003c= 1.1 - Unauthenticated Local File Inclusion",
    "slug": "fat-coming-soon",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32663",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Translate WordPress and go Multilingual – Weglot \u003c= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes",
    "slug": "weglot",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2124",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress \u003c= 3.4.27 - Validation Bypass via Email Field",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.4.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36175",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Menu Item Visibility Control \u003c= 0.5 - Authenticated (Admin+) Remote Code Execution",
    "slug": "menu-items-visibility-control",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24942",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket \u003c= 4.75 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-digital-content-delivery-with-drm-flickrocket",
    "type": "plugin",
    "affected_version": "* - 4.75",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.75",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12438",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Threepress \u003c= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "threepress",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13395",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FloristPress \u003c= 7.3.0 - Missing Authorization to Sensitive Data Exposure",
    "slug": "bakkbone-florist-companion",
    "type": "plugin",
    "affected_version": "* - 7.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53799",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Read more By Adam \u003c= 1.1.8 - Cross-Site Request Forgery",
    "slug": "read-more",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38085",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "School Management System \u003c= 93.2.0 - Authenticated (Student+) Arbitrary File Upload",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 93.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "93.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6079",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wordpress related Posts with thumbnails \u003c= 3.0.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "related-posts-list-grid-and-slider-all-in-one",
    "type": "plugin",
    "affected_version": "* - 3.0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31569",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Materialis Companion \u003c= 1.3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "materialis-companion",
    "type": "plugin",
    "affected_version": "* - 1.3.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4762",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39590",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arconix Shortcodes \u003c= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode",
    "slug": "arconix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10226",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Div \u003c= 3.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "floating-div",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36378",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Estate Manager \u003c= 7.3 - Unauthenticated Local File Inclusion",
    "slug": "real-estate-manager",
    "type": "plugin",
    "affected_version": "* - 7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32668",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elfsight Testimonials Slider \u003c= 1.0.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "elfsight-testimonials-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31588",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WebberZone Snippetz \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "add-to-all",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31874",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Us By Lord Linus \u003c= 2.6 - Reflected Cross-Site Scripting",
    "slug": "contact-us-by-lord-linus",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25127",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "loader-utils (JS package) \u003c 3.2.1 - Regular Expression Denial of Service",
    "slug": "simple-page-ordering",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-37603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37603",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "loader-utils (JS package) \u003c 3.2.1 - Regular Expression Denial of Service",
    "slug": "restricted-site-access",
    "type": "plugin",
    "affected_version": "* - 7.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.4",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-37603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37603",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "loader-utils (JS package) \u003c 3.2.1 - Regular Expression Denial of Service",
    "slug": "elasticpress",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-37603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37603",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "loader-utils (JS package) \u003c 3.2.1 - Regular Expression Denial of Service",
    "slug": "insert-special-characters",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-37603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37603",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "ARI Stream Quiz \u003c= 1.2.32 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ari-stream-quiz",
    "type": "plugin",
    "affected_version": "* - 1.2.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47835",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Night Mode \u003c= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "night-mode",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29418",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVGMagic \u003c= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "svgmagic",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4270",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Network Summary \u003c= 2.0.11 - Unauthenticated SQL Injection",
    "slug": "network-summary",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-2804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2804",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Async JavaScript \u003c= 2.19.07.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "async-javascript",
    "type": "plugin",
    "affected_version": "[*, 2.20.02.27)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.02.27",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36854",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "tarteaucitron.io \u003c= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tarteaucitronjs",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4955",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Locatoraid Store Locator \u003c= 3.9.30 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "locatoraid",
    "type": "plugin",
    "affected_version": "* - 3.9.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30181",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 3.9.6 - Cross-Site Request Forgery to Product Limit Update",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3203",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woffice \u003c= 5.4.21 - Authentication Bypass via Registration Role",
    "slug": "woffice",
    "type": "theme",
    "affected_version": "* - 5.4.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.21",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2798",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEUR Oficial \u003c= 2.2.10.2 - Unauthenticated SQL Injection",
    "slug": "seur",
    "type": "plugin",
    "affected_version": "* - 2.2.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.10.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9201",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Javo Core \u003c= 3.0.0.266 - Cross-Site Request Forgery",
    "slug": "javo-core",
    "type": "plugin",
    "affected_version": "* - 3.0.0.266",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0.266",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60111",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-UserOnline \u003c= 2.88.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-useronline",
    "type": "plugin",
    "affected_version": "* - 2.88.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.88.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5560",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.4.2 - Missing Authorization Checks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2012-4422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4422",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Landing Page Cat \u003c= 1.7.8 - Reflected Cross-Site Scripting",
    "slug": "landing-page-cat",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26992",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flynax Bridge \u003c= 2.2.0 - Unauthenticated Arbitrary User Deletion",
    "slug": "flynax-bridge",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4177",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pearl \u003c= 1.3.9 - Missing Authorization",
    "slug": "pearl-header-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31881",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple JWT Login \u003c= 3.2.1 - Insecure Password Creation",
    "slug": "simple-jwt-login",
    "type": "plugin",
    "affected_version": "[*, 3.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24998",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Apptivo Business Site CRM \u003c= 5.3 - Cross-Site Request Forgery to IP Address Block",
    "slug": "apptivo-business-site",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13405",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "B-Banner Slider \u003c= 1.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "b-banner-slider",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52405",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "bunny.net – WordPress CDN Plugin \u003c= 2.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bunnycdn",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31361",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ActiveCampaign – Forms, Site Tracking, Live Chat \u003c= 8.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "activecampaign-subscription-forms",
    "type": "plugin",
    "affected_version": "* - 8.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0233",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Delete Revision \u003c= 1.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "better-delete-revision",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37412",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Realbig \u003c= 1.0.6 - Cross-Site Request Forgery",
    "slug": "realbig-media",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41694",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Events Addon for Elementor \u003c= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "events-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4669",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons \u003c= 24.0.3 - Unauthenticated SQL Injection",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 24.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10687",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Builder: Live Composer \u003c= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "live-composer-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4669",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blackhole for Bad Bots \u003c= 3.3.1 - Arbitrary IP Address Blocking via IP Spoofing",
    "slug": "blackhole-bad-bots",
    "type": "plugin",
    "affected_version": "[*, 3.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-1165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1165",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Hummingbird \u003c= 3.3.1 - Admin+ Stored Cross-Site Scripting",
    "slug": "hummingbird-performance",
    "type": "plugin",
    "affected_version": "[*, 3.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0994",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All In One Favicon \u003c= 4.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "all-in-one-favicon",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-13832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-13832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker – Best WordPress Survey Plugin \u003c= 3.6.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-34423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34423",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Mask \u003c= 1.8.5.2 - Authenticated (Author+) Insecure Direct Object Reference",
    "slug": "content-mask",
    "type": "plugin",
    "affected_version": "* - 1.8.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58012",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MailCWP \u003c= 1.100 - Arbitrary File Upload",
    "slug": "mailcwp",
    "type": "plugin",
    "affected_version": "* - 1.100",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.100",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-1000156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000156",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Limit Login Attempts Reloaded \u003c= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "limit-login-attempts-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.25.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6934",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Konami Easter Egg \u003c= v0.4 - Cross-Site Request Forgery",
    "slug": "konami-easter-egg",
    "type": "plugin",
    "affected_version": "* - v0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "v0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49425",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NV Slider \u003c= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "nv-slider",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23661",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tipsacarrier \u003c 1.5.0.5 - Missing Authorization to Order Disclosure",
    "slug": "tipsacarrier",
    "type": "plugin",
    "affected_version": "[*, 1.5.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25002",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via id parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6576",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Syndicate Out \u003c= 0.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "syndicate-out",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-43836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-43836",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CKEditor for WordPress \u003c= 4.5.3 - Reflected Cross-Site Scripting",
    "slug": "ckeditor-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9349",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 12.0.7 - Authenticated SQL Injection",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 12.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-18515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18515",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Social Login \u003c= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress-social-login",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4773",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Solid Affiliate \u003c= 1.9.1 - Sensitive Information Exposure",
    "slug": "solid-affiliate",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33637",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SoundCloud Ultimate \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "soundcloud-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30542",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Complianz - GDPR/CCPA Cookie Consent \u003c= 6.4.4 - Cross-Site Request Forgery via ajax_script_save",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33333",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Weaver Themes Shortcode Compatibility \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "weaver-themes-shortcode-compatibility",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22267",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop File Upload for Elementor Forms \u003c= 1.5.3 - Unauthenticated Arbitrary File Upload",
    "slug": "drag-and-drop-file-upload-for-elementor-forms",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49387",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WEDOS Global \u003c= 1.2.2 - Missing Authorization",
    "slug": "wgpwpp",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60130",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13730",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 6.3.0 - Stored Cross-Site Scripting",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 6.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0364",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPDash Notes \u003c= 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "wpdash-notes",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9223",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AI Twitter Feeds (Twitter widget \u0026 shortcode) \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ai-twitter-feeds",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31101",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MDC YouTube Downloader \u003c= 3.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mdc-youtube-downloader",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23639",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARMember \u003c= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0969",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.4.33 - Cross-Site Request Forgery to OAuth Service Disconnection",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.4.34)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.34",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24166",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Integration for Contact Form 7 and Salesforce \u003c= 1.3.3 - Open Redirect",
    "slug": "cf7-salesforce",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-37982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37982",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WP2LEADS \u003c= 3.3.3 - Reflected Cross-Site Scripting",
    "slug": "wp2leads",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24565",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kodex Posts likes \u003c= 2.5.0 - Reflected Cross-Site Scripting",
    "slug": "kodex-posts-likes",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8713",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.11 - Authenticated (Administrator+) SQL Injection",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "* - 4.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-38692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38692",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart \u003c= 3.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "push-monkey-desktop-push-notifications",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54386",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MaxiBlocks \u003c= 2.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update",
    "slug": "maxi-blocks",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47601",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Restaurant Menu and Food Ordering \u003c= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "menu-ordering-reservations",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1399",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nelio AB Testing \u003c 4.5.11 - Server-Side Request Forgery",
    "slug": "nelio-ab-testing",
    "type": "plugin",
    "affected_version": "[*, 4.5.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10927",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Category Template \u003c= 0.1 - Stored Cross-Site Scripting via Cross-Site Request Forgery in _form.php",
    "slug": "advanced-category-template",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31072",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post View Count \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "wp-simple-post-view",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44996",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Waiting: One-click countdowns \u003c= 0.6.2 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "waiting",
    "type": "plugin",
    "affected_version": "* - 0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2757",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Instapage Plugin \u003c= 3.5.12 - Cross-Site Request Forgery",
    "slug": "instapage",
    "type": "plugin",
    "affected_version": "* - 3.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60115",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woo Products Widgets For Elementor \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross Site Scripting",
    "slug": "woo-products-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4661",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.4.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10873",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BadgeOS \u003c= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries",
    "slug": "badgeos",
    "type": "plugin",
    "affected_version": "* - 3.7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2174",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Yuzo Related Posts \u003c= 5.12.93 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "yuzo-related-post",
    "type": "plugin",
    "affected_version": "[*, 5.12.94)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.94",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-11869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11869",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Recount Earnings \u003c= 1.0.2 - Cross-Site Scripting",
    "slug": "edd-recount-earnings",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9524",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ALO EasyMail Newsletter \u003c= 2.6.00 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "alo-easymail",
    "type": "plugin",
    "affected_version": "[*, 2.6.01)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.01",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9409",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CopySafe Web Protection \u003c= 3.15 - Reflected Cross-Site Scripting",
    "slug": "wp-copysafe-web",
    "type": "plugin",
    "affected_version": "* - 3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38781",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flexmls® IDX \u003c= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "flexmls-idx",
    "type": "plugin",
    "affected_version": "* - 3.14.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0863",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DirectoryPress \u003c= 3.6.19 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "directorypress",
    "type": "plugin",
    "affected_version": "* - 3.6.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49633",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slider by 10Web \u003c= 1.2.35 - SQL Injection",
    "slug": "slider-wd",
    "type": "plugin",
    "affected_version": "* - 1.2.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.35",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24132",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CSS3 Compare Pricing Tables for WordPress \u003c= 11.6 - Reflected Cross-Site Scripting",
    "slug": "css3_web_pricing_tables_grids",
    "type": "plugin",
    "affected_version": "* - 11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47554",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wordpress Clicksold IDX Plugin \u003c= 1.90 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "clicksold-wordpress-plugin",
    "type": "plugin",
    "affected_version": "* - 1.90",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.90",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7769",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow Gallery \u003c= 1.7.8 - Authenticated (Contributor+) SQL Injection",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31355",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "UltraAddons Elementor Lite \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultraaddons-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48131",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eMember \u003c= 10.6.6 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']",
    "slug": "wp-eMember",
    "type": "plugin",
    "affected_version": "* - 10.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5744",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery – Photo Albums Plugin \u003c 1.3.47 - Cross-Site Scripting",
    "slug": "easy-media-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.3.50)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.50",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-7386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7386",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.24",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.22",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.31",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.19",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.18",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.7",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.2",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.32",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.31",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.28",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.10",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.4",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.1",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.23",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.6",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.14",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.15",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.34",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Reflected Cross-Site Scripting via Global Variables",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.34",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Image Sizes \u003c= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-image-sizes",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24810",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Delete Original Image \u003c= 0.4 - Cross-Site Request Forgery",
    "slug": "delete-original-image",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28863",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c= 3.4.2 - Reflected Cross-Site Scripting",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[*, 3.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9359",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Event Planner \u003c= 1.5.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "simple-event-planner",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25611",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LegalWeb Cloud \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "legalweb-cloud",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11761",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Payment gateway per Product for WooCommerce \u003c= 3.2.7 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-product-payments",
    "type": "plugin",
    "affected_version": "[*, 3.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44144",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Processing Projects \u003c= 1.0.2 - Authenticated (Shop Manager+) Arbitrary File Upload",
    "slug": "processing-projects",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32206",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Heartland Management Terminal \u003c= 1.3. 0 - Reflected Cross-Site Scripting",
    "slug": "heartland-management-terminal",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23520",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3162",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Push Envoy Notifications \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "push-envoy",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23556",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Get Your Number \u003c= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "get-your-number",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2634",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Templately \u003c= 3.1.2 - Missing Authorization",
    "slug": "templately",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47308",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FULL Customer \u003c= 3.1.25 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "full-customer",
    "type": "plugin",
    "affected_version": "* - 3.1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54313",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer \u003c= 3.10.2 - Missing Authorization",
    "slug": "smartcrawl-seo",
    "type": "plugin",
    "affected_version": "* - 3.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3287",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Post Columns \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-post-columns",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5708",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6958",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP RealEstate \u003c= 1.6.26 - Unauthenticated Privilege Escalation via 'process_register'",
    "slug": "wp-realestate",
    "type": "plugin",
    "affected_version": "* - 1.6.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2237",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Travel Engine \u003c= 6.3.5 - Unauthenticated Local File Inclusion",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 6.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30870",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SP Project \u0026 Document Manager \u003c= 4.59 - Reflected Cross-Site Scripting",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-34857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34857",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CC Canadian Mortgage Calculator \u003c= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cc-canadian-mortgage-calculator",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11383",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ATT YouTube Widget \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "att-youtube",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48359",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF for WPForms + Drag and Drop Template Builder \u003c= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab Shortcode",
    "slug": "pdf-for-wpforms",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12593",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup Migration \u003c= 1.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36884",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Black Widgets For Elementor \u003c= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "black-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31869",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Landing Page Cat – Coming Soon Page, Maintenance Page \u0026 Squeeze Pages \u003c= 1.7.6 - Reflected Cross-Site Scripting",
    "slug": "landing-page-cat",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9226",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder Addons by WPZOOM \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget",
    "slug": "wpzoom-addons-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2187",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PropertyHive \u003c= 2.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35701",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Manager \u003c= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "* - 7.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1538",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress GDPR \u0026 CCPA \u003c= 1.9.26 Reflected Cross-Site Scripting",
    "slug": "wordpress-gdpr",
    "type": "plugin",
    "affected_version": "[*, 1.9.27)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.27",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0220",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "School Management System – SakolaWP \u003c= 1.0.8 - Cross-Site Request Forgery to Exam Setting Manipulation",
    "slug": "sakolawp-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13647",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.3.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4431",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Menu Duplicator \u003c= 1.0 - Missing Authorization",
    "slug": "copy-menu",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30543",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form builder with drag \u0026 drop for WordPress – Kali Forms \u003c= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation",
    "slug": "kali-forms",
    "type": "plugin",
    "affected_version": "* - 2.3.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.41",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1217",
    "auth_type": "Auth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"
  },
  {
    "title": "WP Dialog \u003c= 1.2.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-dialog",
    "type": "plugin",
    "affected_version": "* - 1.2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24600",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Academy LMS – eLearning and online course solution for WordPress \u003c= 1.9.19 -  Authenticated (Subscriber+) Privilege Escalation",
    "slug": "academy",
    "type": "plugin",
    "affected_version": "* - 1.9.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1505",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dan's Embedder for Google Calendar \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "dans-gcal",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51504",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Transcoder \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "transcoder",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58209",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Export \u0026 Order Import for WooCommerce \u003c= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function",
    "slug": "order-import-export-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13920",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Plugin Security Scanner \u003c= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "plugin-security-scanner",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57950",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Fancybox \u003c= 1.8.17 - Authenticated Stored Cross-Site Scripting",
    "slug": "easy-fancybox",
    "type": "plugin",
    "affected_version": "* - 1.8.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16524",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewsMash \u003c= 1.0.71 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "newsmash",
    "type": "theme",
    "affected_version": "* - 1.0.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10849",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Security Policy Pro \u003c= 1.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "content-security-policy-pro",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23820",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cornerstone \u003c= 0.8.0 - Reflected Cross-Site Scripting via PHP_SELF",
    "slug": "cornerstone",
    "type": "plugin",
    "affected_version": "* - 0.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32570",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flexi \u003c= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode",
    "slug": "flexi",
    "type": "plugin",
    "affected_version": "* - 4.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9129",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KiviCare – Clinic \u0026 Patient Management System (EHR) \u003c= 3.2.0 - Sensitive Information Exposure",
    "slug": "kivicare-clinic-management-system",
    "type": "plugin",
    "affected_version": "3.2.0",
    "from_version": "3.2.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2623",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simply Static \u003c= 3.1.3 - Unauthenticated Information Exposure",
    "slug": "simply-static",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32825",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 5.1.0 - Cross-Site Request Forgery",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-44737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44737",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.68 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "[*, 0.9.69)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.69",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24994",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Libro de Reclamaciones y Quejas \u003c= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "libro-de-reclamaciones-y-quejas",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32113",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LayerSlider 7.9.11 - 7.10.0 - Unauthenticated SQL Injection",
    "slug": "LayerSlider",
    "type": "plugin",
    "affected_version": "7.9.11 - 7.10.0",
    "from_version": "7.9.11",
    "from_inclusive": true,
    "to_version": "7.10.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-2879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2879",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Activity Tracking and Log \u003c= 4.1.3 - IP Spoofing",
    "slug": "user-activity-tracking-and-log",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0970",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Solace Extra \u003c= 1.3.1 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "solace-extra",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47464",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MC Woocommerce Wishlist \u003c= 1.9.1 - Reflected Cross-Site Scripting",
    "slug": "smart-wishlist-for-more-convert",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47487",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.1.19 - Reflected Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.1.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.20",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24306",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "No External Links \u003c= 5.1.6.2 - Cross-Site Request Forgery",
    "slug": "mihdan-no-external-links",
    "type": "plugin",
    "affected_version": "* - 5.1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53451",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Magical Addons For Elementor \u003c= 1.1.41 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "magical-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38730",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailChimp Forms by MailMunch \u003c= 3.2.1 - Cross-Site Request Forgery",
    "slug": "mailchimp-forms-by-mailmunch",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31378",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spiderpowa Embed PDF \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spiderpowa-embed-pdf",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23807",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Planification \u003c= 2.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-planification",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32484",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Webcam Video Conference \u003c= 4.91.8 - Unrestricted File Upload leading to Remote Code Execuction",
    "slug": "videowhisper-video-conference-integration",
    "type": "plugin",
    "affected_version": "* - 4.91.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.91.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9271",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate YouTube Video \u0026 Shorts Player With Vimeo \u003c= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion",
    "slug": "ultimate-youtube-video-player",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11354",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) \u003c= 5.1.2 - Cross-Site Scripting",
    "slug": "google-analytics-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2014-9174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9174",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Melapress File Monitor \u003c= 2.1.0 - Authenticated (Admin+) Authenticated SQL Injection",
    "slug": "website-file-changes-monitor",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9879",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Easy Site Importer \u003c= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change",
    "slug": "easy-site-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56004",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript \u003c= 2.1.1 - Reflected Cross-Site Scripting",
    "slug": "searchpro",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9344",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel Engine – Tour Booking Plugin – Tour Operator Software \u003c= 6.6.7 - Unauthenticated Local File Inclusion",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 6.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7634",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TH Advance Product Search \u003c= 1.1.4 - Missing Authorization to Plugin Settings Change",
    "slug": "th-advance-product-search",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40218",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "DirectoryPress – Business Directory And Classified Ad Listing \u003c= 3.6.7 - Reflected Cross-Site Scripting",
    "slug": "directorypress",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32567",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup Migration \u003c= 1.3.7 - Unauthenticated Remote Code Execution",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6553",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bootstrap Ultimate \u003c= 1.4.9 - Unauthenticated Limited Local File Inclusion",
    "slug": "bootstrap-ultimate",
    "type": "theme",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13545",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 Email Add on \u003c= 1.9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "cf7-email-add-on",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10898",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c= 8.5.2 - Cross-Site Request Forgery",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "* - 8.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22155",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slider Revolution \u003c= 6.7.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.7.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8107",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.102 - Reflected Cross-Site Scripting",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.102",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.102",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43915",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "SiteOrigin Widgets Bundle \u003c 1.51.0 - Authenticated (Admin+) Local File Inclusion",
    "slug": "so-widgets-bundle",
    "type": "plugin",
    "affected_version": "* - 1.50.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.50.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6295",
    "auth_type": "Privileged",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Himer \u003c= 2.1.0 - Cross-Site Request Forgery to Poll Voting",
    "slug": "himer",
    "type": "theme",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2235",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Code Embed \u003c= 2.3.6 - Authenticated(Contributor+) Denial of Service",
    "slug": "simple-embed-code",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49837",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Apollo13 Framework Extensions \u003c= 1.9.1 - Cross-Site Request Forgery",
    "slug": "apollo13-framework-extensions",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51539",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Memberful \u003c= 1.73.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "memberful-wp",
    "type": "plugin",
    "affected_version": "* - 1.73.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.73.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11294",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPBakery Page Builder Clipboard \u003c= 4.5.5 - Stored Cross-Site Scripting",
    "slug": "vc_clipboard",
    "type": "plugin",
    "affected_version": "[*, 4.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24243",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress/Plugin Upgrade Time Out Plugin \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wordpressplugin-upgrade-time-out-plugin",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8243",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "flickrRSS \u003c= 5.3.1 - Cross-Site Request Forgery",
    "slug": "flickr-rss",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-6467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6467",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator \u003c= 1.42.0 - Order Replay Vulnerability",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.42.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.42.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3479",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventON \u003c= 2.1 - Insecure Direct Object Reference to Unauthorized Post Access",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3219",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "EventON \u003c= 2.1 - Insecure Direct Object Reference to Unauthorized Post Access",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "[*, 4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-3219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3219",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Dynamics 365 Integration \u003c= 1.3.12 - Missing Authorization via wp_ajax_wpcrm_log \u0026 wp_ajax_wpcrm_log_verbosity",
    "slug": "integration-dynamics",
    "type": "plugin",
    "affected_version": "* - 1.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28417",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Card Elements for Elementor \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widget",
    "slug": "card-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13734",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.11 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24385",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tijaji \u003c= 1.43 - Reflected Cross-Site Scripting",
    "slug": "tijaji",
    "type": "theme",
    "affected_version": "* - 1.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23983",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sandbox \u003c= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download",
    "slug": "sandbox",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13367",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "KK I Like It \u003c= 1.7.5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "kk-i-like-it",
    "type": "plugin",
    "affected_version": "* - 1.7.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31443",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-PManager \u003c= 1.2 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-programmmanager",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2248",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Build App Online \u003c= 1.0.18 - Unauthenticated SQL Injection",
    "slug": "build-app-online",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3241",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Review Slider \u003c 11.0 - SQL Injection",
    "slug": "wp-facebook-reviews",
    "type": "plugin",
    "affected_version": "[*, 11.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0383",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "m1.DownloadList \u003c= 0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "m1downloadlist",
    "type": "plugin",
    "affected_version": "* - 0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26895",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YaDisk Files \u003c= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-yadisk-files",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10710",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Daily Prayer Time \u003c= 2024.08.26 - Authenticated (Contributor+) SQL Injection",
    "slug": "daily-prayer-time-for-mosques",
    "type": "plugin",
    "affected_version": "* - 2024.08.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.08.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8621",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Gallery Styles \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gallery-styles",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1783",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "App Builder \u003c= 3.8.7 - Open Redirection",
    "slug": "app-builder",
    "type": "plugin",
    "affected_version": "* - 3.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31282",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Address Autocomplete via Google for Gravity Forms \u003c= 1.3.4 - Cross-Site Request Forgery",
    "slug": "gf-google-address-autocomplete",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53263",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Arconix Shortcodes \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "arconix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DupeOff \u003c= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dupeoff",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-26529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26529",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "HTML Forms \u003c= 1.3.28 - Authenticated (Administrator+) Cross-Site Scripting",
    "slug": "html-forms",
    "type": "plugin",
    "affected_version": "* - 1.3.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50836",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GivingPress Lite \u003c= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "givingpress-lite",
    "type": "theme",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43352",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meks ThemeForest Smart Widget \u003c= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "meks-themeforest-smart-widget",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33694",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LeadSquared Suite \u003c= 0.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "leadsquared-suite",
    "type": "plugin",
    "affected_version": "* - 0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45833",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Allow PHP in Posts and Pages \u003c= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode",
    "slug": "allow-php-in-posts-and-pages",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-4994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4994",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Amministrazione Trasparente \u003c= 7.1 - Cross-Site Request Forgery Bypass",
    "slug": "amministrazione-trasparente",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4398",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Premmerce Redirect Manager \u003c= 1.0.10 - Cross-Site Request Forgery via deleteRedirect()",
    "slug": "premmerce-redirect-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23787",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Login Logout Register Menu \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "login-logout-register-menu",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33932",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ads24 Lite \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-ad-management",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23458",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz and Survey Master (QSM)  \u003c= 9.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 9.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10679",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Cookies Policy \u003c= 1.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "easy-cookies-policy",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24405",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Void Elementor Post Grid Addon for Elementor Page builder \u003c= 2.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "void-elementor-post-grid-addon-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43281",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NGG Smart Image Search \u003c= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ngg-smart-image-search",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58027",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WCFM Membership \u003c= 2.10.0 - Missing Authorization",
    "slug": "wc-multivendor-membership",
    "type": "plugin",
    "affected_version": "* - 2.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4940",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Radio – Worldwide Online Radio Stations Directory for WordPress \u003c= 3.1.9 - Missing Authorization via multiple AJAX actions",
    "slug": "wp-radio",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classiera \u003c= 4.0.34 - Unauthenticated SQL Injection",
    "slug": "classiera",
    "type": "theme",
    "affected_version": "* - 4.0.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52722",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Plugin Oficial – Getnet para WooCommerce \u003c= 1.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wc-checkout-getnet",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1289",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Beaver Builder – Lite \u003c= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget",
    "slug": "ultimate-addons-for-beaver-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2141",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bluff Post \u003c= 1.1.1 - Cross-Site Request Forgery",
    "slug": "bluff-post",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52784",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WassUp Real Time Analytics \u003c= 1.9.4.5 - Unauthenticated Stored Cross-Site Scripting via IP",
    "slug": "wassup",
    "type": "plugin",
    "affected_version": "* - 1.9.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5653",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBakery Visual Composer \u003c= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1840",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.18",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.16",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.15",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.12",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.8",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.7",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.3",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.18",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.15",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.6",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Bypass URL Validation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.2",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Text Widget  \u003c= 2.1.2 - Missing Authorization via atw_dismiss_admin_notice",
    "slug": "advanced-text-widget",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26520",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hotel Booking Lite \u003c= 4.8.4 - Insufficient Path Validation to Unauthenticated Arbitrary File Deletion and Download",
    "slug": "motopress-hotel-booking-lite",
    "type": "plugin",
    "affected_version": "[*, 4.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-5991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5991",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Delete Post Revisions In WordPress \u003c= 4.6 - Cross-Site Request Forgery",
    "slug": "delete-post-revisions-on-single-click",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48754",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hospital Management System \u003c= 47.0(20-11-2023) - Reflected Cross-Site Scripting",
    "slug": "hospital-management",
    "type": "plugin",
    "affected_version": "[*, 47.0(20-11-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "47.0(20-11-2023)",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39393",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eCommerce \u003c= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation",
    "slug": "wp-e-commerce",
    "type": "plugin",
    "affected_version": "* - 3.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.15.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1516",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8546",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Google Maps \u003c= 5.8.4 - Missing Authorization",
    "slug": "wp-google-map-gold",
    "type": "plugin",
    "affected_version": "* - 5.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39465",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Listingo - Business Listing and Directory WordPress Theme \u003c= 3.2.7 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "listingo",
    "type": "theme",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13815",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Super Popup \u003c= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-super-popup",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47598",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Oxygen MyData for WooCommerce \u003c= 1.0.64 - Unauthenticated Arbitrary File Deletion",
    "slug": "oxygen-mydata",
    "type": "plugin",
    "affected_version": "* - 1.0.64",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.64",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32631",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "PDF.js Viewer \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "pdfjs-viewer-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4670",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Job Manager \u003c= 2.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title",
    "slug": "js-jobs",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25963",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Indeed Membership Pro 7.3 - 8.6 - Missing Authorization Checks",
    "slug": "indeed-membership-pro",
    "type": "plugin",
    "affected_version": "7.3 - 8.6",
    "from_version": "7.3",
    "from_inclusive": true,
    "to_version": "8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36833",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "LadiApp \u003c= 4.4 - Cross-Site Request Forgery via save_config()",
    "slug": "ladipage",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4629",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Strx Magic Floating Sidebar Maker \u003c= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "strx-magic-floating-sidebar-maker",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23827",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FuseDesk \u003c= 6.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fusedesk",
    "type": "plugin",
    "affected_version": "* - 6.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13459",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pods \u003c= 2.9.10.2 - Cross-Site Request Forgery",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "* - 2.9.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.10.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23790",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3018",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Optin Forms \u003c= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "optin-forms",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29434",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 8.1.1 \u0026 WooCommerce Blocks \u003c= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "* - 8.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 8.1.1 \u0026 WooCommerce Blocks \u003c= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute",
    "slug": "woo-gutenberg-products-block",
    "type": "plugin",
    "affected_version": "* - 11.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing table addon for elementor \u003c= 1.0.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "pricing-table-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52499",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Age Gate \u003c= 2.17.0 - Cross-Site Scripting via Data Import",
    "slug": "age-gate",
    "type": "plugin",
    "affected_version": "* - 2.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36901",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.34.0 - Reflected Cross-Site Scripting",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.34.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.34.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45625",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Evergreen Content Poster \u003c= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "evergreen-content-poster",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41127",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yoast SEO \u003c= 17.2 - Full Path Disclosure",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "[*, 17.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25118",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.18",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.18",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.12",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.8",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.7",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.6",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.2",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.16",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.15",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.15",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.3",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVS Pricing Tables \u003c= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation",
    "slug": "svs-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2959",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Inventory Manager \u003c= 2.3.4 - Cross-Site Request Forgery",
    "slug": "wp-inventory-manager",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ajax Contact Form \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fws-ajax-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22761",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "404 Solution \u003c= 2.35.19 - Reflected Cross-Site Scripting",
    "slug": "404-solution",
    "type": "plugin",
    "affected_version": "* - 2.35.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.35.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11277",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woffice Core \u003c= 5.4.26 - Authenticated (Contributor+) Arbitrary File Deletion",
    "slug": "woffice-core",
    "type": "plugin",
    "affected_version": "* - 5.4.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7694",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Smart Mockups \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-mockups",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50537",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML Forms – Simple WordPress Forms \u003c= 1.3.32 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "html-forms",
    "type": "plugin",
    "affected_version": "* - 1.3.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6243",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management System – WPSchoolPress \u003c= 2.1.16 - Stored Cross-Site Scripting",
    "slug": "wpschoolpress",
    "type": "plugin",
    "affected_version": "[*, 2.1.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24664",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant \u0026 Cafe Addon for Elementor \u003c= 1.5.9 - Authenticated (Contributor+) Post Disclosure",
    "slug": "restaurant-cafe-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10780",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FireDrum Email Marketing \u003c= 1.64 - Reflected Cross-Site Scripting",
    "slug": "firedrum-email-marketing",
    "type": "plugin",
    "affected_version": "* - 1.64",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.64",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31018",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 5.0.26 - Missing Authorization",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 5.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57896",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Crelly Slider \u003c= 1.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "crelly-slider",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33542",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "5 star review funnel for Google Reviews, Trustpilot, ProvenExpert and more | RRatingg \u003c= 1.2.67 - Missing Authorization",
    "slug": "5-stars-rating-funnel",
    "type": "plugin",
    "affected_version": "[*, 1.3.02)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.02",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-31358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31358",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Course Redirects for Learndash Plugin \u003c= 0.4 - Cross-Site Request Forgery",
    "slug": "course-redirects-for-learndash",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10376",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pay With Tweet \u003c= 1.1 - Authenticated SQL Injection",
    "slug": "pay-with-tweet",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-5350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5350",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPVN \u003c= 0.7.8 - Cross-Site Request Forgery",
    "slug": "wpvn-username-changer",
    "type": "plugin",
    "affected_version": "* - 0.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46462",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Force First and Last Name as Display Name \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "force-first-last",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28419",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PayTR Taksit Tablosu \u003c= 1.3.1 - Missing Authorization",
    "slug": "paytr-taksit-tablosu-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47847",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Global Translator \u003c= 2.0.2 - Cross-Site Request Forgery",
    "slug": "global-translator",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30632",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shipping with Venipak for WooCommerce \u003c= 1.19.5 - Reflected Cross-Site Scripting via 'venipak_labels_link'",
    "slug": "wc-venipak-shipping",
    "type": "plugin",
    "affected_version": "* - 1.19.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29805",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14947",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CheckBot \u003c= 1.05 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "checkbot",
    "type": "plugin",
    "affected_version": "* - 1.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-43840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-43840",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JupiterX Core \u003c= 4.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 4.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58264",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anti-Spam by CleanTalk \u003c 5.149 - Authenticated SQL Injection",
    "slug": "cleantalk-spam-protect",
    "type": "plugin",
    "affected_version": "[*, 5.149)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.149",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24131",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks – Page Builder Features \u003c= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3189",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "AWcode Toolkit \u003c= 1.0.14 - Reflected Cross-Site Scripting",
    "slug": "awcode-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24554",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Privacy Policy Generator, Terms \u0026 Conditions Generator WordPress Plugin : WP Legal Pages \u003c= 3.2.7 - Cross-Site Request Forgery",
    "slug": "wplegalpages",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12636",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spectra Pro \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block IDs",
    "slug": "spectra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3827",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail Mint \u003c= 1.18.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "mail-mint",
    "type": "plugin",
    "affected_version": "* - 1.18.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58604",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "EZ SQL Reports Shortcode Widget and DB Backup \u003c= 5.25.08 - Cross-Site Request Forgery",
    "slug": "elisqlreports",
    "type": "plugin",
    "affected_version": "* - 5.25.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.25.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30788",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Just Post Preview Widget \u003c= 1.1.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "just-post-preview",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32156",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Dashboard Widgets \u003c= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via cdw_DashboardWidgets",
    "slug": "custom-dashboard-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22290",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N"
  },
  {
    "title": "Add Shortcodes Actions And Filters \u003c= 2.0.9 - Reflected Cross-Site Scripting",
    "slug": "add-actions-and-filters",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46072",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon – Under Construction \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "coming-soons",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1322",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conditional Fields for Contact Form 7 \u003c= 2.4.13 - Cross-Site Request Forgery to Plugin Setting Reset",
    "slug": "cf7-conditional-fields",
    "type": "plugin",
    "affected_version": "* - 2.4.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5804",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zoho Creator Forms \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zohocreator",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46453",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Realty Portal – Agent \u003c= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function",
    "slug": "realty-portal-agent",
    "type": "plugin",
    "affected_version": "* - 0.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6190",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS \u003c= 2.7.6 - Unauthenticated SQL Injection via rating_filter",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10400",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Sinking Dropdowns \u003c= 1.25 - Cross-Site Request Forgery",
    "slug": "sinking-dropdowns",
    "type": "plugin",
    "affected_version": "* - 1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56204",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Awesome Support – WordPress HelpDesk \u0026 Support Plugin \u003c= 6.0.13 - Cross-Site Scripting via post_title",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20181",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schema App Structured Data \u003c= 1.22.3 - Missing Authorization via page_init",
    "slug": "schema-app-structured-data-for-schemaorg",
    "type": "plugin",
    "affected_version": "* - 1.22.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44258",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FCChat Widget \u003c 2.2.13.7 - Arbitrary File Upload",
    "slug": "fcchat",
    "type": "plugin",
    "affected_version": "[*, 2.2.13.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.13.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-3578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3578",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Name Directory \u003c= 1.17.4 - Cross-Site Request Forgery",
    "slug": "name-directory",
    "type": "plugin",
    "affected_version": "* - 1.17.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20652",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light \u003c= 2.4.37 - Unauthenticated SQL Injection",
    "slug": "excel-like-price-change-for-woocommerce-and-wp-e-commerce-light",
    "type": "plugin",
    "affected_version": "* - 2.4.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48122",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Opensea \u003c= 1.0.2 - Cross-Site Scripting",
    "slug": "opensea",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1228",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Activity Reactions For Buddypress \u003c= 1.0.22 - Cross-Site Request Forgery",
    "slug": "activity-reactions-for-buddypress",
    "type": "plugin",
    "affected_version": "* - 1.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45074",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zoho Campaigns \u003c= 2.0.7 - Cross-Site Request Forgery via zcwc_integration_disconnect",
    "slug": "zoho-campaigns",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32442",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LuckyWP Table of Contents \u003c= 2.1.5 - Authenticated (Administrator+) Cross-Site Scripting",
    "slug": "luckywp-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6487",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Registration – Tailored tool for seamless login and invitation-based registrations \u003c= 2.5.6 - Open Redirect",
    "slug": "cm-invitation-codes",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11167",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Profile Widget Ninja \u003c= 4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "profile-widget-ninja",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27320",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c= 2.1.7 - Cross-Site Scripting",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "[*, 2.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5670",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Namaste! LMS \u003c= 2.6.5 - Cross-Site Request Forgery",
    "slug": "namaste-lms",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27353",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.1 - Authentication Bypass to Administrator",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2437",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YOP Poll \u003c= 6.1.1 - Reflected Cross-Site Scripting",
    "slug": "yop-poll",
    "type": "plugin",
    "affected_version": "[*, 6.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24885",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "POST SMTP Mailer \u003c= 2.8.6 - Reflected Cross-Site Scripting via msg",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6629",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-in-one Like Widget \u003c= 2.2.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "all-in-one-facebook-like-widget",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32815",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Local Pickup for WooCommerce \u003c= 1.5.2 - Missing Authorization",
    "slug": "advanced-local-pickup-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40702",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Automated Editor \u003c= 1.3 - Cross-Site Request Forgery via admin menu pages",
    "slug": "automated-editor",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45276",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Google Maps \u003c= 8.1.12 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "[*, 8.1.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-36870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36870",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management \u003c= 91.5.0 - Authenticated (Student+) Arbitrary File Upload",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 91.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "91.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9660",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mags \u003c= 1.1.6 - Unauthenticated Local File Inclusion",
    "slug": "mags",
    "type": "theme",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49701",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Event Planner plugin \u003c= 1.5.4 - Cross-Site Scripting",
    "slug": "simple-event-planner",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25612",
    "auth_type": "Auth",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Elite Booster for WooCommerce  \u003c= 7.1.7 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "booster-elite-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 7.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1986",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Frontend Dashboard \u003c= 2.2.2 - Sensitive Information Exposure",
    "slug": "frontend-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32726",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Post Ideas \u003c= 2 - Unauthenticated SQL Injection",
    "slug": "post-ideas",
    "type": "plugin",
    "affected_version": "* - 2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52451",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Link Directory Pro \u003c= 14.7.3 - Missing Authorization",
    "slug": "qc-simple-link-directory",
    "type": "plugin",
    "affected_version": "* - 14.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32296",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0689",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Travel Gutenberg Blocks \u003c= 3.9.0 - Unauthenticated Local File Inclusion",
    "slug": "wp-travel-blocks",
    "type": "plugin",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53207",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Customer Area \u003c= 8.1.3 - Cross-Site Request Forgery",
    "slug": "customer-area",
    "type": "plugin",
    "affected_version": "* - 8.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4745",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Plus Addons for Elementor Page Builder \u003c= 4.1.10 - Open Redirect",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "[*, 4.1.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24359",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fancy Product Designer \u003c 6.1.81 - Authenticated (Admin+) Stored Cross-Site Scripting via Product Title",
    "slug": "fancy-product-designer",
    "type": "plugin",
    "affected_version": "[*, 6.1.81)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.81",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-0902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0902",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Store Locator for WordPress with Google Maps – LotsOfLocales \u003c= 3.98.10 - Unauthenticated Local File Inclusion",
    "slug": "store-locator",
    "type": "plugin",
    "affected_version": "* - 3.98.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.98.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23422",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Docs \u003c= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id'",
    "slug": "wp-docs",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12635",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.25.1 - Unauthenticated CSV Injection",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-22719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22719",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Click to Chat \u003c= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter",
    "slug": "click-to-chat-for-whatsapp",
    "type": "plugin",
    "affected_version": "* - 4.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5336",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Manager \u003c= 1.7.2 - Authenticated Remote Command Execution",
    "slug": "wordpress-form-manager",
    "type": "plugin",
    "affected_version": "[*, 1.7.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-7806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7806",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FG Drupal to WordPress \u003c= 3.67.0 - Cross-Site Request Forgery via ajax_importer",
    "slug": "fg-joomla-to-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24837",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FG Drupal to WordPress \u003c= 3.67.0 - Cross-Site Request Forgery via ajax_importer",
    "slug": "fg-prestashop-to-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.44.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.44.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24837",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FG Drupal to WordPress \u003c= 3.67.0 - Cross-Site Request Forgery via ajax_importer",
    "slug": "fg-drupal-to-wp",
    "type": "plugin",
    "affected_version": "* - 3.67.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.67.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24837",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EmbedPress \u003c= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1349",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complianz \u003c= 6.4.5 (Premium \u003c= 6.4.7) - Cross-Site Request Forgery",
    "slug": "complianz-gdpr-premium",
    "type": "plugin",
    "affected_version": "* - 6.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34030",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Complianz \u003c= 6.4.5 (Premium \u003c= 6.4.7) - Cross-Site Request Forgery",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34030",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pixabay Images \u003c= 2.0 - Authentication Bypass to Arbitrary File Upload",
    "slug": "pixabay-images",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-1375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1375",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Amazon Products to WooCommerce \u003c= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation",
    "slug": "import-products-to-wc",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5813",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fluid Responsive Slideshow \u003c 2.2.7 - Reflected Cross-Site Scripting",
    "slug": "fluid-responsive-slideshow",
    "type": "plugin",
    "affected_version": "[*, 2.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10975",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SlickQuiz \u003c= 1.3.7.1 - Authenticated SQL Injection",
    "slug": "slickquiz",
    "type": "plugin",
    "affected_version": "* - 1.3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-12516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12516",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Maps for WordPress \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27265",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AHAthat \u003c= 1.6 - Reflected Cross-Site Scripting",
    "slug": "ahathat",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12595",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Remote Images Grabber \u003c= 0.6 - Reflected Cross-Site Scripting",
    "slug": "remote-images-grabber",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-43832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-43832",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wilmër \u003c 3.4.2 - Unauthenticated Local File Inclusion",
    "slug": "wilmer",
    "type": "theme",
    "affected_version": "[*, 3.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-39494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39494",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Addons PRO \u003c= 2.9.0 - Sensitive Information Exposure",
    "slug": "premium-addons-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37868",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPC Smart Upsell Funnel for WooCommerce \u003c= 3.0.4 - Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "wpc-smart-upsell-funnel",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30772",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Track Page Scroll \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "track-page-scroll",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23536",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons Elementor \u003c= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49292",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Reviews \u003c 2.1.33 - PHP Object Injection",
    "slug": "ultimate-reviews",
    "type": "plugin",
    "affected_version": "[*, 2.1.33)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.33",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-36726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36726",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "School Management \u003c= 91.5.0 - Unauthenticated Arbitrary File Upload",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 91.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "91.5.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9659",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Open Graph Metabox \u003c= 1.4.4 - Cross-Site Request Forgery",
    "slug": "open-graph-metabox",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46191",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0292",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Schema Plugin For Divi, Gutenberg \u0026 Shortcodes \u003c= 4.3.2 - Authenticated (Contributor+) Object Instantiation",
    "slug": "wp-structured-data-schema",
    "type": "plugin",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7825",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Auto Delete Posts \u003c= 1.3.0 - Cross-Site Request Forgery to Arbitrary Settings Update",
    "slug": "auto-delete-posts",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1779",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Complianz - GDPR/CCPA Cookie Consent \u003c= 6.4.4 - Cross-Site Request Forgery via ajax_delete_snapshot",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33333",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Seraphinite Accelerator \u003c= 2.22.15 (2.21.13 PRO) - Authenticated (Subscriber+) Information Exposure",
    "slug": "seraphinite-accelerator",
    "type": "plugin",
    "affected_version": "* - 2.22.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.22.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54222",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Seraphinite Accelerator \u003c= 2.22.15 (2.21.13 PRO) - Authenticated (Subscriber+) Information Exposure",
    "slug": "seraphinite-accelerator-ext",
    "type": "plugin",
    "affected_version": "* - 2.21.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.21.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54222",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Tweet \u003c= 1.4.0.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "simple-tweet",
    "type": "plugin",
    "affected_version": "* - 1.4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0700",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetFormBuilder \u003c= 3.0.6 - Cross-Site Request Fogery via 'do_admin_action'",
    "slug": "jetformbuilder",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33212",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GPT AI Power \u003c= 1.4.37 - Missing Authorization",
    "slug": "gpt3-ai-content-generator",
    "type": "plugin",
    "affected_version": "* - 1.4.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0405",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "ProfileGrid  \u003c= 5.7.6 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31291",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Chatbot for WordPress \u003c= 2.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "collectchat",
    "type": "plugin",
    "affected_version": "2.3.9",
    "from_version": "2.3.9",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5691",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEOReseller Partner \u003c= 1.3.15 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "sr-partner",
    "type": "plugin",
    "affected_version": "* - 1.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23805",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Greenshift – animation and page builder blocks \u003c= 7.6.2 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 7.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6636",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import Export For WooCommerce \u003c= 1.6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "import-export-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48144",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter Subscriptions \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "newsletter-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11683",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Rich Snippets for Google \u003c= 1.8 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "rich-snippets-vevents",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-44478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44478",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mage Front End Forms \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mage-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52339",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qi Blocks \u003c= 1.3.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "qi-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49690",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slider for Writers \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "slider-for-writers",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23692",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Analytify Dashboard \u003c= 5.1.1 - Cross-Site Request Forgery",
    "slug": "wp-analytify",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47841",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Galleria \u003c= 1.0.3 - Cross-Site Request Forgery via showOptionsPage",
    "slug": "galleria",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35780",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Permalink Manager Lite \u003c= 2.5.1.3 - Unauthenticated Sensitive Information Exposure",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59010",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce Multivendor Marketplace – REST API \u003c= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API",
    "slug": "wcfm-marketplace-rest-api",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2275",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Video \u0026 Photo Gallery for Ultimate Member \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "gallery-for-ultimate-member",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12162",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Secure Copy Content Protection and Content Locking \u003c= 3.9.0 - Missing Authorization",
    "slug": "secure-copy-content-protection",
    "type": "plugin",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33587",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48288",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVPMarker  \u003c= 10.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 10.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27617",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks for Gutenberg \u003c= 4.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47385",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 4.5.5 - Unauthenticated Email Forgery",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "[*, 4.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-5780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5780",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3061",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AlphaOmega Captcha \u0026amp; Anti-Spam Filter \u003c= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "alphaomega-captcha-anti-spam",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30584",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Transposh WordPress Translation \u003c= 1.0.9.1 - Remote Code Execution",
    "slug": "transposh-translation-filter-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-25812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25812",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing \u003c= 5.0.4 - Missing Authorization",
    "slug": "wp-dark-mode",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5449",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PixelYourSite \u003c= 9.3.0 - Cross-Site Request Forgery",
    "slug": "pixelyoursite",
    "type": "plugin",
    "affected_version": "* - 9.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22700",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.1.3.1 - Stored Cross-Site Scripting via $custom_profile",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39348",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support Plus Responsive Ticket System \u003c= 4.1 - Full Path Disclosure",
    "slug": "wp-support-plus-responsive-ticket-system",
    "type": "plugin",
    "affected_version": "[*, 4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-10388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10388",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Drag And drop All Import : WP Ultimate CSV Importer \u003c= 5.6 - Cross-Site Request Forgery",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20967",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MultiPurpose \u003c= 1.2.0 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "multipurpose",
    "type": "theme",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7486",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1366",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.5.1 - Authentication Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-1930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-1930",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Awesome Event Booking \u003c= 2.7.5 - Cross-Site Request Forgery",
    "slug": "awesome-event-booking",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22669",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Folders \u003c= 8.2.0 - Reflected Cross-Site Scripting via 's'",
    "slug": "media-library-plus",
    "type": "plugin",
    "affected_version": "* - 8.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3615",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "rezo",
    "type": "theme",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30996",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "wigi",
    "type": "theme",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30996",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "edmin",
    "type": "theme",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30996",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "folo",
    "type": "theme",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30996",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "bloggie",
    "type": "theme",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30996",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "newsy",
    "type": "theme",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30996",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "sidepane",
    "type": "theme",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30996",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "slide",
    "type": "theme",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30996",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "photobox",
    "type": "theme",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30996",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks – Page Builder Features \u003c= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1999",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GenerateBlocks \u003c= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description'",
    "slug": "generateblocks",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13546",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP-dTree \u003c= 4.4.5 - Cross-Site Request Forgery",
    "slug": "wp-dtree-30",
    "type": "plugin",
    "affected_version": "* - 4.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41667",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Best Restaurant Menu by PriceListo \u003c= 1.3.1 - Cross-Site Request Forgery via menu_page",
    "slug": "best-restaurant-menu-by-pricelisto",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47649",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Predictive Search \u003c= 6.0.1 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-predictive-search",
    "type": "plugin",
    "affected_version": "* - 6.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38669",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Hour Booking \u003c= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form",
    "slug": "appointment-hour-booking",
    "type": "plugin",
    "affected_version": "* - 1.3.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.72",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4035",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP No External Links \u003c 3.5.19 - Reflected Cross-Site Scripting",
    "slug": "wp-noexternallinks",
    "type": "plugin",
    "affected_version": "[*, 3.5.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-15863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-15863",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes Finder \u003c= 1.5.4 - Reflected Cross-Site Scripting via nonce",
    "slug": "shortcodes-finder",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-21750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-21750",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce GoCardless Gateway \u003c= 2.5.6 - Unauthenticated Insecure Direct Object Reference",
    "slug": "woocommerce-gateway-gocardless",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37871",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Gutenverse News \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via elementId Parameter",
    "slug": "gutenverse-news",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5234",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon Booking Pro \u003c= 10.10.2 - Missing Authorization",
    "slug": "salon-booking-plugin-pro-cc",
    "type": "plugin",
    "affected_version": "* - 10.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32295",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Czater.pl – live chat i telefon \u003c= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "czater",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32624",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Consulting Elementor Widgets \u003c= 1.3.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "consulting-elementor-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37090",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Chat Bubble \u003c= 2.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "chat-bubble",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3415",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mendeley \u003c= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mendeleyplugin",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45073",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shopready \u003c= 3.5 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "shopready-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ElementsCSS Addons for Elementor \u003c= 1.0.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "css-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22321",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ViewMedica 9 \u003c= 1.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "viewmedica",
    "type": "plugin",
    "affected_version": "* - 1.4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13394",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NGG Smart Image Search \u003c= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ngg-smart-image-search",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47503",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InstaWP Connect \u003c= 0.1.0.8 - Authenticated (Subscriber+) Remote Code Execution",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-25918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25918",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kings Tab Slider \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kings-tab-slider",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51932",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_row",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4162",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_row",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4162",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEO Landing Page Generator \u003c= 1.66.2 - Reflected Cross-Site Scripting",
    "slug": "seo-landing-page-generator",
    "type": "plugin",
    "affected_version": "* - 1.66.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.66.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11366",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Login Control \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-login-control",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13836",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme Switcha \u003c= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "theme-switcha",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46239",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sales Page Addon – Elementor \u0026 Beaver Builder \u003c= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sales-page-addon",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51585",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "POST SMTP Mailer \u003c= 2.7.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5958",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPForms Pro \u003c= 1.7.6 - CSV Injection",
    "slug": "wpforms",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3574",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hash Elements \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hash-elements",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30426",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TinyNav \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "tinynav",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52781",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IdeaPush \u003c= 8.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "ideapush",
    "type": "plugin",
    "affected_version": "* - 8.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37265",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Auction Pro \u003c= 1.5.2 - Unauthenticated SQL Injection via 'auction_id'",
    "slug": "ultimate-woocommerce-auction-pro",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4204",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "NextGen Gallery \u003c= 1.9.7 - Cross-Site Scripting",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Youzify \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0059",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Time Validation for Gravity Forms \u003c= 1.7.0 - Reflected Cross-Site Scripting",
    "slug": "real-time-validation-for-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48329",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Logo Slideshow \u003c 1.2 - Cross-Site Scripting",
    "slug": "responsive-logo-slideshow",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-1759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1759",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YARPP – Yet Another Related Posts Plugin \u003c= 5.30.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yet-another-related-posts-plugin",
    "type": "plugin",
    "affected_version": "* - 5.30.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.30.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2433",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Encoder \u003c= 2.1.1 - Reflected Cross Site Scripting",
    "slug": "email-encoder-bundle",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Telegram Bot \u0026 Channel \u003c= 3.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "telegram-bot",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34006",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Pug \u003c= 1.30.0 - Missing Authorization via multiple admin_init actions",
    "slug": "social-pug",
    "type": "plugin",
    "affected_version": "* - 1.30.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49193",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Music Store \u003c= 1.0.41 - Cross-Site Scripting",
    "slug": "music-store",
    "type": "plugin",
    "affected_version": "* - 1.0.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10992",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Pricing Tables \u003c= 3.2.0 - Reflected Cross-Site Scripting",
    "slug": "easy-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1904",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation",
    "slug": "wpforms-lite",
    "type": "plugin",
    "affected_version": "1.8.4 - 1.9.2.1",
    "from_version": "1.8.4",
    "from_inclusive": true,
    "to_version": "1.9.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11205",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N"
  },
  {
    "title": "MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar \u003c= 4.10 - Missing Authorization to Template Import",
    "slug": "mp3-music-player-by-sonaar",
    "type": "plugin",
    "affected_version": "* - 4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47822",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "R3W InstaFeed \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "r3w-instafeed",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13678",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Ship to Multiple Addresses \u003c= 3.8.5 - Missing Authorization",
    "slug": "woocommerce-shipping-multiple-addresses",
    "type": "plugin",
    "affected_version": "* - 3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37872",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "onOffice for WP-Websites \u003c= 5.7 - Missing Authorization",
    "slug": "onoffice-for-wp-websites",
    "type": "plugin",
    "affected_version": "* - 5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Astra Widgets \u003c= 1.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "astra-widgets",
    "type": "plugin",
    "affected_version": "* - 1.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50439",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kata Plus \u003c= 1.5.3 - Missing Authorization",
    "slug": "kata-plus",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50009",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced File Manager \u003c= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale",
    "slug": "file-manager-advanced",
    "type": "plugin",
    "affected_version": "* - 5.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8704",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Grid Accordion Lite \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "grid-accordion-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11874",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-DownloadManager \u003c= 1.68.6 - Stored Cross-Site Scripting",
    "slug": "wp-downloadmanager",
    "type": "plugin",
    "affected_version": "[*, 1.68.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.68.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-25606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25606",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Popup Builder \u003c= 1.2.9 - Missing Authorization and Cross-Site Request Forgery",
    "slug": "wp-popup-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2405",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Bold Timeline Lite \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bold-timeline-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43294",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Consent Notice Box \u003c= 1.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cookie-consent-box",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32294",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Scoutnet Kalender \u003c= 1.1.0 - Cross-Site Scripting",
    "slug": "scoutnet-kalender",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19198",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.1.4.1 - Arbitrary Image Renaming",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0377",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Portfolio Builder – Portfolio Gallery \u003c= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update",
    "slug": "uber-grid",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13231",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hide My WP Ghost \u003c= 5.4.01 - Unauthenticated Local File Inclusion",
    "slug": "hide-my-wp",
    "type": "plugin",
    "affected_version": "* - 5.4.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.01",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26909",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stacks Mobile App Builder \u003c= 5.2.3 - Authentication Bypass via Account Takeover",
    "slug": "stacks-mobile-app-builder",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50477",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Profile Builder \u003c= 3.11.2 - Restricted Email Bypass",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31341",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPQA - Builder forms Addon For WordPress \u003c 5.2 - Insecure Direct Object Reference to Private Message Disclosure",
    "slug": "wpqa",
    "type": "plugin",
    "affected_version": "[*, 5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1425",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP EXtra \u003c= 6.2 - Missing Authorization to .htaccess File Modification",
    "slug": "wp-extra",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5311",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LetsRecover \u003c= 1.1.0 - Unauthenticated SQL Injection via AJAX action",
    "slug": "letsrecover-woocommerce-abandoned-cart",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4357",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder \u003c= 8.5.2 - Cross-Site Request Forgery",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52120",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Embed Optimizer \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "video-embed-optimizer",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22554",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "No Disposable Email \u003c= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "no-disposable-email",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28923",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Categorify \u003c= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxAddCategory",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "* - 1.0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1906",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ebook Store \u003c= 5.8013 - Cross-Site Request Forgery",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.8013",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8013",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54702",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "File Manager Pro \u003c= 1.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "filester",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4862",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DN Sitemap Control \u003c= 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "dn-sitemap-control",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23753",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hyperlink Group Block \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hyperlink-group-block",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31885",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UltraPress \u003c= 1.2.2 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "ultrapress",
    "type": "theme",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7434",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Church Content – Sermons, Events and More \u003c= 2.6 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "church-theme-content",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32094",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Disconnected \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "disconnected",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49268",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 1.5.1.3 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 1.5.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2005-2108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2005-2108",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HT Mega \u003c= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30182",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SMS \u003c= 6.5.2 - Reflected Cross-Site Scripting via 'page'",
    "slug": "wp-sms",
    "type": "plugin",
    "affected_version": "* - 6.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24881",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode Menu \u003c= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "shortcode-menu",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5565",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NOO Timetable \u003c= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "noo-timetable",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45821",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Code Generate \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "code-generator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49646",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Tribal \u003c= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "the-tech-tribe",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60141",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Slider \u003c= 1.6.7 - Missing Authorization",
    "slug": "adl-post-slider",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40975",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Social Widget \u003c= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-social-widget",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57981",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Filter by WBW \u003c= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend Parameter",
    "slug": "woo-product-filter",
    "type": "plugin",
    "affected_version": "* - 2.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2317",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Database for Contact Form 7, WPforms, Elementor forms \u003c= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "contact-form-entries",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Auto Poster \u003c= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion",
    "slug": "social-auto-poster",
    "type": "plugin",
    "affected_version": "* - 5.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6755",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme \u003c= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request",
    "slug": "responsive-add-ons",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13834",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Bible Embed \u003c= 0.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "bible-embed",
    "type": "plugin",
    "affected_version": "* - 0.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23513",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Capture \u0026 Lead Generation \u003c= 1.0.2 - Missing Authorization",
    "slug": "email-capture-lead-generation",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23929",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2665",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XPD Reduce Image Filesize \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "xpd-reduce-image-filesize",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54409",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mailster \u003c= 4.0.9 - Reflected Cross-Site Scripting",
    "slug": "mailster",
    "type": "plugin",
    "affected_version": "* - 4.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37433",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Editor Google Map \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "site-editor-google-map",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23466",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Include Mastodon Feed \u003c= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "include-mastodon-feed",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22660",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSS \u0026 JavaScript Toolbox \u003c= 11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "css-javascript-toolbox",
    "type": "plugin",
    "affected_version": "* - 11.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50823",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1206",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Modal \u003c 2.1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "easy-modal",
    "type": "plugin",
    "affected_version": "[*, 2.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-12946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-12946",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARForms Form Builder \u003c= 6.5 - Unauthenticated Arbitrary File Upload",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "* - 6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4620",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Post to Social Media – WordPress to Hootsuite \u003c= 1.5.9 - Cross-Site Request Forgery",
    "slug": "wp-to-hootsuite",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32267",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Local Shipping Labels for WooCommerce \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "local-shipping-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23903",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ABC Notation \u003c= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "abc-notation",
    "type": "plugin",
    "affected_version": "* - 6.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13551",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WS Form LITE – Drag \u0026 Drop Contact Form Builder for WordPress \u003c= 1.10.35 - Missing Authorization to Unauthenticated Sensitive Information Exposure",
    "slug": "ws-form",
    "type": "plugin",
    "affected_version": "* - 1.10.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3912",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Google My Business Auto Publish \u003c= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-google-my-business-auto-publish",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4790",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rebrand Fluent Forms \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "rebrand-fluent-forms",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23904",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SoundCloud Shortcode \u003c= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "soundcloud-shortcode",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25936",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ANON::form embedded secure form \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "anonform-embedded-secure-form",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52733",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rating by BestWebSoft \u003c 0.2 - Reflected Cross-Site Scripting",
    "slug": "rating-bws",
    "type": "plugin",
    "affected_version": "[*, 0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18530",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Shortcode \u003c= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "post-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0526",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Product Add-Ons \u003c= 4.14.1 - Reflected Cross-Site Scripting",
    "slug": "yith-woocommerce-product-add-ons",
    "type": "plugin",
    "affected_version": "* - 4.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50448",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Role Based Pricing for WooCommerce \u003c= 1.6.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "role-based-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3537",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MF Gig Calendar \u003c= 0.9.4.1 - Cross-Site Scripting",
    "slug": "mf-gig-calendar",
    "type": "plugin",
    "affected_version": "* - 0.9.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-4242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4242",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Atahualpa \u003c= 3.7.24 - Cross-Site Scripting via Cross-Site Request Forgery",
    "slug": "atahualpa",
    "type": "theme",
    "affected_version": "* - 3.7.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27948",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radio Player \u003c= 2.0.73 - Unauthenticated Server-Side Request Forgery",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "* - 2.0.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.73",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-33592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33592",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Z Companion \u003c= 1.0.13 - Missing Authorization",
    "slug": "z-companion",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30817",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Clock In Portal \u003c= 2.1 - Cross-Site Request Forgery to Holidays Deletion",
    "slug": "clock-in-portal",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0763",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Formidable Form Builder \u003c= 4.02 - PHP Object Injection",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "[*, 4.02.01)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.02.01",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-15780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15780",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Tabs Slides \u003c= 2.0.3 - Cross-Site Request Forgery",
    "slug": "wordpress-tabs-slides",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22688",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Tabs – Responsive Tabs Plugin for WordPress \u003c= 1.8.0 - Stored Cross-Site Scripting",
    "slug": "wp-expand-tabs-free",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5312",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Custom Author Profiles \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-custom-author-profiles",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24372",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SermonAudio Widgets \u003c= 1.9.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "sermonaudio-widgets",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49614",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Photo Album Plus \u003c= 8.7.01.001 - Unauthenticated Arbitrary File Upload",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 8.7.01.001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.7.01.001",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31377",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Smart Notification \u003c= 10.3 - Unauthenticated SQL Injection",
    "slug": "smio-push-notification",
    "type": "plugin",
    "affected_version": "* - 10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39479",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Product Table by WBW \u003c= 1.8.6 - Cross-Site Request Forgery via saveGroup",
    "slug": "woo-product-tables",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51512",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Stripe Checkout \u003c= 1.2.2.41 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-stripe-checkout",
    "type": "plugin",
    "affected_version": "* - 1.2.2.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32571",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Listener for WooCommerce – Play Sounds Instantly on New Orders \u003c= 3.2.1 - Unauthenticated SQL Injection",
    "slug": "woc-order-alert",
    "type": "plugin",
    "affected_version": "[*, 3.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0948",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPcalc – Create any online calculators \u003c= 2.1 - SQL Injection",
    "slug": "wpcalc",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25054",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "3D FlipBook - Lite Edition \u003c= 1.16.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via style and mode Parameters",
    "slug": "interactive-3d-flipbook-powered-physics-engine",
    "type": "plugin",
    "affected_version": "* - 1.16.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5289",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Snazzy Maps \u003c= 1.1.4 - Multiple Cross-Site Scripting",
    "slug": "snazzy-maps",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-17947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17947",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP JobSearch \u003c= 2.6.7 - Unauthenticated Arbitrary File Upload",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8615",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "AIO Performance Profiler, Monitor, Optimize, Compress \u0026 Debug \u003c= 1.2 - Missing Authorization",
    "slug": "all-in-one-performance-accelerator",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22647",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Cross-Site Request Forgery via 'uucss_update_rule'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1344",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.9.14 - Missing Authorization",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.9.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32144",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Lazyest Backup \u003c 0.2.2 - Reflected Cross-Site Scripting",
    "slug": "lazyest-backup",
    "type": "plugin",
    "affected_version": "[*, 0.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-5264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5264",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "include-file \u003c= 1 - Authenticated (Contributor+) Arbitrary File Download",
    "slug": "include-file",
    "type": "plugin",
    "affected_version": "* - 1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30596",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Point of Sale \u003c= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change",
    "slug": "woo-point-of-sale",
    "type": "plugin",
    "affected_version": "* - 6.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11281",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Team Rosters \u003c= 4.8.2 - Unauthenticated PHP Object Injection",
    "slug": "team-rosters",
    "type": "plugin",
    "affected_version": "* - 4.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52439",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PixProof \u003c= 2.0.1 - Missing Authorization",
    "slug": "pixproof",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54417",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Coming Soon Page – Responsive Coming Soon \u0026 Maintenance Mode \u003c= 1.1.18 - Cross-Site Scripting via bg_color parameter",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5666",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RainbowNews \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rainbownews",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Turn off all comments \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "turn-off-comments-for-all-posts",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1192",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cooked – Recipe Management \u003c= Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cooked",
    "type": "plugin",
    "affected_version": "* - 1.7.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.15.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37308",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Trending \u003c 0.2 - Cross-Site Scripting",
    "slug": "trending",
    "type": "theme",
    "affected_version": "[*, 0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-3859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3859",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP QuickLaTeX \u003c= 3.8.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-quicklatex",
    "type": "plugin",
    "affected_version": "* - 3.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5472",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.0.1 - Cross-Site Request Forgery to Settings Modification",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41786",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PixelYourSite – Your smart PIXEL (TAG) Manager \u003c= 10.0.1.2 - Cross-Site Request Forgery",
    "slug": "pixelyoursite",
    "type": "plugin",
    "affected_version": "* - 10.0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22300",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Not Login Hide \u003c= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-not-login-hide-wpnlh",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5940",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSFirewall! \u003c= 1.1.42 - Authenticated (Admin+) Arbitrary File Read",
    "slug": "rsfirewall",
    "type": "plugin",
    "affected_version": "* - 1.1.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7518",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP01 – Speed, Security, SEO consultant \u003c= 2.6.2 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "wp01",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2267",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Custom Fields Account Registration For Woocommerce \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "custom-fields-account-registration-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Map No Api \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-map-no-api",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31890",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Disqus Conditional Load \u003c= 11.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings.",
    "slug": "disqus-conditional-load",
    "type": "plugin",
    "affected_version": "* - 11.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23732",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WpStickyBar – Sticky Bar, Sticky Header \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "wpstickybar-sticky-bar-sticky-header",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6226",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Delivery Date for WP e-Commerce \u003c= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "order-delivery-date",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41859",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SpeakOut! Email Petitions \u003c 2.14.15.1 - Unauthenticated SQL Injection",
    "slug": "speakout",
    "type": "plugin",
    "affected_version": "[*, 2.14.15.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.15.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0846",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JP Students Result Management System Premium  1.1.7 - Unauthenticated Arbitrary File Upload",
    "slug": "jp-students-result-system-premium",
    "type": "plugin",
    "affected_version": "1.1.7",
    "from_version": "1.1.7",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31916",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stream \u003c= 3.8.1 - Admin+ SQL Injection",
    "slug": "stream",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24772",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CM Table Of Contents \u003c= 1.2.3 - Cross-Site Request Forgery",
    "slug": "cm-table-of-content",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5029",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Target Video Easy Publish \u003c= 3.8.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "brid-video-easy-publish",
    "type": "plugin",
    "affected_version": "* - 3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32688",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "SEOPress \u003c= 7.8 - Unauthenticated PHP Object Injection",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5488",
    "auth_type": "Unauth",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Disable WordPress Update Notifications \u003c= 2.3.3 - Cross-Site Request Forgery",
    "slug": "disable-update-notifications",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34029",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PAFacile \u003c= 2.6.1 - Reflected Cross-Site Scripting",
    "slug": "pafacile",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23755",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Om Stripe \u003c= 02.00.00 - Reflected Cross-Site Scripting",
    "slug": "om-stripe",
    "type": "plugin",
    "affected_version": "* - 02.00.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "02.00.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13631",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "aDirectory \u003c= 1.3 - Unauthenticated Arbitrary File Upload",
    "slug": "adirectory",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50420",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "R Animated Icon Plugin \u003c= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "r-animated-icon",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9272",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Triggers Lite \u003c= 2.5.3 - Reflected Cross-Site Scripting",
    "slug": "wp-triggers-lite",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13094",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Featured Image from URL (FIFU) \u003c= 4.0.0 - Stored Cross-Site Scripting",
    "slug": "featured-image-from-url",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2278",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Minimal Coming Soon – Coming Soon Page \u003c= 2.38 - Missing Authorization to Limited Settings Change",
    "slug": "minimal-coming-soon-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 2.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5087",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Code Engine \u003c= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "code-engine",
    "type": "plugin",
    "affected_version": "* - 0.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50043",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Specific Content For Mobile \u003c= 0.5.3 - Missing Authorization",
    "slug": "specific-content-for-mobile",
    "type": "plugin",
    "affected_version": "* - 0.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30874",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GDPR CCPA Compliance \u0026 Cookie Consent Banner \u003c= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scripting",
    "slug": "ninja-gdpr-compliance",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5607",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Sticky Anything \u003c= 2.1.5 - Missing Authorization",
    "slug": "toast-stick-anything",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-33646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33646",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit \u003c= 1.0.9 -  Unauthenticated Sensitive Information Exposure",
    "slug": "myshopkit-popup-smartbar-slidein",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1436",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Seraphinite Accelerator \u003c= 2.20.28 - Reflected Cross-Site Scripting via rt",
    "slug": "seraphinite-accelerator",
    "type": "plugin",
    "affected_version": "* - 2.20.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49740",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FeedWordPress \u003c= 2022.0222 - Insecure Direct Object Referece",
    "slug": "feedwordpress",
    "type": "plugin",
    "affected_version": "* - 2022.0222",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2022.0222",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0839",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Video XML Sitemap Generator \u003c= 1.0.0 - Cross-Site Request Forgery via video_sitemap_generate",
    "slug": "video-xml-sitemap-generator",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31089",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Droip \u003c= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Many Actions",
    "slug": "droip",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5835",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Instant Appointment \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "instant-appointment",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23672",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BerqWP \u003c= 2.2.42 - Unauthenticated Arbitrary File Upload",
    "slug": "searchpro",
    "type": "plugin",
    "affected_version": "* - 2.2.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.42",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7443",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPFactory Helper \u003c= 1.5.2 - Reflected Cross-Site Scripting via item_slug",
    "slug": "wpcodefactory-helper",
    "type": "plugin",
    "affected_version": "[*, 1.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-36689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36689",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LoginWP \u003c 2.9.1 - Cross-Site Scripting",
    "slug": "peters-login-redirect",
    "type": "plugin",
    "affected_version": "[*, 2.9.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10925",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SpeedyCache \u003c= 1.1.8 - Cross-Site Request Forgery",
    "slug": "speedycache",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43299",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Customer Reviews \u003c= 3.7.0 - Authenticated (Contributor+) Malicious Redirect via HTTP-EQUIV Injection",
    "slug": "wp-customer-reviews",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1849",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Minimal Share Buttons \u003c= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter",
    "slug": "minimal-share-buttons",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5259",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Countdown and CountUp, WooCommerce Sales Timers \u003c= 1.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "countdown-wpdevart-extended",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-34636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34636",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import and export users and customers \u003c= 1.26.8 - Unauthenticated Information Exposure",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.26.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38787",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ARforms \u003c= 6.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "* - 6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4621",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Social Share Buttons \u003c= 1.19 - Reflected Cross-Site Scripting",
    "slug": "share-button",
    "type": "plugin",
    "affected_version": "* - 1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9219",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow, Image Slider by 2J  \u003c= 1.3.31 - Authorization Bypass",
    "slug": "2j-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.3.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36729",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "The Pack Elementor addons \u003c= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-pack-addon",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52356",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LH Email \u003c= 1.12 - Reflected Cross-Site Scripting",
    "slug": "lh-email",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23676",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Boom Fest \u003c= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update",
    "slug": "boom-fest",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13449",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.12.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "1.12.11",
    "from_version": "1.12.11",
    "from_inclusive": true,
    "to_version": "1.12.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Graphina – Elementor Charts and Graphs \u003c= 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "graphina-elementor-charts-and-graphs",
    "type": "plugin",
    "affected_version": "* - 1.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4574",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "History Collection \u003c=1.1.1 - Arbitrary File Download",
    "slug": "history-collection",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9470",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Talroo \u003c= 2.4 - Reflected Cross-Site Scripting",
    "slug": "wp-jobs2careers",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8281",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Program Suite — SliceWP Affiliates \u003c= 1.1.23 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "slicewp",
    "type": "plugin",
    "affected_version": "* - 1.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12454",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popular Brand Icons - Simple Icons \u003c= 2.7.7 - Authenticated Cross-Site Scripting",
    "slug": "simple-icons",
    "type": "plugin",
    "affected_version": "[*, 2.7.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24503",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IP Blacklist Cloud \u003c= 5.00 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ip-blacklist-cloud",
    "type": "plugin",
    "affected_version": "* - 5.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-42462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42462",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0709",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pz-LinkCard \u003c= 2.4.5.1 - Reflected Cross-Site Scripting",
    "slug": "pz-linkcard",
    "type": "plugin",
    "affected_version": "* - 2.4.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25012",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Publish Confirm Message \u003c= 1.3.1 - Cross-Site Request Forgery",
    "slug": "publish-confirm-message",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32124",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Category Post List Widget \u003c= 2.0 - Cross-Site Request Forgery via get_cplw_settings",
    "slug": "category-post-list-widget",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47516",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag'",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.15.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1396",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Motors Car Dealer \u0026 Classified Ads \u003c= 1.4.0 - Unauthenticated Settings Import/Export",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17228",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Simple Basic Contact Form \u003c= 20240511 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-basic-contact-form",
    "type": "plugin",
    "affected_version": "* - 20240511",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20240511",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12716",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Clone Extension \u003c= 4.0.2 - Missing Authorization to Plugin Settings Change",
    "slug": "mainwp-clone-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23642",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "워드프레스 결제 심플페이 \u003c= 5.2.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "pgall-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56281",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Review Slider \u003c= 12.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-facebook-reviews",
    "type": "plugin",
    "affected_version": "* - 12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0260",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Christian Science Bible Lesson Subjects \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "christian-science-bible-lesson-subjects",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52353",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wp Hosting Performance Check \u003c= 2.18.8 - Reflected Cross-Site Scripting",
    "slug": "wp-hosting-performance-check",
    "type": "plugin",
    "affected_version": "* - 2.18.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22521",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nepali Date Converter \u003c= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nepali-date-converter",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26950",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Manager for Elementor \u003c= 2.0.5 - Missing Authorization",
    "slug": "page-manager-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53230",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking System Trafft \u003c= 1.0.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "booking-system-trafft",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58213",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 1.2.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0963",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Send E-mail \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "send-e-mail",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31592",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid  \u003c= 5.7.8 - Cross-Site Request Forgery",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31362",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blog2Social: Social Media Auto Post \u0026 Scheduler \u003c= 6.3.0 - Authenticated SQL Injection",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "* - 6.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24137",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.10",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.9",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.5",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.21",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.21",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.19",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.18",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.1",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.18",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.15",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Stored Cross-Site Scripting via Plugin Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.11",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14721",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ahmeti Wp Timeline \u003c= 5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ahmeti-wp-timeline",
    "type": "plugin",
    "affected_version": "* - 5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49237",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Members Membership Plugin \u003c= 3.4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.4.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1987",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Chinese Conversion \u003c= 1.1.16 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-chinese-conversion",
    "type": "plugin",
    "affected_version": "* - 1.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32518",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SocialV - Social Network and Community BuddyPress Theme \u003c= 2.0.15 - Missing Authorization to Arbitrary File Download",
    "slug": "socialv",
    "type": "theme",
    "affected_version": "* - 2.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13529",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GC Testimonials \u003c= 1.3.2 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "gc-testimonials",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel Engine \u003c= 5.3.0 - Editor+ Stored Cross-Site Scripting",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 5.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24680",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce - Social Login \u003c= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password",
    "slug": "woo-social-login",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6637",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "ONLYOFFICE DocSpace \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "onlyoffice-docspace",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11750",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Docket Cache \u003c= 24.07.02 - Unauthenticated Local File Inclusion",
    "slug": "docket-cache",
    "type": "plugin",
    "affected_version": "* - 24.07.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.07.02",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39461",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Configure Login Timeout \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "configure-login-timeout",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34419",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks – Page Builder Features \u003c= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2919",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.87 - Missing Authorization via wpr_update_form_action_meta",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0516",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PPOM – Product Addons \u0026 Custom Fields for WooCommerce \u003c= 33.0.15 - Unauthenticated Arbitrary File Upload",
    "slug": "woocommerce-product-addon",
    "type": "plugin",
    "affected_version": "* - 33.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "33.0.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-11391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11391",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 5.7.13 - Missing Authorization",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31352",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Visual Website Collaboration, Feedback \u0026 Project Management – Atarim \u003c= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion",
    "slug": "atarim-visual-collaboration",
    "type": "plugin",
    "affected_version": "* - 4.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12104",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WRC Pricing Tables \u003c= 2.3.7 - Missing Authorization",
    "slug": "wrc-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32293",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Related Posts for WordPress \u003c= 4.0.3 - Cross-Site Request Forgery",
    "slug": "microkids-related-posts",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32549",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Material Design Icons for Page Builders \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "material-design-icons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24374",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slimstat Analytics \u003c= 5.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "* - 5.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40676",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks – Page Builder Gutenberg Blocks, Patterns \u0026 Templates \u003c= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7071",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Football pool \u003c= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "football-pool",
    "type": "plugin",
    "affected_version": "* - 2.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29802",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopLentor – WooCommerce Builder for Elementor \u0026 Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \u003c= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2868",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YouTube Video Inserter \u003c= 1.2.1.0 Reflected Cross-Site Scripting",
    "slug": "youtube-video-inserter",
    "type": "plugin",
    "affected_version": "* - 1.2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38327",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metrika \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "metrika",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54420",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons Elementor \u003c= 2.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48244",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 1.2.54 - Reflected Cross-Site Scripting",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 1.2.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.54",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29759",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart DoFollow \u003c= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "smart-dofollow",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25152",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Travel Agency \u003c= 1.4.9 - Cross-Site Request Forgery",
    "slug": "travel-agency",
    "type": "theme",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37451",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \u003c= 1.6.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.6.7.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4288",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "No API Amazon Affiliate \u003c= 4.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "no-api-amazon-affiliate",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22680",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Events Calendar Registration \u0026 Tickets \u003c= 2.6.0 - Unauthenticated PHP Object Injection",
    "slug": "wpeventplus",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47581",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Transposh WordPress Translation \u003c= 1.0.9.1 - Authenticated (Admin+) SQL Injection via 'tp_editor'",
    "slug": "transposh-translation-filter-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25811",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Background Control \u003c= 1.0.5 - Cross-Site Request Forgery to Arbitrary File Deletion",
    "slug": "background-control",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22784",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Grand Conference Theme Custom Post Type \u003c= 2.6.3 - Missing Authorization",
    "slug": "grandconference-custom-post",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60116",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Robo Gallery \u003c= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27620",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.4 - Reflected Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36864",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobmonster \u003c= 4.7.8 - Reflected Cross-Site Scripting",
    "slug": "noo-jobmonster",
    "type": "theme",
    "affected_version": "* - 4.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53201",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "occupancyplan \u003c= 1.0.3.0 - Cross-Site Request Forgery to SQL Injection",
    "slug": "occupancyplan",
    "type": "plugin",
    "affected_version": "* - 1.0.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46458",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stylish Google Sheet Reader \u003c= 4.0 - Reflected Cross-Site Scripting",
    "slug": "stylish-google-sheet-reader",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22651",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 23.1.2 - Unauthenticated Information Exposure",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 23.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "23.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43283",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP e-Commerce Swipe plugin \u003c= 3.1.0 - Multiple Cross-Site Scripting",
    "slug": "swipehq-payment-gateway-wp-e-commerce",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seriously Simple Stats \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "seriously-simple-stats",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45005",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nite Shortcodes \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nite-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23877",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TSB Occasion Editor \u003c= 1.2.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "tsb-occasion-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55973",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Contact Form 7 Material Design \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cf7-material-design",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Puzzles \u003c= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "puzzles",
    "type": "theme",
    "affected_version": "* - 4.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0837",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backend Localization \u003c= 1.9 - Reflected Cross-Site Scripting",
    "slug": "kau-boys-backend-localization",
    "type": "plugin",
    "affected_version": "1.6.1",
    "from_version": "1.6.1",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-10013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10013",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Reactions Lite \u003c= 1.3.3 - Cross-Site Scripting",
    "slug": "wp-reactions-lite",
    "type": "plugin",
    "affected_version": "[*, 1.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24723",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Cross-Site Request Forgery via 'wpfc_toolbar_save_settings_callback'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1924",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wordpress vertical image slider plugin \u003c= 1.2.16 - Reflected Cross-Site Scripting",
    "slug": "wp-vertical-image-slider",
    "type": "plugin",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2289",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Libsyn Publisher Hub \u003c= 1.4.4 - Cross-Site Request Forgery",
    "slug": "libsyn-podcasting",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32141",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Forms by Cimatti \u003c= 1.6.0 - Cross-Site Request Forgery via accua_forms_list_page_table",
    "slug": "contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47230",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contractor Contact Form Website to Workflow Tool \u003c= 4.0.0 - Reflected Cross-Site Scripting",
    "slug": "contractor-contact-form-website-to-workflow-tool",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44245",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.1 - Cross-Site Request Forgery to Sensitive Information Exposure",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2447",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Login WP \u003c= 5.0.0.0 - Cross-Site Request Forgery",
    "slug": "social-login-wp",
    "type": "plugin",
    "affected_version": "* - 5.0.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38063",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Bitcoin / AltCoin Payment Gateway for WooCommerce \u0026 Multivendor store / shop \u003c= 1.6.0 - Reflected Cross-Site Scripting",
    "slug": "woo-altcoin-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24679",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Admin Emails \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "multiple-admin-emails",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54388",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator \u003c= 4.3.2 - Missing Authorization",
    "slug": "feedzy-rss-feeds",
    "type": "plugin",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6798",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Multisite Content Copier/Updater \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-multisite-content-copier",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38673",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.9 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24701",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 1.8.7 - Authenticated Local File Inclusion",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24242",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L"
  },
  {
    "title": "Zingiri Web Shop Plugin \u003c= 2.4.1 - Cross-Site Scripting",
    "slug": "zingiri-web-shop",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6506",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chatbot with IBM Watson \u003c 0.8.21 - Cross-Site Scripting",
    "slug": "conversation-watson",
    "type": "plugin",
    "affected_version": "[*, 0.8.21)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.21",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-7239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7239",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API – Create Native Android \u0026 iOS Apps On The Cloud \u003c= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12042",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.3.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3200",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "GoogleMapper \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "googlemapper-2",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23518",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Recall \u003c= 16.26.14 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47653",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Jetpack CRM \u003c= 5.4.2 - Authenticated (Administrator+) Cross-Site Scripting",
    "slug": "zero-bs-crm",
    "type": "plugin",
    "affected_version": "* - 5.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3919",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ePaper Lister for Yumpu \u003c= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "magazine-lister-for-yumpu",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32502",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Debug \u003c= 1.10 - Cross-Site Request Forgery",
    "slug": "debug",
    "type": "plugin",
    "affected_version": "* - 1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24798",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Login by Auth0 \u003c= 4.6.0 - Reflected Cross-Site Scripting via wle",
    "slug": "auth0",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enhanced Search Box \u003c= 0.6.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "extended-search-plugin",
    "type": "plugin",
    "affected_version": "* - 0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8091",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cart All In One For WooCommerce \u003c= 1.1.10 - Cross-Site Request Forgery to Cart Changes",
    "slug": "woo-cart-all-in-one",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46806",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Event Calendar \u003c= 1.0.4 - Missing Authorization to Unauthenticated Arbitrary Calendar Deletion",
    "slug": "event-calendars",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8700",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wow Countdowns \u003c= 3.1.2 - Authenticated (Admin+) SQL Injection",
    "slug": "mwp-countdown",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25064",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Votes in one page \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "multiple-votes-in-one-page",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51917",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CityGov \u003c= 1.9 - Unauthenticated Local File Inclusion",
    "slug": "citygov",
    "type": "theme",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52815",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AWP Classifieds \u003c= 4.3.1 - Missing Authorization",
    "slug": "another-wordpress-classifieds-plugin",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31350",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Global Gallery \u003c= 9.2.3 - Missing Authorization",
    "slug": "global-gallery",
    "type": "plugin",
    "affected_version": "* - 9.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52721",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Publitio \u003c= 2.1.8 - Missing Authorization",
    "slug": "publitio",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31799",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jupiter X Core \u003c= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 4.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12316",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Post SMTP \u003c= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9219",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery \u003c= 1.16.16 - Unauthenticated Sensitive Information Exposure",
    "slug": "interactive-3d-flipbook-powered-physics-engine",
    "type": "plugin",
    "affected_version": "* - 1.16.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58226",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "School Management \u003c= 93.1.0 - Unauthenticated Insecure Direct Object Reference",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 93.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "93.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49896",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Armour – Honeypot Anti Spam \u003c= 2.1.13 - Reflected Cross-Site Scripting",
    "slug": "honeypot",
    "type": "plugin",
    "affected_version": "* - 2.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29091",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 2.8.8 - Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 2.8.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-2220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2220",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NoFollow Free \u003c= 1.6.3 - Reflected Cross-Site Scripting",
    "slug": "nofollow-free",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23853",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inline Related Posts \u003c= 3.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "intelly-related-posts",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2444",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobSearch \u003c= 2.5.9 - Unauthenticated PHP Object Injection",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-47636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47636",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Update Image Tag Alt Attribute \u003c= 2.4.5 - Reflected Cross-Site Scripting",
    "slug": "update-alt-attribute",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27455",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Sidebars \u003c= 3.0.8 - Cross-Site Request Forgery",
    "slug": "custom-sidebars",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-18511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18511",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BuddyBoss Platform \u003c= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function",
    "slug": "buddyboss-platform",
    "type": "plugin",
    "affected_version": "* - 2.8.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13859",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Default Feature Image \u003c= 1.0.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-default-feature-image",
    "type": "plugin",
    "affected_version": "* - 1.0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25488",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CMP – Coming Soon \u0026 Maintenance \u003c= 4.1.13 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "cmp-coming-soon-maintenance",
    "type": "plugin",
    "affected_version": "* - 4.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32118",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Events Addon for Elementor \u003c= 2.2.3 - Authenticated (Contributor+) Post Disclosure",
    "slug": "events-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12061",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Better Protected Pages \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "better-protected-pages",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23875",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: KingComposer \u003c 2.9.4 - Stored Cross-Site Scripting",
    "slug": "kingcomposer",
    "type": "plugin",
    "affected_version": "[*, 2.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36709",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Saphali Woocommerce Lite \u003c= 1.8.13 - Cross-Site Request Forgery via 'woocommerce_saphali_page_s_l'",
    "slug": "saphali-woocommerce-lite",
    "type": "plugin",
    "affected_version": "* - 1.8.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25788",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Broken Link Notifier \u003c= 1.3.0 - Unauthenticated Server-Side Request Forgery",
    "slug": "broken-link-notifier",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6851",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NEX-Forms \u003c= 7.9.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 7.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3142",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.13 - Missing Authorization to Settings Update in disableOptimization",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0984",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Car Dealer \u003c= 4.15 - Authenticated (Admin+) Content Injection",
    "slug": "cardealer",
    "type": "plugin",
    "affected_version": "* - 4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-4214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4214",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fix My Feed RSS Repair \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "fix-my-feed-rss-repair",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49816",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP w3all phpBB \u003c= 2.9.8 - Cross-Site Request Forgery",
    "slug": "wp-w3all-phpbb-integration",
    "type": "plugin",
    "affected_version": "* - 2.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32274",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Userback \u003c= 1.0.13 - Cross-Site Request Forgery",
    "slug": "userback",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46089",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Go Maps (formerly WP Google Maps) \u003c= 7.11.17 - SQL Injection",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 7.11.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.17",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-10692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-10692",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4484",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 2.23.0 \u0026 Pro Version \u003c 1.17.0 - Stored Cross-Site Scripting",
    "slug": "happy-elementor-addons-pro",
    "type": "plugin",
    "affected_version": "[*, 1.17.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24292",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 2.23.0 \u0026 Pro Version \u003c 1.17.0 - Stored Cross-Site Scripting",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "[*, 2.24.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.24.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24292",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.2.5 - Unrestricted File Upload",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9312",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Brizy - Page Builder \u003c= 2.3.11 - Stored Cross-Site Scripting",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38344",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Form Builder \u003c= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "easy-form-builder",
    "type": "plugin",
    "affected_version": "* - 3.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12112",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Page Builder Blocks \u0026 Ready-Made Patterns Library \u003c= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blockspare",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8325",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Plugin \u003c= 3.81 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contact-form-plugin",
    "type": "plugin",
    "affected_version": "* - 3.81",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.81",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-125095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-125095",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 12.0.9 - Authenticated Cross-Site Scripting",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 12.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-10991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-10991",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML5 Video Player with Playlist \u003c= 2.4.0 - Reflected Cross-Site Scripting",
    "slug": "html5-video-player-with-playlist",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4534",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cosmic Blocks (40+) Content Editor Blocks Collection \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cosmic-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "REDIRECTION PLUS \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "redirection-plus",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23681",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ko-fi Button \u003c= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ko-fi-button",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2254",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy School Registration \u003c= 3.9.8 - Reflected Cross-Site Scripting",
    "slug": "easy-school-registration",
    "type": "plugin",
    "affected_version": "* - 3.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23740",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates \u003c= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rael_title_tag'",
    "slug": "responsive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2225",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Allegiant \u003c= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "allegiant",
    "type": "theme",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43329",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Dropbox Dropins \u003c= 1.0 - Unauthenticated Arbitrary File Upload",
    "slug": "wp-dropbox-dropins",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49607",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quick Event Manager \u003c= 9.7.4 - Cross-Site Request Forgery",
    "slug": "quick-event-manager",
    "type": "plugin",
    "affected_version": "* - 9.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23974",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Simple Link Directory \u003c 7.3.5 - Reflected Cross-Site Scripting",
    "slug": "simple-link-directory",
    "type": "plugin",
    "affected_version": "[*, 7.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-13463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13463",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms \u003c= 1.0.9 - Cross-Site Request Forgery",
    "slug": "integration-for-contact-form-7-and-google-sheets",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30863",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sessions \u003c= 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sessions",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57890",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnDash LMS - Reports Free \u003c= 1.8.2.1 - Missing Authorization to Plugin Settings Update",
    "slug": "wisdm-reports-for-learndash",
    "type": "plugin",
    "affected_version": "* - 1.8.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5648",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Download Manager \u003c= 3.2.84 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.84",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.84",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29114",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "zStore Manager Basic \u003c= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing",
    "slug": "zstore-manager-basic",
    "type": "plugin",
    "affected_version": "* - 3.311",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.311",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13715",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GetResponse for WordPress \u003c= 5.5.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "getresponse-integration",
    "type": "plugin",
    "affected_version": "* - 5.5.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0167",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Order By \u003c= 1.4.2 - Reflected Cross-Site Scripting",
    "slug": "wp-order-by",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22765",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode \u003c= 6.18.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "coming-soon",
    "type": "plugin",
    "affected_version": "* - 6.18.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.18.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3949",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ColorNews \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "colornews",
    "type": "theme",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Blocks (Custom Post Widget) \u003c= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-post-widget",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44051",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 3.44 - SQL Injection",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 3.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.44",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-14695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14695",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "weMail \u003c= 1.14.2 - Missing Authorization to Notice Dismissal",
    "slug": "wemail",
    "type": "plugin",
    "affected_version": "* - 1.14.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34822",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slider Revolution \u003c= 4.2.2 - Cross-Site Scripting",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-5151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5151",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pathomation \u003c= 2.5.1 - Unauthenticated Arbitrary File Upload",
    "slug": "pathomation",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52490",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Designer \u003c= 1.4.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "designer",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54225",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ecwid Ecommerce Shopping Cart \u003c= 6.10.23 - Cross-Site Request Forgery to Settings/Options Update",
    "slug": "ecwid-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 6.10.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2432",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Asset Manager \u003c= 0.3 - Arbitrary File Upload",
    "slug": "asset-manager",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-10026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10026",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2258",
    "auth_type": "Auth",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Putler Connector for WooCommerce \u003c= 2.12.0 - Missing Authorization via 'putler_connector_sync_complete'",
    "slug": "woocommerce-putler-connector",
    "type": "plugin",
    "affected_version": "* - 2.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40327",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Goal Tracker for Patreon \u003c= 0.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "goal-tracker-for-patreon",
    "type": "plugin",
    "affected_version": "* - 0.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48305",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sales Count Manager for WooCommerce \u003c= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wc-sales-count-manager",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57904",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Missing Authorization on ajax_save_sort_order",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0719",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "EU/UK VAT Manager for WooCommerce \u003c= 2.12.14 - Reflected Cross-Site Scripting",
    "slug": "eu-vat-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.12.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44061",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress \u003c= 1.9.1 - Authorization Bypass",
    "slug": "buddypress",
    "type": "plugin",
    "affected_version": "[*, 1.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-1889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-1889",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Payment Forms for Paystack \u003c= 4.0.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "payment-forms-for-paystack",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22652",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Fitness calculators plugin \u003c= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings",
    "slug": "fitness-calculators",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40552",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zedna eBook download \u003c 1.2 - Directory Traversal",
    "slug": "ebook-download",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10924",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "iSpring Embedder \u003c= 1.0 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "embed-ispring",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23922",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Hide \u003c= 0.0.2 - Missing Authorization to Settings Update",
    "slug": "wp-hide",
    "type": "plugin",
    "affected_version": "* - 0.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3489",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Anant Addons for Elementor \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "anant-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51813",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Blocks \u003c= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48234",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Contact Form Widget For Elementor Page Builder \u0026 Gutenberg Blocks \u0026 Form Builder. \u003c= 2.2.1 - Unauthenticated Arbitrary File Deletion",
    "slug": "ht-contactform",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7341",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "isee-products-extractor \u003c= 2.1.3 -  Reflected Cross-Site Scripting",
    "slug": "isee-products-extractor",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11331",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FW Gallery \u003c= 8.0.0 - Unauthenticated Arbitrary File Deletion",
    "slug": "fw-gallery",
    "type": "plugin",
    "affected_version": "* - 8.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49415",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "DukaPress \u003c= 2.5.9 - Blind SQL Injection",
    "slug": "dukapress",
    "type": "plugin",
    "affected_version": "* - 2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-1000011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000011",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "go Social \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "go-social",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23426",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Magic \u003c= 1.0.4 - Unauthenticated Privilege Escalation",
    "slug": "newsletter-page-redirects",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56205",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal \u003c= 3.1.2 - Cross-Site Request Forgery",
    "slug": "simple-e-commerce-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24620",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Featured Image Thumbnail Grid \u003c= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "thumbnail-grid",
    "type": "plugin",
    "affected_version": "* - 6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28918",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Menu - Ordering - Reservations \u003c= 2.3.6 - Reflected Cross-Site Scripting via 'redirect'",
    "slug": "menu-ordering-reservations",
    "type": "plugin",
    "affected_version": "[*, 2.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-32516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32516",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Silvasoft boekhouden \u003c= 3.0.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "silvasoft-boekhouden",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32125",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPML  \u003c= 4.5.13 - Cross-Site Request Forgery",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "* - 4.5.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45072",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CM Pop-Up banners \u003c= 1.5.10 - Authenticated (Subscriber+) SQL Injection via getStatistics",
    "slug": "cm-pop-up-banners",
    "type": "plugin",
    "affected_version": "* - 1.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-30750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30750",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IP Based Login \u003c= 2.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ip-based-login",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50016",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Find and Replace \u003c= 1.6.1 - Unauthenticated PHP Object Injection",
    "slug": "real-time-auto-find-and-replace",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-39636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39636",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Stellissimo Text Box \u003c= 1.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "stellissimo-text-box",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35752",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Email \u003c= 1.3.37 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contact-form-to-email",
    "type": "plugin",
    "affected_version": "* - 1.3.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2718",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WORDPRESS VIDEO GALLERY \u003c= 2.5 - Cross-Site Scripting",
    "slug": "contus-video-gallery",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9098",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Homey \u003c= 2.4.1 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "homey",
    "type": "theme",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-51800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51800",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads – Pushover notifications \u003c= 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "edd-pushover-notifications",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9521",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thumbnail carousel slider \u003c= 1.0 - Cross-Site Request Forgery to Mass Slider Deletion",
    "slug": "wp-responsive-thumbnail-slider",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5821",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YayExtra \u003c= 1.5.2 - Missing Authorization",
    "slug": "yayextra",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31415",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video List Manager \u003c= 1.7 - Authenticated (Contributor+) SQL Injection",
    "slug": "video-list-manager",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52821",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Scriptless Social Sharing \u003c= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Options",
    "slug": "scriptless-social-sharing",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0377",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member – User Profile, User Registration, Login \u0026 Membership Plugin \u003c= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3384",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes \u003c= 1.0.10 - Missing Authorization",
    "slug": "image-sizes-controller",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49973",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "O2tweet \u003c= 0.0.4 - Cross-Site Request Forgery",
    "slug": "o2tweet",
    "type": "plugin",
    "affected_version": "* - 0.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9338",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PropertyHive \u003c= 2.0.9 - Missing Authorization",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37204",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Vertex Addons for Elementor \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addons-for-elementor-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26769",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Bookings \u003c= 1.15.78 - Insecure Direct Object Reference",
    "slug": "woocommerce-bookings",
    "type": "plugin",
    "affected_version": "* - 1.15.78",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.78",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32747",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page Builder KingComposer \u003c= 2.9.6 - Open Redirect",
    "slug": "kingcomposer",
    "type": "plugin",
    "affected_version": "* - 2.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0165",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AWeber \u003c= 7.3.9 - Missing Authorization via AJAX actions",
    "slug": "aweber-web-form-widget",
    "type": "plugin",
    "affected_version": "* - 7.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47757",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "PDF Viewer \u0026 3D PDF Flipbook – DearPDF \u003c= 2.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dearpdf-lite",
    "type": "plugin",
    "affected_version": "* - 2.0.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23505",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for WPBakery Page Builder \u003c= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "Ultimate_VC_Addons",
    "type": "plugin",
    "affected_version": "* - 3.19.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5252",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seriously Simple Stats \u003c= 1.5.0 - Authenticated (Podcast manager+) SQL Injection via order_by",
    "slug": "seriously-simple-stats",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-45001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45001",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Unlimited PopUps \u003c= 4.5.3 - Authenticated (Admin+) SQL Injection",
    "slug": "unlimited-popups",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24631",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Network Posts Extended \u003c= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height Parameter",
    "slug": "network-posts-extended",
    "type": "plugin",
    "affected_version": "* - 7.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3750",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPS Hide Login \u003c= 1.5.2.2 - Login Page Disclosure via 'adminhash'",
    "slug": "wps-hide-login",
    "type": "plugin",
    "affected_version": "* - 1.5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15824",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "All-In-One-Gallery \u003c= 2.4.9 - Admin+ Local File Inclusion",
    "slug": "all-in-one-video-gallery",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24970",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SiteOrigin Widgets Bundle \u003c= 1.58.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "so-widgets-bundle",
    "type": "plugin",
    "affected_version": "* - 1.58.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.58.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1058",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail Picker \u003c= 1.0.14 - Unauthenticated PHP Object Injection",
    "slug": "mail-picker",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54273",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spam protection, AntiSpam, FireWall by CleanTalk \u003c= 5.173 - Reflected Cross-Site Scripting",
    "slug": "cleantalk-spam-protect",
    "type": "plugin",
    "affected_version": "* - 5.173",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.173",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-28221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-28221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GuruWalk Affiliates \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "guruwalk-affiliates",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27622",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Discount Rules for WooCommerce \u003c= 2.0.2 - Missing Authorization",
    "slug": "woo-discount-rules",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36834",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Google Calendar Manager \u003c= 2.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-gcalendar",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28939",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Frizzly \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "frizzly",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30554",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor \u003c= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4316",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TranslatePress \u003c= 2.9.6 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "translatepress-multilingual",
    "type": "plugin",
    "affected_version": "* - 2.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30773",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Website Data \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "simple-custom-website-data",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38347",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Lightbox \u003c= 2.4.6 - Missing Authorization via Information Disclosure",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31252",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Enable Accessibility \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "enable-accessibility",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30484",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GutenGeek Free Gutenberg Blocks for WordPress \u003c= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "gtg-advanced-blocks",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9073",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Videopack (formerly Video Embed \u0026 Thumbnail Generator) \u003c= 1.1 - Full Path Disclosure",
    "slug": "video-embed-thumbnail-generator",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-1786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-1786",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposure",
    "slug": "smartpay",
    "type": "plugin",
    "affected_version": "1.1.0 - 2.7.13",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "2.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3851",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AFI – The Easiest Integration Plugin \u003c= 1.92.0 - Reflected Cross-Site Scripting",
    "slug": "advanced-form-integration",
    "type": "plugin",
    "affected_version": "* - 1.92.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.92.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10877",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slick Sitemap \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slick-sitemap",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11424",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Page Builder Lite \u003c= 6.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 6.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49076",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Helpdesk Integration \u003c= 5.8.10 - Unauthenticated Local File Inclusion",
    "slug": "wp-helpdesk-integration",
    "type": "plugin",
    "affected_version": "* - 5.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9990",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Editor \u003c= 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "wp-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24700",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mmm Simple File List \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "mmm-file-list",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4514",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter \u003c= 6.8.1 - Reflected Cross-Site Scripting",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "[*, 6.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-35933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35933",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Pinpoint Booking System – #1 WordPress Booking Plugin \u003c 1.3 - SQL Injection",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-3210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3210",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Logo Showcase \u003c= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "logo-showcase",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58684",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AnyWhere Elementor \u003c= 1.2.7 - Sensitive Information Exposure",
    "slug": "anywhere-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0443",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 2.81 - Remote Code Execution via tax_query, meta_query, date_query Parameters",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 2.81",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.81",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-11928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11928",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps \u0026 Hybrid Mobile Apps \u003c 2.1.3 - Sensitive Information Exposure",
    "slug": "wordpress-mobile-pack",
    "type": "plugin",
    "affected_version": "[*, 2.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9269",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Video Posts Webcam Recorder \u003c= 1.55.4 - Reflected Cross-Site Scripting",
    "slug": "video-posts-webcam-recorder",
    "type": "plugin",
    "affected_version": "* - 1.55.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.55.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4568",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Podcasts Manager \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "wp-podcasts-manager",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47597",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cornerstone \u003c= 0.8.0 - Reflected Cross-Site Scripting",
    "slug": "cornerstone",
    "type": "plugin",
    "affected_version": "* - 0.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-28002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-28002",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stop User Enumeration \u003c= 1.3.7 - Cross-Site Scripting",
    "slug": "stop-user-enumeration",
    "type": "plugin",
    "affected_version": "[*, 1.3.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18536",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AnyComment \u003c= 0.2.17 - Cross-Site Request Forgery",
    "slug": "anycomment",
    "type": "plugin",
    "affected_version": "[*, 0.2.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.18",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0134",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto \u003c= 8.0.8 - Unauthenticated Sensitive Information Exposure",
    "slug": "tripetto",
    "type": "plugin",
    "affected_version": "* - 8.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13829",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Fluent Support \u003c= 1.7.6 - Authenticated(Administrator+) SQL Injection",
    "slug": "fluent-support",
    "type": "plugin",
    "affected_version": "[*, 1.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-51547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51547",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Search with Typesense \u003c= 2.0.8 - Authenticated (Admin+) Path Traversal",
    "slug": "search-with-typesense",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-26876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26876",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JS Job Manager \u003c= 2.0.2 - Unauthenticated Local File Inclusion",
    "slug": "js-jobs",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32627",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "W3 Total Cache 0.9.2.6-0.9.3 - File Read / Directory Traversal",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "0.9.2.6 - 0.9.3",
    "from_version": "0.9.2.6",
    "from_inclusive": true,
    "to_version": "0.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-6715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6715",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Free SSL – Free SSL Certificate for WordPress and force HTTPS \u003c= 1.2.7 - Missing Authorization",
    "slug": "wp-free-ssl",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44020",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Swift Performance Lite \u003c= 2.3.6.20 - Cross-Site Request Forgery",
    "slug": "swift-performance-lite",
    "type": "plugin",
    "affected_version": "* - 2.3.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37511",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Photo \u003c= 0.9.4 - Arbitrary File Upload",
    "slug": "user-photo",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-1916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1916",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MStore API \u003c= 4.10.1 - Cross-Site Request Forgery",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50878",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Domain Check \u003c= 1.0.16 - Reflected Cross-Site Scripting via domain",
    "slug": "domain-check",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24926",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Hive Support \u003c= 1.2.6 - Unauthenticated Sensitive Information Exposure",
    "slug": "hive-support",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32635",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Integrate Google Drive \u003c= 1.3.8 - Missing Authorization",
    "slug": "integrate-google-drive",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32949",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Contact Form Builder \u003c 1.1 - Cross-Site Scripting",
    "slug": "tidio-form",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000152",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration \u0026 Membership PRO – Custom Registration Form, Login Form, and User Profile \u003c= 5.1.3 - Cross-Site Request Forgery to User Deletion",
    "slug": "user-registration-pro",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3284",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UiCore Elements \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "uicore-elements",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58196",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Tiles \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "wp-tiles",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25482",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Go Maps (formerly WP Google Maps) \u003c= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5994",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "W3 Total Cache \u003c= 2.7.5 - Sensitive Credentials Stored in Plaintext",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-5359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5359",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPLMS \u003c= 1.9.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56048",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Ultimate Post Grid \u003c= 3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters Shortcode",
    "slug": "wp-ultimate-post-grid",
    "type": "plugin",
    "affected_version": "* - 3.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9051",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Assistant \u003c= 1.4.3 -  Authenticated (Editor+) Server Side Request Forgery",
    "slug": "assistant",
    "type": "plugin",
    "affected_version": "[*, 1.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5798",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Cross-Site Request Forgery to Profile Deletion",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4935",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPBITS Addons For Elementor Page Builder \u003c= 1.3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpbits-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32593",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Autolinks \u003c= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "autolinks",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1112",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ShortPixel Adaptive Images \u003c= 3.3.1 - Subscriber+ Arbitrary Settings Update",
    "slug": "shortpixel-adaptive-images",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29417",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Warfare \u003c= 4.3.0 - Missing Authorization",
    "slug": "social-warfare",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0402",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "AI Quiz | Quiz Maker \u003c= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "ai-quiz",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11323",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Category/Post Type Post order \u003c= 1.6.0 - Missing Authorization",
    "slug": "custom-post-order-category",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29013",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FOX – Currency Switcher Professional for WooCommerce \u003c= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.4.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6556",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c= 10.16 - Cross-Site Request Forgery to Arbitrary Post/Page Deletion",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 10.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47583",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AWP Classifieds \u003c= 4.3 - Cross-Site Request Forgery",
    "slug": "another-wordpress-classifieds-plugin",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41801",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Academy LMS \u003c= 3.3.4 - Authenticated (Academy Instructor+) Insecure Direct Object Reference",
    "slug": "academy",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59562",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Delete Usermetas \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "delete-usermetas",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5537",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Testimonials (Free \u003c= 2.6, Pro \u003c 1.0.7) - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "super-testimonial",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3539",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonials (Free \u003c= 2.6, Pro \u003c 1.0.7) - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "super-testimonial-pro",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3539",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hover Effects – Elementor Addon \u003c= 1.3.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "image-hover-effects-addon-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24264",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Client Reports \u003c= 1.0.22 - Cross-Site Request Forgery",
    "slug": "wp-client-reports",
    "type": "plugin",
    "affected_version": "* - 1.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32439",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Fusion Lite \u003c= 3.37.18 – Reflected Cross-Site Scripting",
    "slug": "wp-fusion-lite",
    "type": "plugin",
    "affected_version": "* - 3.37.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.37.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34660",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maps Plugin using Google Maps for WordPress – WP Google Map \u003c= 1.9.3 - Maps Plugin using Google Maps for WordPress – WP Google Map \u003c= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Markers",
    "slug": "gmap-embed",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13208",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SlideOnline \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slideonline",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0489",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CP Polls \u003c= 1.0.71 - Unauthenticated Poll Limit Bypass",
    "slug": "cp-polls",
    "type": "plugin",
    "affected_version": "* - 1.0.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24873",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Storefront Footer Text \u003c= 1.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "storefront-footer-text",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24607",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ContentStudio \u003c= 1.3.4 - Missing Authorization",
    "slug": "contentstudio",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49990",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Soisy Pagamento Rateale \u003c= 6.0.1 - Missing Authorization to Sensitive Information Exposure",
    "slug": "soisy-pagamento-rateale",
    "type": "plugin",
    "affected_version": "* - 6.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5132",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Kapost \u003c= 2.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "kapost-byline",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23712",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Maintenance \u003c= 6.1.3 - IP Restriction Bypass",
    "slug": "wp-maintenance",
    "type": "plugin",
    "affected_version": "* - 6.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47769",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ShopEngine \u003c= 4.1.1 - Cross-Site Request Forgery via get_product",
    "slug": "shopengine",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45371",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Appointment Buddy Widget \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "appointment-buddy-online-appointment-booking-by-accrete",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25099",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "formafzar \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "formafzar",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22524",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FireCask Like \u0026 Share Button \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter",
    "slug": "facebook-like-send-button",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11226",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1985",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Canto \u003c= 3.0.6 - Remote File Inclusion to Code Execution",
    "slug": "canto",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-25096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25096",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ali2Woo Lite \u003c= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "ali2woo-lite",
    "type": "plugin",
    "affected_version": "* - 3.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37214",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login Block IPs \u003c= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "login-block-ips",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3098",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hermit 音乐播放器 \u003c= 3.1.6 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "hermit",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29413",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Social Share Buttons \u003c= 9.4 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "easy-social-share-buttons3",
    "type": "plugin",
    "affected_version": "* - 9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-31300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31300",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Eximius \u003c= 2.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "eximius",
    "type": "theme",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26872",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mantra \u003c= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mantra",
    "type": "theme",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44056",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NC Wishlist for Woocommerce \u003c= 1.0.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "nc-wishlist-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22505",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor \u003c= 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "gutentor",
    "type": "plugin",
    "affected_version": "* - 3.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10178",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Upload Restriction \u003c= 2.2.4 - Missing Authorization Checks",
    "slug": "wp-upload-restriction",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34627",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.10.5 - PHP Objection Injection",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3359",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Login \u003c= 4.1.0 - Missing Authorization",
    "slug": "custom-login",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49858",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FireStats \u003c1.6.2 - SQL Injection",
    "slug": "firestats",
    "type": "plugin",
    "affected_version": "[*, 1.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2009-2144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2144",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Download SpamReferrerBlock \u003c= 2.22 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "spamreferrerblock",
    "type": "plugin",
    "affected_version": "* - 2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34372",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Forms \u003c= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "[*, 6.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2877",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "File Manager \u003c= 7.2.1 - Sensitive Information Exposure via Backup Filenames",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "* - 7.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0761",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Listing, Classified Ads \u0026 Business Directory – uListing \u003c= 2.0.5 - Cross-Site Request Forgery",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36876",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Quick Call Button \u003c= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "quick-call-button",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47829",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Piotnet Forms \u003c= 1.0.28 - Unauthenticated Arbitrary File Upload",
    "slug": "piotnetforms",
    "type": "plugin",
    "affected_version": "* - 1.0.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6220",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multi Step Form \u003c= 1.2.5 - Reflected Cross-Site Scripting",
    "slug": "multi-step-form",
    "type": "plugin",
    "affected_version": "[*, 1.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-14430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14430",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "10WebMapBuilder \u003c= 1.0.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wd-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.0.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4758",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram \u003c= 2.0.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36832",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Media File Type Manager \u003c= 2.3.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-media-file-type-manager",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27359",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Real Estate Manager \u003c= 7.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "real-estate-manager",
    "type": "plugin",
    "affected_version": "* - 7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32150",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Narnoo Distributor \u003c= 2.5.1 - Path Traversal",
    "slug": "narnoo-distributor",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0679",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Crew HRM \u003c= 1.1.1 - Unauthenticated PHP Object Injection",
    "slug": "hr-management",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43252",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Virtual Moderator \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "virtual-moderator",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52772",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booknetic \u003c= 4.0.9 - Cross-Site Request Forgery",
    "slug": "booknetic",
    "type": "plugin",
    "affected_version": "* - 4.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26926",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0714",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SupportCandy \u003c= 3.1.6 - Authenticated (Admin+) SQL Injection",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2805",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mailster \u003c= 1.8.16.0 - Missing Authorization",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53803",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Everest Forms \u003c= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1812",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inisev Analyst Module \u003c= Various Versions - Missing Authorization",
    "slug": "http-https-remover",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Analyst Module \u003c= Various Versions - Missing Authorization",
    "slug": "copy-delete-posts",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Analyst Module \u003c= Various Versions - Missing Authorization",
    "slug": "ultimate-social-media-plus",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Analyst Module \u003c= Various Versions - Missing Authorization",
    "slug": "ultimate-posts-widget",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Analyst Module \u003c= Various Versions - Missing Authorization",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Analyst Module \u003c= Various Versions - Missing Authorization",
    "slug": "pop-up-pop-up",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Analyst Module \u003c= Various Versions - Missing Authorization",
    "slug": "redirect-redirection",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Analyst Module \u003c= Various Versions - Missing Authorization",
    "slug": "wp-clone-by-wp-academy",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Analyst Module \u003c= Various Versions - Missing Authorization",
    "slug": "feedburner-alternative-and-rss-redirect",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Analyst Module \u003c= Various Versions - Missing Authorization",
    "slug": "add-social-share",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Analyst Module \u003c= Various Versions - Missing Authorization",
    "slug": "enhanced-text-widget",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31435",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy2map-photos \u003c= 1.0.9 - Path Traversal",
    "slug": "easy2map-photos",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-4617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4617",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Seo Monster \u003c= 3.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "seo-monster",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9620",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backuply – Backup, Restore, Migrate and Clone \u003c= 1.3.4 - Authenticated (Admin+) SQL Injection",
    "slug": "backuply",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8669",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Blue Admin \u003c= 21.06.01 - Cross-Site Request Forgery",
    "slug": "blue-admin",
    "type": "plugin",
    "affected_version": "* - 21.06.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.06.01",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24581",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CopyRightPro \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "copyrightpro",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44476",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PSW Front-end Login \u0026 Registration \u003c= 1.12 - Insufficiently Random Values to Unauthenticated Account Takeover/Privilege Escalation via customer_registration Function",
    "slug": "psw-login-and-registration",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4607",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Memory Usage \u003c= 3.98 - Cross-Site Request Forgery to Limited Plugin Installation via wpmemory_install_plugin Function",
    "slug": "wp-memory",
    "type": "plugin",
    "affected_version": "* - 3.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.98",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8104",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RDP Wiki Embed \u003c= 1.2.20 - Cross-Site Request Forgery",
    "slug": "rdp-wiki-embed",
    "type": "plugin",
    "affected_version": "* - 1.2.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32262",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Store Hours for WooCommerce \u003c= 4.3.20 - Reflected Cross-Site Scripting",
    "slug": "order-hours-scheduler-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8872",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qubely – Advanced Gutenberg Blocks \u003c= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content",
    "slug": "qubely",
    "type": "plugin",
    "affected_version": "* - 1.8.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13228",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Tutor LMS – eLearning and online course solution \u003c= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1503",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "History Log by click5 \u003c= 1.0.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "history-log-by-click5",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47598",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "افزونه پیامک ووکامرس Persian WooCommerce SMS \u003c= 7.0.5 - Reflected Cross-Site Scripting",
    "slug": "persian-woocommerce-sms",
    "type": "plugin",
    "affected_version": "* - 7.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10046",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings \u0026 Increase Traffic \u003c= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3554",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce \u003c= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode",
    "slug": "wp-event-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2691",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Posti Shipping \u003c= 3.10.3 - Cross-Site Request Forgery",
    "slug": "posti-shipping",
    "type": "plugin",
    "affected_version": "* - 3.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56005",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ArtiBot Free Chat Bot for WordPress WebSites \u003c= 1.1.6 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "artibot",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0449",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donations Made Easy – Smart Donations \u003c= 4.0.12 - Reflected Cross-Site Scripting",
    "slug": "smart-donations",
    "type": "plugin",
    "affected_version": "* - 4.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32603",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Hide Admin Bar \u003c= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "auto-hide-admin-bar",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23994",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez  \u003c= 3.4.1 - Missing Authorization",
    "slug": "houzez",
    "type": "theme",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24747",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Comments Extra Fields For Post,Pages and CPT \u003c= 5.0 - Cross-Site Request Forgery",
    "slug": "wp-comment-fields",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0830",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1785",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ShareThis Share Buttons \u003c= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sharethis-inline-buttons Shortcode",
    "slug": "sharethis-share-buttons",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3648",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks \u003c= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.85",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.85",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6346",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShayanWeb Admin FontChanger \u003c= 1.9.1 - Cross-Site Request Forgery",
    "slug": "shayanweb-admin-fontchanger",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48114",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Noptin \u003c= 3.4.2 - Missing Authorization to Unauthenticated Form Submission",
    "slug": "newsletter-optin-box",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37456",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rollback \u003c 1.2.3 - Cross-Site Request Forgery",
    "slug": "wp-rollback",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9343",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Grand Restaurant WordPress \u003c= 7.0 - Unauthenticated PHP Object Injection via Path Traversal",
    "slug": "grandrestaurant",
    "type": "theme",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32926",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bg Bible References \u003c= 3.8.14 - Reflected Cross-Site Scripting",
    "slug": "bg-biblie-references",
    "type": "plugin",
    "affected_version": "* - 3.8.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4374",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 0.8.8.5 - Cross-Site Scripting via rules[0][content] parameter",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 0.8.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-17586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17586",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.16.2 - Authenticated Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "[*, 4.16.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24961",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Best WordPress Shortcode Plugin in 2025 – AIO Shortcodes \u003c= 1.3.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "aio-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24620",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada Builder \u003c= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure",
    "slug": "fusion-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12335",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MapPress Maps for WordPress \u003c= 2.73.12 - Admin+ File Upload to Remote Code Execution",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 2.73.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.73.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0537",
    "auth_type": "Privileged",
    "cvss_score": 6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6518",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Post List Table \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-post-list-table",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13664",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "[*, 2.7.31)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.31",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-6999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6999",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "[2.8, 2.8.23.2)",
    "from_version": "2.8",
    "from_inclusive": true,
    "to_version": "2.8.23.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-6999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6999",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "[3, 3.0.10.2)",
    "from_version": "3",
    "from_inclusive": true,
    "to_version": "3.0.10.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-6999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6999",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AS – Create Pinterest Pinboard Pages \u003c= 1.0 - Authenticated Options Change to Stored Cross-Site Scripting",
    "slug": "as-create-pinterest-pinboard-pages",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36341",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "mb.miniAudioPlayer \u003c= 1.7.6 - Multiple Vulnerabilities",
    "slug": "wp-miniaudioplayer",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-0796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-0796",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L"
  },
  {
    "title": "Blocksy \u003c= 2.0.19 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "blocksy",
    "type": "theme",
    "affected_version": "* - 2.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24871",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Plugin \u003c= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "download-plugin",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6586",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.75 - Cross-Site Request Forgery",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.75",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.75",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47175",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Netease Music \u003c= 3.2.1 - Missing Authorization",
    "slug": "netease-music",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49052",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Mail SMTP Pro \u003c= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_page",
    "slug": "wp-mail-smtp-pro",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3213",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Replace Image \u003c= 1.1.10 - Insecure Direct Object Reference",
    "slug": "replace-image",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4873",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Restrict \u003c= 1.2.6 - Missing Authorization to Sensitive Information Exposure",
    "slug": "simple-restrict",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1083",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Frontend File Manager \u003c= 18.2 - Unauthenticated Content Injection",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "[*, 18.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4369",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Powerplay Gallery \u003c= 3.3 - SQL Injection",
    "slug": "wp-powerplaygallery",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-5599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5599",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Frontend File Manager \u003c= 21.2 - Missing Authorization",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "* - 21.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3124",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Social Web Suite – Social Media Auto Post, Social Media Auto Publish \u003c= 4.1.11 - Directory Traversal to Arbitrary File Download",
    "slug": "social-web-suite",
    "type": "plugin",
    "affected_version": "* - 4.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8352",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "FancyBox for WordPress \u003c= 3.0.2 - Stored Cross-Site Scripting",
    "slug": "fancybox-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 3.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-1494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1494",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Store Locator \u003c= 3.98.7 - Cross-Site Request Forgery to Settings Update",
    "slug": "store-locator",
    "type": "plugin",
    "affected_version": "* - 3.98.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.98.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47446",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cookie Information | Free GDPR Consent Solution \u003c= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "wp-gdpr-compliance",
    "type": "plugin",
    "affected_version": "* - 2.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6700",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BuddyPress Extended Friendship Request \u003c 1.0.2 - Cross-Site Scripting",
    "slug": "buddypress-extended-friendship-request",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-4944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4944",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": ".htaccess Login block \u003c= 0.9a - Reflected Cross-Site Scripting",
    "slug": "htaccess-login-block",
    "type": "plugin",
    "affected_version": "* - 0.9a",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9a",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27269",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme \u003c= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Option Update",
    "slug": "buzzclub",
    "type": "theme",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0515",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Role by BestWebSoft \u003c= 1.6.6 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "user-role",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0820",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributes",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3926",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Header Footer Code Manager \u003c= 1.1.13 - Authenticated SQL Injections",
    "slug": "header-footer-code-manager",
    "type": "plugin",
    "affected_version": "[*, 1.1.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.14",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24791",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quick Event Manager \u003c= 9.7.4 - Missing Authorization Checks",
    "slug": "quick-event-manager",
    "type": "plugin",
    "affected_version": "* - 9.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23975",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "BookIt \u003c= 2.4.3 - Authenticated(Administrator+) SQL Injection",
    "slug": "bookit",
    "type": "plugin",
    "affected_version": "[*, 2.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50852",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz And Survey Master \u003c= 8.0.8 - Unauthenticated Arbitrary Media Deletion",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0291",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"
  },
  {
    "title": "myCred – Points, Rewards, Gamification, Ranks, Badges \u0026 Loyalty Plugin \u003c= 2.4.3 - Missing Authorization",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "[*, 2.4.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0287",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Cream Blog, Fascinate, Glaze Blog Lite, \u0026 Everest News (All Versions) - Cross-Site Scripting",
    "slug": "everest-news",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cream Blog, Fascinate, Glaze Blog Lite, \u0026 Everest News (All Versions) - Cross-Site Scripting",
    "slug": "glaze-blog-lite",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cream Blog, Fascinate, Glaze Blog Lite, \u0026 Everest News (All Versions) - Cross-Site Scripting",
    "slug": "cream-blog",
    "type": "theme",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cream Blog, Fascinate, Glaze Blog Lite, \u0026 Everest News (All Versions) - Cross-Site Scripting",
    "slug": "fascinate",
    "type": "theme",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 0.8.9.5 - Directory Traversal",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 0.8.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.9.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-13635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13635",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "RWS Enquiry And Lead Follow-up \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "rws-enquiry",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23460",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forms for Mailchimp by Optin Cat – Grow Your MailChimp List \u003c= 2.5.7 - Reflected Cross-Site Scripting",
    "slug": "mailchimp-wp",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8870",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accept Stripe Payments Using Contact Form 7 \u003c= 3.0 - Unauthenticated Information Exposure",
    "slug": "accept-stripe-payments-using-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53309",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Comments – wpDiscuz \u003c= 7.4.2 - Insecure Direct Object References",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43492",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Featured Image Caption \u003c= 0.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "featured-image-caption",
    "type": "plugin",
    "affected_version": "* - 0.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5669",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Stateless – Google Cloud Storage \u003c= 3.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-stateless",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4905",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Video Central for WordPress \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "video-central",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0418",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Intuitive Custom Post Order \u003c= 3.1.3 - Cross-Site Request Forgery",
    "slug": "intuitive-custom-post-order",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Dropshipping Premium \u003c= 4.3 - Unauthenticated SQL Injection",
    "slug": "woocommerce-dropshipping",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3481",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Submitted Posts – Enable Users to Submit Posts from the Front End \u003c= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "user-submitted-posts",
    "type": "plugin",
    "affected_version": "* - 20230811",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20230811",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4779",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SE HTML5 Album Audio Player \u003c= 1.1.0 - Directory Traversal",
    "slug": "se-html5-album-audio-player",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-4414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4414",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mailster \u003c= 1.8.17.0 - Reflected Cross-Site Scripting",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24598",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magic Google Maps \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magic-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23935",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPFront User Role Editor \u003c= 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpfront-user-role-editor",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: Live Composer \u003c= 1.5.38 - Missing Authorization",
    "slug": "live-composer-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32957",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress Export Import \u003c= 4.0.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "learnpress-import-export",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31241",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Canto \u003c= 3.0.4 - Unauthenticated Remote File Inclusion",
    "slug": "canto",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-3452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3452",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Duplicator \u003c 1.3.28 - Directory Traversal",
    "slug": "duplicator-pro",
    "type": "plugin",
    "affected_version": "[*, 3.8.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.7.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-11738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11738",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Duplicator \u003c 1.3.28 - Directory Traversal",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "[*, 1.3.28)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.28",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-11738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11738",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Easy Blocks pro \u003c= 1.0.21 - Missing Authorization",
    "slug": "easy-blocks-pro",
    "type": "plugin",
    "affected_version": "* - 1.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54256",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "JS Multi Hotel \u003c= 2.2.1 - Full Path Disclosure",
    "slug": "js-multihotel",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-100009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-100009",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Get Custom Field Values \u003c= 4.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin widget",
    "slug": "get-custom-field-values",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45604",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more \u003c= 4.5.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ilab-media-tools",
    "type": "plugin",
    "affected_version": "* - 4.5.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29795",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk NoIndex \u0026 NoFollow Toolkit \u003c= 1.5 - Missing Authorization",
    "slug": "bulk-noindex-nofollow-toolkit-by-mad-fish",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41688",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Spoiler 1.2 - 1.3 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "simple-spoiler",
    "type": "plugin",
    "affected_version": "1.2 - 1.3",
    "from_version": "1.2",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8479",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Enhanced WP Contact Form \u003c= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "enhanced-wordpress-contactform",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23812",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flexible Blogtitle \u003c= 0.1 - Reflected Cross-Site Scripting",
    "slug": "flexible-blogtitle",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23846",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Membership For WooCommerce \u003c= 2.8.1 - Missing Authorization",
    "slug": "membership-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49265",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Active Directory Integration / LDAP Integration \u003c= 4.1.9 - Unauthenticated Information Disclosure",
    "slug": "ldap-login-for-intranet-sites",
    "type": "plugin",
    "affected_version": "* - 4.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ajax Search Lite \u003c 3.11 - Remote Code Execution",
    "slug": "ajax-search-lite",
    "type": "plugin",
    "affected_version": "[*, 3.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-4663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4663",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Broken Link Manager \u003c= 0.6.5 - Authenticated (Admin+) SQL Injection",
    "slug": "broken-link-manager",
    "type": "plugin",
    "affected_version": "* - 0.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24550",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "InPost Gallery \u003c= 2.1.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost_gallery_get_shortcode_template",
    "slug": "inpost-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11002",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.112 - IP Address Spoofing to Antispam Bypass",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.112",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.112",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6171",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.9.4 - Reflected Cross-Site Scripting",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "[*, 3.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24697",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPack Addons for Elementor \u003c= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag*",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2491",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forms for Mailchimp by Optin Cat \u003c= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters",
    "slug": "mailchimp-wp",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7489",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kitring \u003c= 2.8 - Unauthenticated Local File Inclusion",
    "slug": "kitring",
    "type": "theme",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49426",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elements For Elementor \u003c= 2.1 - Authenticated (Contributor+) Local File Inclusion via Multiple Widget Attributes",
    "slug": "nd-elements",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5348",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Image Popup \u003c= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-image-popup",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4433",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spirit Framework \u003c= 1.2.13 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "spirit-framework",
    "type": "plugin",
    "affected_version": "* - 1.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10269",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GreenCon \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "greencon",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51926",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Acclectic Media Organizer \u003c= 1.4 - Missing Authorization",
    "slug": "acclectic-media-organizer",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48326",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Block and Stop Bad Bots \u003c= 6.88 - SQL Injection",
    "slug": "stopbadbots",
    "type": "plugin",
    "affected_version": "[*, 6.88)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.88",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-25070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25070",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Betheme \u003c= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 28.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "28.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7399",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RapidExpCart \u003c= 1.0 - Authenticated (Level 8/Administrator+) Stored Cross-Site Scripting",
    "slug": "rapidexpcart",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0520",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS – Migration Tool \u003c= 2.2.0 - Missing Authorization in tutor_import_from_xml",
    "slug": "tutor-lms-migration-tool",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1804",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Theme per user \u003c= 1.0.1 - Unauthenticated PHP Object Injection",
    "slug": "theme-per-user",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-52181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52181",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spacious \u003c= 1.9.11 - Missing Authorization to Autheticated (Subscriber+) Demo Data Import",
    "slug": "spacious",
    "type": "theme",
    "affected_version": "* - 1.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9331",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bulk Featured Image \u003c= 1.2.2 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "bulk-featured-image",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28951",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Append Link on Copy \u003c= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "append-link-on-copy",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57941",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Notifier \u003c= 1.3.0 - Authenticated (Contributor+) CSV Injection",
    "slug": "broken-link-notifier",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6838",
    "auth_type": "Auth",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Accordion title for Elementor \u003c= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "accordion-title-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51685",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Forum  Server \u003c= 1.8.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "forum-server",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53306",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Gold Addons for Elementor \u003c= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) License Activation/Deactivation",
    "slug": "gold-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \u003c= 3.5.14 - Reflected Cross-Site Scripting",
    "slug": "revisionary",
    "type": "plugin",
    "affected_version": "* - 3.5.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9436",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.8 - Stored Cross-Site Scripting",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36854",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Dashboard RSS Feed \u003c= 3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "admin-dashboard-rss-feed",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38725",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes \u003c= 1.4.9 - Authenticated (Subscriber+) SQL Injection",
    "slug": "elex-bulk-edit-products-prices-attributes-for-woocommerce-basic",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3280",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Custom Page Extensions \u003c= 0.6 - Reflected Cross-Site Scripting",
    "slug": "custom-page-extensions",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23888",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Herd Effects \u003c= 5.2 - Local File Inclusion",
    "slug": "mwp-herd-effect",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29448",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Related Posts Widget with Thumbnails \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "advanced-css3-related-posts-widget",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31570",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PropertyHive \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39577",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.1.8 - Missing Authorization via multiple AJAX actions",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25799",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "AWP Classifieds \u003c= 4.3.1 - Cross-Site Request Forgery",
    "slug": "another-wordpress-classifieds-plugin",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32447",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.121 - Authenticated (Editor+) Remote Code Execution",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.121",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.121",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49271",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "kathmag",
    "type": "theme",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "online-estore",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "spidermag",
    "type": "theme",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "medical-heed",
    "type": "theme",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "appzend",
    "type": "theme",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "buzzstore",
    "type": "theme",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "craft-blog",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "fitness-park",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "kingcabs",
    "type": "theme",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "metrostore",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "sparklestore",
    "type": "theme",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "20.0.0 - 21.8.0",
    "from_version": "20.0.0",
    "from_inclusive": true,
    "to_version": "21.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10574",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "7.0.0 - 8.8.0",
    "from_version": "7.0.0",
    "from_inclusive": true,
    "to_version": "8.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10574",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "30.0.0 - 31.8.0",
    "from_version": "30.0.0",
    "from_inclusive": true,
    "to_version": "31.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10574",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Engine 2.8.4 - Insecure OAuth Implementation",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "2.8.4",
    "from_version": "2.8.4",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6238",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spiraclethemes Site Library \u003c= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spiraclethemes-site-library",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47656",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WHOIS \u003c= 1.4.2.4 - Cross-Site Scripting",
    "slug": "wordpress-whois-search",
    "type": "plugin",
    "affected_version": "* - 1.4.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-5193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5193",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Sound \u003c= 1.03 - Cross-Site Request Forgery to Settings Update",
    "slug": "visual-sound",
    "type": "plugin",
    "affected_version": "* - 1.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7859",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks with AI by Kadence WP – Page Builder Features \u003c= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5819",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KH Easy User Settings \u003c= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "kh-easy-user-settings",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54365",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "QR Code for WooCommerce \u003c= 1.2.0 - Reflected Cross-Site Scripting",
    "slug": "wc-qr-codes",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27322",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Orphanage Extended \u003c= 1.2 - Cross-Site Request Forgery to Orphan Account Privilege Escalation",
    "slug": "wp-orphanage-extended",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11415",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Panda Pods Repeater Field \u003c= 1.5.3 - Reflected Cross-Site Scripting",
    "slug": "panda-pods-repeater-field",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4306",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Easy Username Updater \u003c= 1.0.3 - Cross-Site Request Forgery to Username Change",
    "slug": "username-updater",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2355",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DoLogin Security \u003c= 3.7 - Missing Authorization on Dashboard Widget",
    "slug": "dologin",
    "type": "plugin",
    "affected_version": "[*, 3.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4800",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Get Posts \u003c= 0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nurelm-get-posts",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27349",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "e-shops \u003c= 1.0.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "e-shops-cart2",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51648",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Knowledge Base documentation \u0026 wiki plugin – BasePress Docs \u003c= 2.16.3.3 - Missing Authorization to Authenticated (Subscriber+) Database Update",
    "slug": "basepress",
    "type": "plugin",
    "affected_version": "* - 2.16.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10664",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fluid Notification Bar \u003c= 3.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "fluid-notification-bar",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3031",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Staff List \u003c= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-staff-list",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23686",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Media Categories \u003c= 2.1.0 - Cross-Site Request Forgery",
    "slug": "wp-media-categories",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60134",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Secure Copy Content Protection and Content Locking \u003c= 4.4.7 - Missing Authorization to Unauthenticated User Email Retrieval via ays_sccp_reports_user_search Function",
    "slug": "secure-copy-content-protection",
    "type": "plugin",
    "affected_version": "* - 4.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1404",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Modern Footnotes \u003c= 1.4.15 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "modern-footnotes",
    "type": "plugin",
    "affected_version": "* - 1.4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28423",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Renaming Tool by Vlajo \u003c= 1.0 - Path Traversal",
    "slug": "wp-instance-rename",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-4703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4703",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Stock Ticker \u003c= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode",
    "slug": "stock-ticker",
    "type": "plugin",
    "affected_version": "* - 3.24.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.24.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6363",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… \u003c= 4.3 - Missing Authorization via init_endpoint",
    "slug": "ladipage",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Able Player \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ableplayer",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46475",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Five Star Restaurant Reservations \u003c= 2.4.11 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 2.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0421",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Job Board \u003c= 1.3.2 - Information Disclosure",
    "slug": "ninja-job-board",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2544",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP eMember \u003c= 10.6.5 - Reflected Cross-Site Scripting via 'editrecord'",
    "slug": "wp-eMember",
    "type": "plugin",
    "affected_version": "* - 10.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5075",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget4Call \u003c= 1.0.7 - Reflected Cross-Site Scripting",
    "slug": "widget4call",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5727",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel \u003c= 10.1.3 - Authenticated (Author+) SQL Injection",
    "slug": "wp-travel",
    "type": "plugin",
    "affected_version": "* - 10.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22691",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "2.9.3 - 2.9.4",
    "from_version": "2.9.3",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7847",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TheCartPress eCommerce Shopping Cart \u003c= 1.5.3.6 Cross-Site Request Forgery",
    "slug": "thecartpress",
    "type": "plugin",
    "affected_version": "* - 1.5.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3986",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProductX – Gutenberg WooCommerce Blocks \u003c= 2.7.8 - Missing Authorization via option_data_save",
    "slug": "product-blocks",
    "type": "plugin",
    "affected_version": "* - 2.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45271",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Show Pages List \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "show-pages-list",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58219",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup Maker \u003c 1.6.5 - Reflected Cross-Site Scripting",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "[*, 1.6.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-2284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2284",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SendSMS \u003c= 1.2.9 - Reflected Cross-Site Scripting",
    "slug": "sendsms",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56038",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "rtMedia for WordPress, BuddyPress and bbPress WordPress \u003c= 4.6.15 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "buddypress-media",
    "type": "plugin",
    "affected_version": "* - 4.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5939",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import Spreadsheets from Microsoft Excel \u003c= 10.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "import-spreadsheets-from-microsoft-excel",
    "type": "plugin",
    "affected_version": "* - 10.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48289",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Smart Messages for WooCommerce \u003c= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "wpc-smart-messages",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10436",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import and export users and customers \u003c= 1.26.2 - Authenticated (Admin+) PHP Object Injection",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.26.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32817",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Addons for Elementor \u003c= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54050",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Restrict \u003c= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "simple-restrict",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11106",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "The Awesome Feed – Custom Feed \u003c= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-facebook-feed",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44264",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "add custom google tag manager \u003c= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "add-custom-google-tag-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23537",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dropshix \u003c= 4.0.14 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dropshipping-xox",
    "type": "plugin",
    "affected_version": "* - 4.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49898",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom 404 Pro \u003c= 3.8.0 - Unauthenticated SQL Injection via 's'",
    "slug": "custom-404-pro",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2032",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Show Stats \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "wp-show-stats",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32678",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LatePoint \u003c= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 5.1.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.94",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7052",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Beautiful Cookie Consent Banner \u003c= 4.6.1 - Reflected Cross-Site Scripting",
    "slug": "beautiful-and-responsive-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49866",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime \u003c= 4.0.4.5 - Open Redirect",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 4.0.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47648",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog2Social \u003c= 6.9.9 - Authenticated (Subscriber+) SQL Injection",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "* - 6.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3246",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Subscriber by BestWebSoft \u003c= 1.3.4 - Multiple Cross-Site Scripting",
    "slug": "subscriber",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18502",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Platform \u003c 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update",
    "slug": "platform",
    "type": "theme",
    "affected_version": "[*, 1.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-10143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10143",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.8.1 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2008-6762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-6762",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Security \u0026 Malware scan by CleanTalk \u003c= 2.50 - Missing Authorization",
    "slug": "security-malware-firewall",
    "type": "plugin",
    "affected_version": "* - 2.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.50",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36698",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Live Chat Support \u003c= 8.0.32 - Unprotected Functions",
    "slug": "wp-live-chat-support",
    "type": "plugin",
    "affected_version": "[*, 8.0.33)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.33",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-12498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12498",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Groovy Menu \u003c= 1.4.3 - Cross-Site Request Forgery",
    "slug": "groovy-menu-free",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60113",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sort SearchResult By Title \u003c= 10.0 - Cross-Site Request Forgery via settings_page",
    "slug": "sort-searchresult-by-title",
    "type": "plugin",
    "affected_version": "* - 10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45639",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Pricing Tables  \u003c= 3.1.2 - Author+ Stored Cross-Site Scripting",
    "slug": "easy-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36866",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteBuilder Dynamic Components \u003c= 1.0 - PHP Object Injection",
    "slug": "sitebuilder-dynamic-components",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-18604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18604",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Popup Window Maker \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "easy-popup-lightbox-maker",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52421",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Starbox \u003c= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "starbox",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1273",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EAN for WooCommerce \u003c= 4.8.9 - Authenticated (Shop Manager+) Arbitrary Options Update",
    "slug": "ean-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34370",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7491",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FareHarbor for WordPress \u003c= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "fareharbor",
    "type": "plugin",
    "affected_version": "* - 3.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25021",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy2Map \u003c= 1.2.4 - SQL Injection",
    "slug": "easy2map",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-4614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4614",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Keyword Meta \u003c= 3.0 - Cross-Site Scripting",
    "slug": "keyword-meta",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24611",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Interact: Embed A Quiz On Your Site \u003c= 3.1 - Cross-Site Request Forgery",
    "slug": "interact-quiz-embed",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58675",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Link Directory \u003c= 7.7.1 - Unauthenticated SQL Injection",
    "slug": "simple-link-directory",
    "type": "plugin",
    "affected_version": "[*, 7.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0760",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "mFolio Lite \u003c= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files",
    "slug": "mfolio-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9307",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Media Library Folders \u003c= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection",
    "slug": "media-library-plus",
    "type": "plugin",
    "affected_version": "* - 8.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7857",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24578",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wp-greet \u003c= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-greet",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13444",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Invoice \u003c= 2.1.3 - Authenticated SQL Injection",
    "slug": "web-invoice",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4372",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "myCred – Points, Rewards, Gamification, Ranks, Badges \u0026 Loyalty Plugin \u003c= 2.2 - Subscriber+ SQL Injection",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24755",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Everest Backup \u003c= 2.1.9 - Sensitive Information Exposure via Log File",
    "slug": "everest-backup",
    "type": "plugin",
    "affected_version": "[*, 2.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-52185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52185",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP-Recall – Registration, Profile, Commerce \u0026 More \u003c= 16.26.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Exeuction",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1325",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Market \u003c 5.1.27 - Reflected Cross-Site Scripting",
    "slug": "BuilderChild-Market",
    "type": "theme",
    "affected_version": "[*, 5.1.27)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.27",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9378",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IMPress for IDX Broker \u003c= 2.6.1 - Authenticated Arbitrary Post Creation, Modification, and Deletion",
    "slug": "idx-broker-platinum",
    "type": "plugin",
    "affected_version": "[*, 2.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-9514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9514",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Embedder for Google Reviews \u003c=  1.7.3 - Missing Authorization",
    "slug": "embedder-for-google-reviews",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Loggedin – Limit Active Logins \u003c= 1.3.1 - Reflected Cross-Site Scripting",
    "slug": "loggedin",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9228",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Featured Video \u003c= 1.7 - Cross-Site Request Forgery",
    "slug": "post-featured-video",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60137",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordPress \u003c= 21.3.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 21.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1487",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "affiliate-toolkit \u003c= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10227",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mailster \u003c= 1.8.17.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22303",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Responsive Video \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "my-wp-responsive-video",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51940",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Who Hit The Page – Hit Counter \u003c= 1.4.14.3 - Cross-Site Request Forgery",
    "slug": "who-hit-the-page-hit-counter",
    "type": "plugin",
    "affected_version": "* - 1.4.14.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.14.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46087",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Admin Cleanup \u003c= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "admin-cleanup",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23832",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.3.1 - Unauthenticated Local File Inclusion",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47438",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FeedBurner FeedSmith \u003c= 2.2 - Cross-Site Request Forgery",
    "slug": "feedburner-feedsmith",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-5229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-5229",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Viral Signup \u003c= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "viral-signup",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6927",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Documentation \u003c= 1.2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "client-documentation",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26578",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations \u0026 More \u003c= 1.8.3 - Reflected Cross-Site Scripting",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10876",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup – MailChimp, GetResponse and ActiveCampaign Intergrations \u003c= 3.2.6 - Missing Authorization to Unauthenticated DB Table Truncation",
    "slug": "ultimate-popup-creator",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12158",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Verge3D \u003c= 4.9.3 - Reflected Cross-Site Scripting",
    "slug": "verge3d",
    "type": "plugin",
    "affected_version": "* - 4.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48241",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Bulk Delete \u003c= 1.3.1 - Reflected Cross-Site Scripting",
    "slug": "wp-bulk-delete",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47352",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery \u003c= 1.15.6 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "interactive-3d-flipbook-powered-physics-engine",
    "type": "plugin",
    "affected_version": "* - 1.15.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43152",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stock Ticker \u003c= 3.23.3 - Reflected Cross-Site Scripting in ajax_stockticker_load",
    "slug": "stock-ticker",
    "type": "plugin",
    "affected_version": "* - 3.23.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.23.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40208",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dokan \u003c=3.7.19 - Authenticated(Shop Manager+) PHP Object Injection via create_dummy_vendor",
    "slug": "dokan-lite",
    "type": "plugin",
    "affected_version": "[*, 3.7.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.20",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-34382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34382",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Nasa Core \u003c 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nasa-core",
    "type": "plugin",
    "affected_version": "[*, 6.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-49067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49067",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woolook \u003c= 1.7.0 - Unauthenticated Local File Inclusion",
    "slug": "woolook",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54375",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ArCa Payment Gateway \u003c= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "arca-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53759",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload for WooCommerce \u003c= 1.0.8 - Cross-Site Request Forgery in upload and delete_file",
    "slug": "drag-and-drop-multiple-file-upload-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45377",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5940",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Frontend File Manager \u003c= 18.2 - Privilege Escalation",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "[*, 18.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4344",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tidio Gallery \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "tidio-gallery",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000153",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Motors - Car Dealer, Rental \u0026 Listing WordPress theme \u003c= 5.6.65 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "motors",
    "type": "theme",
    "affected_version": "* - 5.6.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.65",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13738",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Ultimate Blocks – WordPress Blocks Plugin \u003c= 3.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4655",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AffiliateX \u003c= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "affiliatex",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49692",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3490",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hero Banner Ultimate \u003c= 1.4.4 - Authenticated (Author+) Local File Inclusion",
    "slug": "hero-banner-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22305",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-UserOnline \u003c= 2.88.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-useronline",
    "type": "plugin",
    "affected_version": "* - 2.88.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.88.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2941",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Watermark RELOADED \u003c= 1.3.5 - Cross-Site Request Forgery via optionsPage",
    "slug": "watermark-reloaded",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-27195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27195",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N"
  },
  {
    "title": "Newsletter Manager \u003c 1.0.2 - Cross-Site Scripting",
    "slug": "newsletter-manager",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6628",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calendar Event Multi View \u003c 1.0.2 - SQL Injection",
    "slug": "cp-multi-view-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-8586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8586",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Vimeo Video Autoplay Automute \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "vimeo-video-autoplay-automute",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress \u003c= 9.11.0 - Reflected Cross-Site Scripting",
    "slug": "acymailing",
    "type": "plugin",
    "affected_version": "* - 9.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24617",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nested Pages \u003c= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-nested-pages",
    "type": "plugin",
    "affected_version": "* - 3.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0718",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PPOM – Product Addons \u0026 Custom Fields for WooCommerce \u003c= 33.0.15 - Unauthenticated SQL Injection",
    "slug": "woocommerce-product-addon",
    "type": "plugin",
    "affected_version": "* - 33.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "33.0.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-11691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11691",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Tour Master - Tour Booking, Travel, Hotel \u003c 5.3.4 - Unauthenticated Stored Cross-Site Scripting via Room Booking",
    "slug": "tourmaster",
    "type": "plugin",
    "affected_version": "[*, 5.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-11356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11356",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Email Registration Blacklist and Whitelist \u003c= 1.4.8 - Cross-Site Request Forgery",
    "slug": "cm-email-blacklist",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5167",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mobile Plugin \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "rocket-wp-mobile",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26563",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sight – Professional Image Gallery and Portfolio \u003c= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title",
    "slug": "sight",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9025",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Nexter Blocks \u003c= 4.5.4 - Missing Authorization",
    "slug": "the-plus-addons-for-block-editor",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54739",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WHMCS Bridge \u003c= 6.1 Subscriber+ Stored Cross-Site Scripting",
    "slug": "whmcs-bridge",
    "type": "plugin",
    "affected_version": "* - 6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4074",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "miniOrange's Google Authenticator \u003c= 5.5.5 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "miniorange-2-factor-authentication",
    "type": "plugin",
    "affected_version": "* - 5.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1321",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0823",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Your Posts Manually \u003c= 2.2.5 - Reflected Cross-Site Scripting via '_user_request'",
    "slug": "order-your-posts-manually",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32510",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP HTML Mail \u003c 2.9.1 - HTML Injection",
    "slug": "wp-html-mail",
    "type": "plugin",
    "affected_version": "[*, 2.9.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-25148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25148",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Maintenance \u003c= 6.1.9.7 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "wp-maintenance",
    "type": "plugin",
    "affected_version": "* - 6.1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47683",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Forms \u003c 2.6.71 - Missing Authorization to Sensitive Information Disclosure",
    "slug": "smart-forms",
    "type": "plugin",
    "affected_version": "[*, 2.6.71)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.71",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0163",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AVChat Video Chat \u003c= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "avchat-3",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49605",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Emergency Password Reset \u003c= 8.0 - Cross-Site Request Forgery",
    "slug": "emergency-password-reset",
    "type": "plugin",
    "affected_version": "* - 8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35648",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Testimonial Slider \u003c 1.2.5 - SQL Injection",
    "slug": "testimonial-slider",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-5372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5372",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RT-Theme 18 | Extensions \u003c= 2.4 - Unauthenticated Local File Inclusion",
    "slug": "rt18-extensions",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32288",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "multimedial images \u003c= 1.0b - Authenticated (Administrator+) SQL Injection",
    "slug": "multimedial-images",
    "type": "plugin",
    "affected_version": "* - 1.0b",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0b",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4370",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Abandoned Cart Pro for WooCommerce \u003c= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "woocommerce-abandon-cart-pro",
    "type": "plugin",
    "affected_version": "* - 9.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.16.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4387",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Knowledge Base \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "knowledgebase",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51677",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ColorWay \u003c= 3.4.1 - Cross-Site Scripting",
    "slug": "colorway",
    "type": "theme",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10961",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "cookieBAR \u003c= 1.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cookiebar",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-43834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-43834",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Core Tweaks WP Setup \u003c= 4.1 - Cross-Site Request Forgery",
    "slug": "seo-automatic-wp-core-tweaks",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24803",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sell Media \u003c= 2.5.5 - Cross-Site Request Forgery Bypass",
    "slug": "sell-media",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4420",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Featurific For WordPress \u003c= 1.6.2 - Cross-Site Scripting",
    "slug": "featurific-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-5265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5265",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Toggles Shortcode and Widget \u003c= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "toggles-shortcode-and-widget",
    "type": "plugin",
    "affected_version": "* - 1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12207",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AceIDE \u003c= 2.6.2 - Authenticated (Admin+) Arbitrary File Read",
    "slug": "aceide",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24549",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Stock Sync for WooCommerce \u003c= 2.3.2 - Missing Authorization",
    "slug": "stock-sync-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46807",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Activity Reactions For Buddypress \u003c= 1.0.22 - Missing Authorization",
    "slug": "activity-reactions-for-buddypress",
    "type": "plugin",
    "affected_version": "* - 1.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45075",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "KBucket: Your Curated Content in WordPress \u003c= 4.1.4 - Reflected Cross-Site Scripting",
    "slug": "kbucket",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6667",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Image Display \u003c= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-image-display",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28919",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple 301 Redirects 2.0.0 - 2.0.3 - Unauthenticated Redirect Import",
    "slug": "simple-301-redirects",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.0.3",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24353",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H"
  },
  {
    "title": "Community by PeepSo – Social Network, Membership, Registration, User Profiles \u003c= 6.4.6.0 - Unauthenticated Full Path Disclosure",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7426",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Digital Downloads – Recent Purchases \u003c= 1.0.2 - Unauthenticated Remote File Inclusion",
    "slug": "edd-recent-purchases",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-35629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35629",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Free Stock Photos Foter \u003c= 1.5.4 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "free-stock-photos-foter",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49227",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CURCY – Multi Currency for WooCommerce \u003c= 2.2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woo-multi-currency",
    "type": "plugin",
    "affected_version": "* - 2.2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50831",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MediClinic \u003c= 2.1 - Unauthenticated Local File Inclusion",
    "slug": "mediclinic",
    "type": "theme",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49295",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple File List \u003c 4.2.3 - Remote Code Execution",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "[*, 4.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-36847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36847",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BizPrint \u003c= 4.5.4 - Cross-Site Request Forgery to Cross-Site Scripting via process.php",
    "slug": "print-google-cloud-print-gcp-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29773",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elegant Themes Divi Theme, Extra Theme, Divi Page Builder \u003c= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "divi-builder",
    "type": "plugin",
    "affected_version": "* - 4.25.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.25.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4490",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elegant Themes Divi Theme, Extra Theme, Divi Page Builder \u003c= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "Divi",
    "type": "theme",
    "affected_version": "* - 4.25.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.25.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4490",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elegant Themes Divi Theme, Extra Theme, Divi Page Builder \u003c= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "extra",
    "type": "theme",
    "affected_version": "* - 4.25.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.25.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4490",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Everest Forms \u003c= 2.0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51695",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPtouch \u003c= 1.9.8 - SQL Injection",
    "slug": "wptouch",
    "type": "plugin",
    "affected_version": "[*, 1.9.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2011-4803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4803",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Download Manager \u003c= 3.2.33 - Authenticated SQL Injection",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "[*, 3.2.34)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.34",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-25069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25069",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPS Hide Login \u003c= 1.9.15.2 - Login Page Disclosure",
    "slug": "wps-hide-login",
    "type": "plugin",
    "affected_version": "* - 1.9.15.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.15.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2473",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ditty \u003c= 3.1.24 - Missing Authorization via save_ditty_permissions_check",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47764",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.7.2.2 - Cross-Site Request Forgery",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.7.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via onClick Events",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0326",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rig Elements For Elementor \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rig-elements",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51927",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kumihimo \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "kumihimo",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23626",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thank You Page Customizer for WooCommerce – Increase Your Sales \u003c= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export",
    "slug": "woo-thank-you-page-customizer",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1686",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Language Translate Widget for WordPress – ConveyThis \u003c= 234 - Missing Authorization to Limited Option Update",
    "slug": "conveythis-translate",
    "type": "plugin",
    "affected_version": "* - 234",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "234",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38792",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VK All in One Expansion Unit \u003c= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in Profile Setting",
    "slug": "vk-all-in-one-expansion-unit",
    "type": "plugin",
    "affected_version": "* - 9.88.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.88.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27926",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woo Product Feed For Marketing Channels \u003c= 1.9.0 - Missing Authorization",
    "slug": "woocommerce-to-google-merchant-center",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31377",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Orion Login with SMS \u003c= 1.0.5 - Authenticated Bypass via Weak OTP",
    "slug": "orion-login-with-sms",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7692",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AdPush \u003c= 1.43 - Multiple Cross-Site Scripting",
    "slug": "adsense-plugin",
    "type": "plugin",
    "affected_version": "* - 1.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18487",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OneTone \u003c= 3.0.6 \u0026 OneTone Companion \u003c= 1.1.1 - Unauthenticated Settings Update",
    "slug": "onetone",
    "type": "theme",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-17230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17230",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OneTone \u003c= 3.0.6 \u0026 OneTone Companion \u003c= 1.1.1 - Unauthenticated Settings Update",
    "slug": "onetone-companion",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-17230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17230",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sensly Online Presence \u003c= 0.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "sensly-online-presence",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13493",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP White Label Extension \u003c= 4.1.1 - Missing Authorization to Plugin Settings Change",
    "slug": "mainwp-branding-extension",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23748",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unite Gallery Lite \u003c 1.5 - SQL Injection",
    "slug": "unite-gallery-lite",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9446",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Safe Editor \u003c 1.2 - Cross-Site Scripting",
    "slug": "safe-editor",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10976",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Blog and Widget \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-blog-and-widgets",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4824",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "ContentBot AI Writer \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "content-bot",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gwolle Guestbook \u003c= 4.9.2 - Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter",
    "slug": "gwolle-gb",
    "type": "plugin",
    "affected_version": "* - 4.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5807",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Big Store \u003c= 1.9.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "big-store",
    "type": "theme",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27431",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MaxButtons \u003c= 9.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "* - 9.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36503",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BP Profile Shortcodes Extra \u003c= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bp-profile-shortcodes-extra",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47815",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 1.14.7 - Missing Authorization",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 1.14.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36702",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks – Page Builder Features \u003c= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF)",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6964",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Search \u0026 Go - Directory WordPress Theme \u003c= 2.7 - Authentication Bypass to Privilege Escalation via Account Takeover",
    "slug": "search-and-go",
    "type": "theme",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-11522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11522",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bonus for Woo \u003c= 7.4.1 - Insufficient Input Validation",
    "slug": "bonus-for-woo",
    "type": "plugin",
    "affected_version": "* - 7.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58835",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Watu Quiz \u003c= 3.4.2 - Reflected Cross-Site Scripting",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30844",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce One Page Checkout \u003c= 2.3.0 - Authenticated (Contributor+) Local File Inclusion via `woocommerce_one_page_checkout`",
    "slug": "woocommerce-one-page-checkout",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-35881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35881",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Uptime Robot Plugin for WordPress \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "uptime-robot-monitor",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31562",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dental Optimizer Patient Generator App \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "dental-optimizer-patient-generator-app",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13052",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post-to-Post Links \u003c= 4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-post-to-post-links",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23878",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BeerXML Shortcode \u003c= 0.7.1 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "beerxml-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46511",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InstaSqueeze Sexy Squeeze Pages (All Known Versions) - Cross-Site Scripting",
    "slug": "instasqueeze",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9176",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopLentor \u003c= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9538",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Lead Plus X \u003c= 0.98 - Stored Cross-Site Scripting",
    "slug": "free-sales-funnel-squeeze-pages-landing-page-builder-templates-make",
    "type": "plugin",
    "affected_version": "* - 0.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.98",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-11509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11509",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XStore Core \u003c= 5.3.8 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "et-core-plugin",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-33557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33557",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CouponXxL Custom Post Types \u003c= 3.0 - Unauthenticated Privilege Escalation",
    "slug": "couponxxl-cpt",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-52726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52726",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quick Restaurant Reservations \u003c= 1.4.1 - Reflected Cross-Site Scripting",
    "slug": "quick-restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29923",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by Supsystic \u003c= 1.7.27 - Cross-Site Request Forgery",
    "slug": "contact-form-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45068",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slimstat Analytics \u003c= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "* - 5.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4597",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nika \u003c= 1.2.8 - Unauthenticated Local File Inclusion",
    "slug": "nika",
    "type": "theme",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49254",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder \u003c= 5.2.12 - IP-Spoofing",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13666",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FrescoChat Live Chat \u003c= 3.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "flexytalk-widget",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31383",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImmoToolBox Connect \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "immotoolbox-connect",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54335",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PayGreen – Ancienne version \u003c= 4.10.2 - Cross-Site Request Forgery",
    "slug": "paygreen-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25986",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "System Dashboard \u003c= 2.8.7 - Missing Authorization to Information Disclosure (sd_db_specs)",
    "slug": "system-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5714",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MAS Static Content \u003c= 1.0.8 - Authenticated (Contributor+) Private Static Content Page Disclosure",
    "slug": "mas-static-content",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8483",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "NPS computy \u003c= 2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "nps-computy",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1754",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Roomcloud \u003c 1.3 - Cross-Site Scripting",
    "slug": "roomcloud",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-3904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3904",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tumult Hype Animations \u003c= 1.9.11 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "tumult-hype-animations",
    "type": "plugin",
    "affected_version": "* - 1.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30461",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Assist24 Help Desk \u003c= 20150401.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "assist24it",
    "type": "plugin",
    "affected_version": "* - 20150401.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20150401.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51910",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.0.11 - Missing Authorization to Settings Import",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1110",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Views – Display Posts, Custom Fields, and More \u003c= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI",
    "slug": "acf-views",
    "type": "plugin",
    "affected_version": "* - 3.7.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10380",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Multiple Free Gift \u003c= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding",
    "slug": "woocommerce-multiple-free-gift",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3459",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Time Slots Booking Form \u003c= 1.1.76 - Cross-Site Request Forgery to Feedback Submission",
    "slug": "wp-time-slots-booking-form",
    "type": "plugin",
    "affected_version": "* - 1.1.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.76",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41790",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CM Business Directory \u003c= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cm-business-directory",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10178",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Boost Your Blog's Engagement with WP Post Author \u003c= 3.8.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-post-author",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8757",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Phoenix Media Rename \u003c= 3.4.2 - Author Arbitrary Media File Renaming",
    "slug": "phoenix-media-rename",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24816",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HelloAsso \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "helloasso",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37488",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Namaste! LMS \u003c= 2.6.2 - Reflected Cross-Site Scripting",
    "slug": "namaste-lms",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50407",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twenty20 Image Before-After \u003c= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "twenty20",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4580",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0442",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Creates 3D Flipbook, PDF Flipbook \u003c= 1.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "create-flipbook-from-pdf",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-48034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48034",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Porto \u003c= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts",
    "slug": "porto",
    "type": "theme",
    "affected_version": "* - 7.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3806",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Setup Wizard \u003c= 1.0.8.1 - Authenticated (Subscriber+) Full Database Download",
    "slug": "wp-setup-wizard",
    "type": "plugin",
    "affected_version": "* - 1.0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25917",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Html5 Audio Player \u003c= 2.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "html5-audio-player",
    "type": "plugin",
    "affected_version": "* - 2.2.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39524",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 10.2.5 - Unauthenticated PHP Object Injection",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 10.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49401",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "InPost Gallery \u003c= 2.1.4.1 - Local File Inclusion",
    "slug": "inpost-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4063",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Run Log \u003c= 1.7.10 - Cross-Site Request Forgery to Settings Update",
    "slug": "run-log",
    "type": "plugin",
    "affected_version": "* - 1.7.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9627",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Dark Mode \u003c= 4.0.7 - Authenticated (Subscriber+) Local File Inclusion via 'style'",
    "slug": "wp-dark-mode",
    "type": "plugin",
    "affected_version": "* - 4.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0467",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sales Report Email for WooCommerce \u003c= 2.8.0 - Missing Authorization for Email Functionality",
    "slug": "woo-advanced-sales-report-email",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38141",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "F8 Lite \u003c= 4.2.1 - Cross-Site Scripting",
    "slug": "f8-lite",
    "type": "theme",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3855",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Maps \u003c= 7.11.34 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "[*, 7.11.35)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.35",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-14792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14792",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newscrunch \u003c= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "newscrunch",
    "type": "theme",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1307",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LatePoint \u003c= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 5.1.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.94",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6941",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Homey - Booking and Rentals WordPress Theme \u003c= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion",
    "slug": "homey",
    "type": "theme",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1327",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Notifications \u003c= 1.2.7 - Missing Authorization",
    "slug": "advanced-notifications",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24693",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Kadence Blocks – Gutenberg Blocks for Page Builder Features \u003c= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5678",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Politic \u003c= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-politic",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51673",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MDJM Event Management  \u003c= 1.7.5.6 - Reflected Cross-Site Scripting",
    "slug": "mobile-dj-manager",
    "type": "plugin",
    "affected_version": "* - 1.7.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22714",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishful Blog \u003c= 2.0.1 \u0026 Raise Mag \u003c= 1.0.7 - Unauthenticated Cross-Site Scripting",
    "slug": "raise-mag",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28621",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishful Blog \u003c= 2.0.1 \u0026 Raise Mag \u003c= 1.0.7 - Unauthenticated Cross-Site Scripting",
    "slug": "wishful-blog",
    "type": "theme",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28621",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Service Finder SMS System \u003c= 2.0.0 - Unauthenticated Privilege Escalation",
    "slug": "aone-sms",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5954",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Universal Star Rating \u003c= 2.1.0 - Cross-Site Request Forgery",
    "slug": "universal-star-rating",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-46867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46867",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elite Video Player \u003c= 10.0.5 - Reflected Cross-Site Scripting",
    "slug": "elite-video-player",
    "type": "plugin",
    "affected_version": "* - 10.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30988",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Cross-Site Request Forgery via 'wpfc_remove_cdn_integration_ajax_request_callback'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1923",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newspack Newsletters \u003c= 2.13.2 - Cross-Site Request Forgery",
    "slug": "newspack-newsletters",
    "type": "plugin",
    "affected_version": "* - 2.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37242",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Back Button Widget \u003c= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "back-button-widget",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48252",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xpresslane Fast Checkout \u003c= 1.0.0 - Unauthenticated PHP Object Injection",
    "slug": "xpresslane-integration-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52440",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Pro \u003c= 3.0.5 - Authenticated Remote Code Execution in Dynamic OOO Widget",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-26596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-26596",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LaTeX2HTML \u003c= 2.5.5 - Reflected Cross-Site Scripting",
    "slug": "latex2html",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11688",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Polls \u003c= 2.75.6 - IP Validation Bypass",
    "slug": "wp-polls",
    "type": "plugin",
    "affected_version": "* - 2.75.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.75.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1581",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Master Paper Collapse Toggle \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "master-paper-collapse-toggle",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58871",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Catalog Enquiry \u003c= 5.0.2 - Missing Authorization",
    "slug": "woocommerce-catalog-enquiry",
    "type": "plugin",
    "affected_version": "[*, 5.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50899",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "radSLIDE \u003c= 2.1 - Missing Authorization",
    "slug": "radslide",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23440",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Leadster \u003c= 1.1.2 - Cross-Site Request Forgery via leadster_script_code_action",
    "slug": "leadster-marketing-conversacional",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47791",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Salient Core \u003c= 2.0.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode",
    "slug": "salient-core",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3812",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cookies Pro \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cookies-pro",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26546",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "azurecurve Floating Featured \u003c= 2.2.0 - Reflected Cross-Site Scripting",
    "slug": "azurecurve-floating-featured-image",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23482",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Basic Contact Form \u003c= 20220207 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-basic-contact-form",
    "type": "plugin",
    "affected_version": "* - 20220207",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20220207",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4226",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBakery Page Builder \u003c= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 8.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11160",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grab \u0026 Save \u003c= 1.0.4 - Cross-Site Request Forgery",
    "slug": "save-grab",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47845",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FS Product Inquiry \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "fs-product-inquiry",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4856",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Missing Authorization on ajax_clone_folder",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0715",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Barter \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "barter",
    "type": "theme",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54346",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Membership Database \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "member-database",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0514",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Shortcode \u003c= 0.2.3 - Directory Traversal",
    "slug": "download-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5465",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Content Slider Block – Create fully functional slider with Gutenberg block \u003c= 3.1.5 - Authenticated (Contributor+) Post Disclosure",
    "slug": "content-slider-block",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10667",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Corner Ad \u003c= 1.0.56 - Cross-Site Request Forgery",
    "slug": "corner-ad",
    "type": "plugin",
    "affected_version": "* - 1.0.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.56",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3427",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Progress Bar \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppb shortcode",
    "slug": "progress-bar",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23699",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Provider \u003c= 1.2.3 - Unauthenticated SQL Injection",
    "slug": "file-provider",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4578",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "DZS Video Gallery \u003c= 12.25 - Unauthenticated PHP Object Injection",
    "slug": "dzs-videogallery",
    "type": "plugin",
    "affected_version": "* - 12.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.25",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47552",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Maps by Supsystic \u003c= 1.2.4 - Reflected Cross-Site scripting",
    "slug": "ultimate-maps-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24274",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cache Sniper for Nginx \u003c= 1.0.4.2 - Missing Authorization",
    "slug": "snipe-nginx-cache",
    "type": "plugin",
    "affected_version": "* - 1.0.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23776",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Modern Design Library \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter",
    "slug": "mdl-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5842",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pz-LinkCard \u003c= 2.5.2 - Cross-Site Request Forgery via page_cacheman",
    "slug": "pz-linkcard",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47790",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "NextScripts \u003c= 4.4.2 - Reflected Cross-Site Scripting via code",
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49183",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Builder for WPForms \u003c= 1.2.116 - Unauthenticated Full Path Disclosure",
    "slug": "pdf-builder-for-wpforms",
    "type": "plugin",
    "affected_version": "* - 1.2.116",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.116",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7414",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Request a Quote \u003c= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "request-a-quote",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6231",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My WP Translate \u003c= 1.1 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Option Read and Deletion",
    "slug": "my-wp-translate",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8423",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Envo's Elementor Templates \u0026 Widgets for WooCommerce \u003c= 1.4.16 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "envo-elementor-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43292",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Infinite Scroll – Ajax Load More \u003c= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 7.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4711",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Email \u003c= 1.3.41 - Captcha Bypass",
    "slug": "contact-form-to-email",
    "type": "plugin",
    "affected_version": "* - 1.3.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48318",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 1.5.1.3 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 1.5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2005-2110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2005-2110",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Slider by 10Web \u003c= 1.2.55 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "slider-wd",
    "type": "plugin",
    "affected_version": "* - 1.2.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.55",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6026",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blocksy \u003c= 2.1.6 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "blocksy",
    "type": "theme",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-55713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-55713",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ovic Product Bundle \u003c= 1.1.2 - Missing Authorization",
    "slug": "ovic-product-bundle",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41649",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload for Contact Form 7 \u003c= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion",
    "slug": "drag-and-drop-multiple-file-upload-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.3.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2485",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP EXtra \u003c= 6.4 - Cross-Site Request Forgery ToolImport",
    "slug": "wp-extra",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47825",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IBPS Online Exam Plugin for WordPress \u003c= 1.0 - SQL Injection",
    "slug": "examapp",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-18602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18602",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 Connector \u003c= 1.2.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "ari-cf7-connector",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0239",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Forum \u003c= 2.3 - Multiple SQL Injections",
    "slug": "wp-forum",
    "type": "plugin",
    "affected_version": "[*, 2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2009-3703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-3703",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Watu Quiz \u003c= 3.4.1.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 3.4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53792",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Accredible Certificates \u0026 Open Badges \u003c= 1.4.9 - Authenticated (Administrator+) SQL Injection via orderby Parameter",
    "slug": "accredible-certificates",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13909",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SupportCandy \u003c= 2.2.6 - Stored Cross-Site Scripting via Shortcode",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "[*, 2.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24880",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MDC Comment Toolbar \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mdc-comment-toolbar",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54404",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Anti Spam \u0026 Security \u003c= 7.3.0 - IP Spoofing to Protection Bypass",
    "slug": "anti-spam",
    "type": "plugin",
    "affected_version": "* - 7.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2877",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8401",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CJ Custom Content \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cj-custom-content",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23869",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mailster \u003c= 1.8.16.0 - Missing Authorization",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.16.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-53805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53805",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Enzio - Responsive Business WordPress Theme \u003c= 1.1.8 - Unauthenticated Local File Inclusion",
    "slug": "enzio",
    "type": "theme",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31912",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Symposium \u003c= 14.11 - Arbitrary File Upload",
    "slug": "wp-symposium",
    "type": "plugin",
    "affected_version": "* - 14.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-10021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10021",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Maker \u003c= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.20.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24746",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Porto Theme - Functionality \u003c= 2.11.1 - Missing Authorization",
    "slug": "porto-functionality",
    "type": "plugin",
    "affected_version": "* - 2.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48739",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SpatialMatch IDX \u003c= 3.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "spatialmatch-free-lifestyle-search",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53781",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Social Bar \u003c= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "floating-social-bar",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46451",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grid View Gallery \u003c= 1.0 - Authenticated (Editor+) PHP Object Injection",
    "slug": "grid-view-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11409",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Loan Comparison \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "loan-comparison",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0442",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Field Suite \u003c= 2.6.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "custom-field-suite",
    "type": "plugin",
    "affected_version": "* - 2.6.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32515",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Slider \u003c= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "logo-slider-wp",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10896",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BruteBank - WP Security \u0026 Firewall \u003c= 1.8 - Cross-Site Request Forgery",
    "slug": "brutebank",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4443",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Simple Banner \u003c= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-banner",
    "type": "plugin",
    "affected_version": "* - 2.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0446",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ND Shortcodes \u003c= 6.9 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "nd-shortcodes",
    "type": "plugin",
    "affected_version": "* - 6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1273",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBITS Addons For Elementor Page Builder \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpbits-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2129",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Lightbox 2 \u003c= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "wp-lightbox-2",
    "type": "plugin",
    "affected_version": "* - 3.0.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6263",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Mail Address Encoder \u003c 1.7 - Reflected Cross-Site Scripting",
    "slug": "simple-mail-address-encoder",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15833",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Error Notification \u003c= 0.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "error-notification",
    "type": "plugin",
    "affected_version": "* - 0.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23902",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stagtools \u003c= 2.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "stagtools",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blogger Importer \u003c= 0.5 - Cross-Site Request Forgery",
    "slug": "blogger-importer",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-10027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-10027",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hitsteps Web Analytics \u003c= 5.86 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "hitsteps-visitor-manager",
    "type": "plugin",
    "affected_version": "* - 5.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45057",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Giveaways and Contests by RafflePress \u003c= 1.12.7 - Unauthenticated IP Spoofing",
    "slug": "rafflepress",
    "type": "plugin",
    "affected_version": "* - 1.12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32827",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPHRM - Human Resource Management System \u003c 1.1 - SQL Injection",
    "slug": "wphrm",
    "type": "theme",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-14848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14848",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tom M8te \u003c= 1.5.3 - Directory Traversal",
    "slug": "tom-m8te",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-5187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5187",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Awesome Weather Widget \u003c= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "awesome-weather",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4944",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin \u003c= 1.26.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-and-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.26.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2888",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.5.45.7212 - Reflected Cross-Site Scripting",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.45.7212",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.45.7212",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35631",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Twitter Feeds (Tweets Widget) \u003c= 2.1.2 - Cross-Site Request Forgery",
    "slug": "custom-twitter-feeds",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52136",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.7 - Arbitrary File Upload",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-18461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-18461",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Scroll To Top \u003c= 1.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "scroll-top",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2710",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export Media URLs \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "export-media-urls",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51510",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48300",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Alter \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "alter",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46780",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BizPrint \u003c= 4.3.39 - Missing Authorization via showTemplatePreview()",
    "slug": "print-google-cloud-print-gcp-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.3.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32777",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "LWS Tools \u003c= 2.4.1 - Cross-Site Request Forgery",
    "slug": "lws-tools",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35774",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Feeds for YouTube \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "feeds-for-youtube",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4841",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zippy \u003c= 1.6.2 - Missing Authorization via adminInit",
    "slug": "zippy",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34381",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Login With OTP \u003c= 1.4.2 - Authentication Bypass via Weak OTP",
    "slug": "otp-login",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11178",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cryptocurrency Widgets – Price Ticker \u0026 Coins List \u003c= 2.6.2 - Missing Authorization",
    "slug": "cryptocurrency-price-ticker-widget",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36681",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Database Cleaner \u003c= 0.9.8 - Sensitive Information Exposure via Log File",
    "slug": "database-cleaner",
    "type": "plugin",
    "affected_version": "* - 0.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51508",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.8 - Unauthenticated Account Takeover to Privilege Escalation",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "5.1.8",
    "from_version": "5.1.8",
    "from_inclusive": true,
    "to_version": "5.1.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-35700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35700",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JetEngine \u003c= 3.2.4 - Missing Authorization",
    "slug": "jet-engine",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48758",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Enter Addons \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "enteraddons",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37263",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor \u003c= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3244",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shipyaari Shipping Management \u003c= 1.2 - Unauthenticated PHP Object Injection",
    "slug": "shipyaari-shipping-managment",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49626",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Off Page SEO \u003c= 3.0.3 - Reflected Cross-Site Scripting",
    "slug": "off-page-seo",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23554",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Document Embedder \u003c 1.7.6 - Sensitive Data Exposure",
    "slug": "document-emberdder",
    "type": "plugin",
    "affected_version": "[*, 1.7.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24775",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Greenshift – animation and page builder blocks \u003c= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 9.9.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.9.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11181",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Awesome Surveys \u003c= 2.0.10 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "awesome-surveys",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28878",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Touch Slider \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "wp-touch-slider",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13627",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OpenHook \u003c= 4.3.0 - Authenticated (Subscriber+) Remote Code Execution via Shortcode",
    "slug": "thesis-openhook",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5201",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "ipBlockList \u003c= 1.0 - Cross Site Request Forgery",
    "slug": "ipblocklist",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47147",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Youtube Vimeo Video Player and Slider \u003c= 3.8 - Reflected Cross-Site Scripting",
    "slug": "video_player_youtube_vimeo",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53563",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple PDF Viewer \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via googlepdf Shortcode",
    "slug": "simple-pdf-viewer",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23817",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Out-of-the-Box \u003c= 1.20.2 - Reflected Cross-Site Scripting",
    "slug": "out-of-the-box",
    "type": "plugin",
    "affected_version": "[*, 1.20.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-42547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login with phone number \u003c= 1.3.6 - Unauthenticated Remote Plugin Deletion",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "[*, 1.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0593",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "adstxt Plugin \u003c= 1.0.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "adstxt",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7892",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mediciti Lite \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "mediciti-lite",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28418",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maspik – Spam blacklist \u003c= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "contact-forms-anti-spam",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9182",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Ad Changer \u003c= 2.0.5 - Cross-Site Request Forgery",
    "slug": "cm-ad-changer",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46245",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Webmaster Tools Verification \u003c= 1.2 - Missing Authorization to Arbitrary Plugin Deactivation",
    "slug": "webmaster-tools-verification",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3538",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Product Filter by WBW \u003c= 2.7.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "woo-product-filter",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49691",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Multistore Locator \u003c= 2.5.1 - Unauthenticated SQL Injection",
    "slug": "wp-multi-store-locator",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26974",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GDY Modular Content \u003c= 0.9.92 - Reflected Cross-Site Scripting",
    "slug": "gdy-modular-content",
    "type": "plugin",
    "affected_version": "* - 0.9.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.92",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12153",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Anything \u003c= 2.8.0 - Missing Authorization",
    "slug": "popup-anything-on-click",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32601",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "IgnitionDeck Crowdfunding Platform \u003c= 1.9.8 - Missing Authorization",
    "slug": "ignitiondeck",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4410",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Qi Addons For Elementor \u003c= 1.7.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "qi-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4887",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Google Feed Manager \u003c= 2.2.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "wp-product-feed-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29112",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SecuPress Free — WordPress Security \u003c= 2.2.5.1 - Cross-Site Request Forgery to Banned IP Address",
    "slug": "secupress",
    "type": "plugin",
    "affected_version": "* - 2.2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1504",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "301 Redirects - Easy Redirect Manager \u003c= 2.40 - Missing Authorization",
    "slug": "eps-301-redirects",
    "type": "plugin",
    "affected_version": "* - 2.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19915",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c= 2.0.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2006-0985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-0985",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress Cover \u003c= 2.1.4.2 - Unauthenticated Arbitrary File Upload",
    "slug": "bp-cover",
    "type": "plugin",
    "affected_version": "* - 2.1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-35746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35746",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Accordion \u003c= 2.2.99 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "accordions",
    "type": "plugin",
    "affected_version": "* - 2.2.99",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.99",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47342",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Puzzles | WP Magazine / Review with Store WordPress Theme + RTL \u003c= 4.2.4 - Unauthenticated PHP Object Injection",
    "slug": "puzzles",
    "type": "theme",
    "affected_version": "* - 4.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13770",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventPress \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-eventpress",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51861",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better WishList API \u003c= 1.1.4 - Reflected Cross-Site Scripting",
    "slug": "better-wlm-api",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30798",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Table Lite \u003c= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution \u0026 Reflected Cross-Site Scripting",
    "slug": "wc-product-table-lite",
    "type": "plugin",
    "affected_version": "* - 3.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10899",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Custom CSS, JS \u0026 PHP \u003c= 2.3.0 - Reflected Cross-Site Scripting",
    "slug": "custom-css",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11330",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Geocache Stat Bar Widget \u003c= 0.911 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "geocache-stat-bar-widget",
    "type": "plugin",
    "affected_version": "* - 0.911",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.911",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11266",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Music Press Pro \u003c= 1.4.6 - Missing Authorization",
    "slug": "music-press-pro",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30591",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Cost Estimation \u0026 Payment Forms Builder \u003c= 10.1.75 - Reflected Cross-Site Scripting",
    "slug": "wp-estimation-form",
    "type": "plugin",
    "affected_version": "* - 10.1.75",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1.75",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32510",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "System Dashboard \u003c= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info)",
    "slug": "system-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5711",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Betheme \u003c= 27.1.1 - Missing Authorization via '_tool_history_delete'",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 27.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "27.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39998",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Slotti Ajanvaraus \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slotti-ajanvaraus",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11408",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export All URLs \u003c= 4.5 - Reflected Cross-Site Scripting",
    "slug": "export-all-urls",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3118",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Gallery Block – Display your videos as a gallery in a professional way \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "video-gallery-block",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27326",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Estate 7 WordPress \u003c= 3.5.1 - Unauthenticated Privilege Escalation to Administrator",
    "slug": "realestate-7",
    "type": "theme",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13421",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Landing Pages \u003c 1.2.3 - SQL Injection",
    "slug": "landing-pages",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-6243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6243",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Forms for Mailchimp \u003c= 6.8.10 - Sensitive Information Exposure via logfile",
    "slug": "yikes-inc-easy-mailchimp-extender",
    "type": "plugin",
    "affected_version": "* - 6.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-25095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25095",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "TagGator \u003c= 1.54 - Reflected Cross-Site Scripting",
    "slug": "taggator",
    "type": "plugin",
    "affected_version": "* - 1.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.54",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54390",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Plugin \u003c 1.6.1 - Cross-Site Request Forgery",
    "slug": "download-plugin",
    "type": "plugin",
    "affected_version": "[*, 1.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24703",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Buy one click WooCommerce \u003c= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order Deletion",
    "slug": "buy-one-click-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10853",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Events Calendar for Google \u003c= 2.1.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "events-calendar-for-google",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-38716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38716",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Simple Adsense Insertion \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "wordpress-plugin-for-simple-google-adsense-insertion",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1695",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "eCommerce Product Catalog Plugin for WordPress \u003c= 3.3.43 - Cross-Site Request Forgery to Password Reset",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "* - 3.3.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.43",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12771",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Inquiry Cart \u003c= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "inquiry-cart",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5155",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Vimeotheque \u003c= 2.3.4.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "codeflavors-vimeo-video-post-lite",
    "type": "plugin",
    "affected_version": "* - 2.3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30806",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Link Library \u003c= 7.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4199",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RomethemeKit For Elementor \u003c= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation",
    "slug": "rometheme-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30911",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Leads CRM \u003c= 2.0.13 - Reflected Cross-Site Scripting",
    "slug": "leads-crm",
    "type": "plugin",
    "affected_version": "* - 2.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Announcer – Notification \u0026 message bars \u003c= 6.0 - Missing Authorization",
    "slug": "announcer",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31261",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Photo Feed \u003c= 1.4.0 - Missing Authorization",
    "slug": "simple-photo-feed",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27000",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CRM and Lead Management by vcita \u003c= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "crm-customer-relationship-management-by-vcita",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13702",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WOOEXIM – WooCommerce Export Import Plugin \u003c= 5.0.0 - Unauthenticated PHP Object Injection",
    "slug": "wooexim",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23944",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP JobSearch \u003c= 1.7.3 - Stored Cross-Site Scripting",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "[*, 1.7.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24421",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Z-Downloads \u003c= 1.11.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "z-downloads",
    "type": "plugin",
    "affected_version": "* - 1.11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8703",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ovation Elements \u003c= 1.1.2 - Missing Authorization",
    "slug": "ovation-elements",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47528",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Makeaholic \u003c= 1.8.4 - Unauthenticated Local File Inclusion",
    "slug": "makeaholic",
    "type": "theme",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-54700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54700",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MDC Private Message \u003c= 1.0.1 - Cross-Site Scripting",
    "slug": "mdc-private-message",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-6805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6805",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CLEVER \u003c= 2.6 - Unauthenticated Arbitrary File Download",
    "slug": "lbg-audio11-html5-shoutcast_history",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31635",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Emmet \u003c= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-emmet",
    "type": "plugin",
    "affected_version": "* - 0.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49894",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile Navigation \u003c= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mobile-navigation",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30574",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wise Agent Capture Forms \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "wiseagentleadform",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38335",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Latest Posts \u003c= 5.0.7  - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "wp-latest-posts",
    "type": "plugin",
    "affected_version": "* - 5.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4135",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GoZen Forms \u003c= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm()",
    "slug": "gozen-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6782",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Rich Reviews by Starfish \u003c= 1.9.14 - Cross-Site Request Forgery",
    "slug": "rich-reviews",
    "type": "plugin",
    "affected_version": "* - 1.9.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36861",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Float to Top Button \u003c= 2.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "float-to-top-button",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2709",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eMember \u003c= 10.6.6 - Reflected Cross-Site Scripting via Member Edit",
    "slug": "wp-eMember",
    "type": "plugin",
    "affected_version": "* - 10.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5715",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Realtyna Provisioning \u003c= 1.2.2 - Reflected Cross-Site Scripting",
    "slug": "realtyna-provisioning",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24656",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS  \u003c= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1904",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Database Administrator \u003c= 1.0.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-database-admin",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3211",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "filedownload plugin \u003c= 1.4 - Cross-Site Scripting",
    "slug": "filedownload",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-1000004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000004",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visualizer: Tables and Charts Manager for WordPress \u003c= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2444",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP All Backup \u003c= 2.4.3 - Cross-Site Request Forgery to Backup Storage Modification",
    "slug": "wp-all-backup",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32583",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Products, Order \u0026 Customers Export for WooCommerce \u003c= 2.0.10 - Reflected Cross-Site Scripting via date parameters",
    "slug": "export-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy PayPal Buy Now Button \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-ecommerce-paypal",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47623",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GS Testimonial Slider \u003c= 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gs-testimonial",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40213",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup Migration \u003c= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6972",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Download Plugin \u003c= 2.0.4 - Cross-Site Request Forgery",
    "slug": "download-plugin",
    "type": "plugin",
    "affected_version": "[*, 2.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-36345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36345",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Groups and Communities \u003c= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13740",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Themes by KlbTheme \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "medibazar",
    "type": "theme",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49838",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by KlbTheme \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "machic-core",
    "type": "theme",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49838",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by KlbTheme \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "furnob",
    "type": "theme",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49838",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by KlbTheme \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "cosmetsy",
    "type": "theme",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49838",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by KlbTheme \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "clotya",
    "type": "theme",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49838",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by KlbTheme \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "bacola",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49838",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by KlbTheme \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "partdo",
    "type": "theme",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49838",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShortCodes UI \u003c= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "shortcodes-ui",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47231",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "jwp-a11y \u003c= 4.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "jwp-a11y",
    "type": "plugin",
    "affected_version": "* - 4.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11190",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WassUp Real Time Analytics 1.4 - 1.4.3 - SQL Injection",
    "slug": "wassup",
    "type": "plugin",
    "affected_version": "1.4 - 1.4.3",
    "from_version": "1.4",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-0520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0520",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pastebin \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pastebin-embed",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23908",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.11.1 - Authenticated (Admin+) SQL Injection",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-42404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-42404",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Team Members \u003c= 5.2.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "team-members",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3936",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Callback Request \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "callback-request",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25129",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.3.3 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-4769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-4769",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.3.3 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "2.5",
    "from_version": "2.5",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-4769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-4769",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Wp cycle text announcement \u003c= 8.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-cycle-text-announcement",
    "type": "plugin",
    "affected_version": "* - 8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9198",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ebook Store \u003c= 5.8009 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.8009",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8009",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47589",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Analyse Uploads \u003c= 0.5 - Unauthenticated Arbitrary File Deletion",
    "slug": "analyse-uploads",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49253",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dokan \u003c= 3.7.5 - Unauthenticated SQL Injection",
    "slug": "dokan-lite",
    "type": "plugin",
    "affected_version": "* - 3.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3915",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pinterest Automatic Pin \u003c= 4.18.2 - Missing Authorization",
    "slug": "wp-pinterest-automatic",
    "type": "plugin",
    "affected_version": "* - 4.18.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.18.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39511",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Accordions \u003c= 2.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "accordions-or-faqs",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37122",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "estrutura-basica (All Known Versions) - Path Traversal",
    "slug": "estrutura-basica",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9473",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP shop \u003c= 2.6.0 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "wpshop",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32576",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LIQUID SPEECH BALLOON \u003c= 1.1.8 - Cross-Site Request Forgery to Settings Update",
    "slug": "liquid-speech-balloon",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27889",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Recencio Book Reviews \u003c= 1.66.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "recencio-book-reviews",
    "type": "plugin",
    "affected_version": "* - 1.66.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.66.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33648",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Twine \u003c= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embed-twine",
    "type": "plugin",
    "affected_version": "* - 0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12509",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Shipping – DPD baltic \u003c= 1.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "woo-shipping-dpd-baltic",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4000",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prismatic \u003c= 2.7 - Stored Cross-Site Scripting",
    "slug": "prismatic",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24408",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Current Age Plugin \u003c= 1.6 - Cross-Site Request Forgery",
    "slug": "current-age",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58687",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Access Manager \u003c= 6.9.18 - Authenticated (Author+) Open Redirect",
    "slug": "advanced-access-manager",
    "type": "plugin",
    "affected_version": "* - 6.9.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51675",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Klarna Order Management for WooCommerce \u003c= 1.9.8 - Authenticated (Shop Manager+) Information Disclosure via Log Files",
    "slug": "klarna-order-management-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-58598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58598",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Sidebar Widgets by CodeLights \u003c= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "codelights-shortcodes-and-widgets",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4619",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Folders \u003c= 7.1.1 - Cross-Site Request Forgery",
    "slug": "media-library-plus",
    "type": "plugin",
    "affected_version": "* - 7.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41634",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import and export users and customers \u003c= 1.16.3.5 - CSV injection via a customer's profile",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.16.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-22277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-22277",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.16",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.13",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.10",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.4",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.1",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.16",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.14",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.13",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.6",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.5",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Stored Cross-Site Scripting via theme directory name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bootstrap collapse \u003c= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "bootstrap-collapse",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26551",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Simple PayPal Shopping Cart \u003c= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress-simple-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3890",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Analytics Top Content Widget \u003c= 1.5.5 - Reflected Cross-Site Scripting",
    "slug": "google-analytics-top-posts-widget",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10101",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Cross-Site Request Forgery via 'ucss_connect'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1342",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zoho Forms \u003c= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zoho-forms",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47633",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder Pro \u003c= 3.10.0 - Authenticated (Subscriber+) Time-Based One-Time Password Sensitive Information Exposure",
    "slug": "profile-builder-pro",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22141",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Awesome Filterable Portfolio \u003c 1.9 - Blind SQL Injection",
    "slug": "awesome-filterable-portfolio",
    "type": "plugin",
    "affected_version": "[*, 1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9461",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Coming Soon Page \u0026 Maintenance Mode \u003c= 2.2.1 - Maintenance Mode Bypass",
    "slug": "responsive-coming-soon",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1136",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jobs for WordPress \u003c= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "job-postings",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0820",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Follow-Up Emails \u003c= 4.9.50 - Authenticated (Follow-up emails manager+) SQL Injection",
    "slug": "woocommerce-follow-up-emails",
    "type": "plugin",
    "affected_version": "* - 4.9.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.50",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-33330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33330",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stock in \u0026 out \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "stock-in",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24346",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Side Tab \u003c= 2.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-side-tab",
    "type": "plugin",
    "affected_version": "* - 2.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11183",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salutation Responsive WordPress Theme \u003c 3.0.16 - Authenticated Stored Cross-Site Scripting",
    "slug": "parallelus-salutation",
    "type": "theme",
    "affected_version": "[*, 3.0.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-1000227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000227",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Devnex Addons For Elementor \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "devnex-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53766",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Easy Post Types \u003c= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions",
    "slug": "easy-post-types",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10078",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Migrate Users \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "migrate-users",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24477",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.17.2 - Reflected Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "[*, 2.17.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25099",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Payments \u003c= 5.9.0 - Missing Authorization via redirect_pay_for_order_to_update_payment_method",
    "slug": "woocommerce-payments",
    "type": "plugin",
    "affected_version": "* - 5.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35916",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c= 1.7.6 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4687",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GD bbPress Tools \u003c= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gd-bbpress-tools",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58002",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BerqWP \u003c= 2.2.53 - Missing Authorization",
    "slug": "searchpro",
    "type": "plugin",
    "affected_version": "* - 2.2.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58979",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Slider Feed \u003c= 2.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "instagram-slider-widget",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0717",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "smart SEO \u003c= 4.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "smartseo",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28953",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPZOOM Addons for Elementor (Templates, Widgets) \u003c= 1.1.37 - Unauthenticated Local File Inclusion",
    "slug": "wpzoom-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.1.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.37",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5147",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Download Manager \u003c= 3.2.89 - Improper Authorization via protectMediaLibrary",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2098",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Poll Maker \u003c= 5.5.6 - Missing Authorization",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56295",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Featured Image from URL (FIFU) \u003c= 5.2.7 - Missing Authorization to Password Protected Post Disclosure",
    "slug": "featured-image-from-url",
    "type": "plugin",
    "affected_version": "* - 5.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9984",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Admin in English with Switch \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "admin-in-english-with-switch",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9623",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rough Chart \u003c= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "rough-chart",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2409",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MoolaMojo \u003c= 0.7.4.1 Reflected Cross-Site Scripting",
    "slug": "moolamojo",
    "type": "plugin",
    "affected_version": "* - 0.7.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38358",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wise Chat \u003c= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "wise-chat",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13613",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Quick Post Duplicator \u003c= 2.0 - Missing Authorization",
    "slug": "wp-quick-post-duplicator",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31214",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Follow-Up Emails \u003c= 4.9.40 - Authenticated Arbitrary File Upload in Template Editing",
    "slug": "woocommerce-follow-up-emails",
    "type": "plugin",
    "affected_version": "* - 4.9.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.40",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-33318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33318",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Whizzy \u003c= 1.1.18 - Missing Authorization",
    "slug": "whizzy",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30544",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) \u003c= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion",
    "slug": "extensions-for-cf7",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7645",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Marketing Automation by AZEXO \u003c= 1.27.80 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "marketing-automation-by-azexo",
    "type": "plugin",
    "affected_version": "* - 1.27.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.80",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50480",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RegLevel \u003c= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "reglevel",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6705",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Ultra Simple Paypal Shopping Cart \u003c= 4.4 - Cross-Site Request Forgery",
    "slug": "wp-ultra-simple-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-5992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5992",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Simple HTML Sitemap \u003c= 3.1 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-simple-html-sitemap",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-7385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7385",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Radio Forge Muses Player with Skins \u003c= 2.5 - Reflected Cross-Site Scripting",
    "slug": "radio-forge",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-37976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37976",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPvivid Backup and Migration \u003c= 0.9.68 - Unauthenticated SQL Injection",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "0.9.68",
    "from_version": "0.9.68",
    "from_inclusive": true,
    "to_version": "0.9.68",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-1981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1981",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "QA Analytics \u003c= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "qa-heatmap-analytics",
    "type": "plugin",
    "affected_version": "* - 4.1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8513",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Mailster \u003c= 1.8.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11782",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Social Media Share Buttons \u003c= 5.1.0 - Unauthenticated Password Protected Post Disclosure",
    "slug": "simple-social-buttons",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5845",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Restrict – membership, site, content and user access restrictions for WordPress \u003c= 2.2.8 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "restricted-content",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11351",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Very Simple Google Maps \u003c= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "very-simple-google-maps",
    "type": "plugin",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5744",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog2Social \u003c= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "* - 8.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5673",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP 2FA – Two-factor authentication for WordPress \u003c= 2.2.0 - Missing Authorization",
    "slug": "wp-2fa",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44595",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Slides \u0026 Presentations \u003c= 0.0.39 - Missing Authorization",
    "slug": "slide",
    "type": "plugin",
    "affected_version": "* - 0.0.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22534",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Agreements \u003c= 1.0.3 - Unauthenticated Local File Inclusion",
    "slug": "smart-agreements",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39462",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yet Another Stars Rating \u003c= 3.1.2 - Authenticated (Subscriber+) Cross-Site Scripting via Shortcodes",
    "slug": "yet-another-stars-rating",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40699",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Like Button \u003c= 1.7.0 - Missing Authorization via crublabFBLBAjax",
    "slug": "wp-like-button",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-47820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47820",
    "auth_type": "Auth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.3.4 - Privilege escalation via Registration",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-41957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41957",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Bookmarkify \u003c= 1.1.3 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "bookmarkify",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9441",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PayPal Forms \u003c= 1.0.3 - Cross-Site Request Forgery",
    "slug": "paypal-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10309",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mailster \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "mailster",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30503",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Library Bookshelves \u003c= 5.8 - Reflected Cross-Site Scripting",
    "slug": "library-bookshelves",
    "type": "plugin",
    "affected_version": "* - 5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11359",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "phpCAS authentication library \u003c 1.6.0 - Service Hostname Discovery Exploitation",
    "slug": "authorizer",
    "type": "plugin",
    "affected_version": "[*, 1.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-39369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-39369",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FluentSMTP \u003c= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Email Subject",
    "slug": "fluent-smtp",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3087",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yahoo! WebPlayer \u003c=  2.0.6 - Reflected Cross-Site Scripting",
    "slug": "yahoo-media-player",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53215",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text Editor",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.5.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2716",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KLEO \u003c 5.4.4 - Missing Authorization",
    "slug": "kleo",
    "type": "theme",
    "affected_version": "[*, 5.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-39367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39367",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Donate Extra \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "donate-extra",
    "type": "plugin",
    "affected_version": "* - 2.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1268",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ChillPay WooCommerce \u003c= 2.5.3 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "chillpay-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32570",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quasar form \u003c= 6.1 - Authenticated (Subscriber+) SQL Injection via 'id'",
    "slug": "quasar-form",
    "type": "plugin",
    "affected_version": "* - 6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-35910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35910",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Scroll Top Advanced \u003c= 2.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "scroll-top-advanced",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23444",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP MultiTasking \u003c= 0.1.12 - Reflected Cross-Site Scripting",
    "slug": "wp-multitasking",
    "type": "plugin",
    "affected_version": "* - 0.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6859",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider by Supsystic \u003c= 1.8.6 - Missing Authorization",
    "slug": "slider-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47330",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slider by Supsystic \u003c= 1.8.6 - Missing Authorization",
    "slug": "social-share-buttons-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47330",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4670",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Chat Widget - Chaty \u003c= 3.0.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "chaty",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3858",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.12 - Cross-Site Request Forgery in widgets_watch_data function",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25707",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tourfic \u003c= 2.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tourfic",
    "type": "plugin",
    "affected_version": "* - 2.11.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29134",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP \u003c= 6.1.10 - Unauthenticated Arbitrary File Read",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "* - 6.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26753",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Insert or Embed Articulate Content into WordPress \u003c 4.2999 - Arbitrary File Upload",
    "slug": "insert-or-embed-articulate-content-into-wordpress",
    "type": "plugin",
    "affected_version": "[*, 4.2999)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2999",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15649",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Visual Composer Website Builder \u003c= 45.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "visualcomposer",
    "type": "plugin",
    "affected_version": "* - 45.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "45.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46254",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetBlog \u003c= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-blog",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26744",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TrackShip for WooCommerce \u003c= 1.7.5 - Missing Authorization",
    "slug": "trackship-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32678",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Githuber MD \u003c= 1.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-githuber-md",
    "type": "plugin",
    "affected_version": "* - 1.16.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52422",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 9.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2439",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "reCaptcha by BestWebSoft \u003c= 1.78 - CAPTCHA Bypass",
    "slug": "google-captcha",
    "type": "plugin",
    "affected_version": "* - 1.78",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.78",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24628",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32236",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Author Box \u003c= 2.51 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary User Sensitive Information Exposure",
    "slug": "simple-author-box",
    "type": "plugin",
    "affected_version": "* - 2.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3601",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Notibar \u003c= 2.1.4 - Missing Authorization via ajax_install_plugin",
    "slug": "notibar",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54269",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GeoDirectory \u003c= 2.8.119 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.8.119",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.119",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6200",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.16 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24831",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.1.7.3.2 - Unauthenticated Local File Inclusion",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.1.7.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-47615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47615",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.0.2 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2006-0986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-0986",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PHP Everywhere \u003c= 2.0.3 - Authenticated (Contributor+) Remote Code Execution via Metabox",
    "slug": "php-everywhere",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-24664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-24664",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "QuickSwish \u003c= 1.0.9 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "quickswish",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0499",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RealHomes \u003c= 4.3.7 - Missing Authorization",
    "slug": "realhomes",
    "type": "theme",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37886",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "The Events Calendar \u003c= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12118",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TTT Crop \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "ttt-crop",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26588",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export All URLs \u003c= 4.1 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "export-all-urls",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27856",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Vendors Marketplace \u003c= 2.4.7 - Authenticated (Shop manager+) SQL Injection via search dates",
    "slug": "wc-vendors",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48327",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Beaver Builder Addons by WPZOOM \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget",
    "slug": "wpzoom-addons-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2183",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photography \u003c= 7.5.2 - Unauthenticated Server-Side Request Forgery",
    "slug": "photography",
    "type": "theme",
    "affected_version": "* - 7.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30964",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"
  },
  {
    "title": "JSmol2WP \u003c= 1.07 - Server-Side Request Forgery",
    "slug": "jsmol2wp",
    "type": "plugin",
    "affected_version": "* - 1.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.07",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20463",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Mang Board WP \u003c= 1.8.4 - Reflected Cross-Site Scripting",
    "slug": "mangboard",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56296",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Sticky Add To Cart For WooCommerce \u003c= 1.4.6 - Missing Authorization",
    "slug": "sticky-add-to-cart-woo",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31854",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Owl Carousel \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-owl-carousel",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31535",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hesabfa Accounting \u003c= 2.2.4 - Cross-Site Request Forgery",
    "slug": "hesabfa-accounting",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48362",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form \u0026 Lead Form Elementor Builder \u003c 1.7.4 - Arbitrary Settings Change",
    "slug": "lead-form-builder",
    "type": "plugin",
    "affected_version": "[*, 1.7.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-23180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23180",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Simple Google Photos Grid \u003c= 1.5 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "simple-google-photos-grid",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46503",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hotel Booking \u003c= 1.10.5 - Cross-Site Request Forgery",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 1.10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36852",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "isMobile \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via device Parameter",
    "slug": "ismobile",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6488",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Borderless – Widgets, Elements, Templates and Toolkit for Elementor \u0026 Gutenberg \u003c= 1.6.0 - Authenticated (Administrator+) Remote Code Execution",
    "slug": "borderless",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11600",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49310",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Catch Base \u003c= 3.4.6 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "catch-base",
    "type": "theme",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47313",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetElements For Elementor \u003c= 2.7.4.1 - Missing Authorization",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.7.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39447",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Youzify \u003c= 1.2.6 - Missing Authorization",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39635",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple DeoThemes Themes \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "everse",
    "type": "theme",
    "affected_version": "* - 1.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3708",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple DeoThemes Themes \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "nokke",
    "type": "theme",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3708",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple DeoThemes Themes \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "medikaid",
    "type": "theme",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3708",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple DeoThemes Themes \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "arendelle",
    "type": "theme",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3708",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple DeoThemes Themes \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "amela",
    "type": "theme",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3708",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sitekit \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sitekit",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50047",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiveJournal Shortcode \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "livejournal-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3773",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS for Yandex Turbo \u003c= 1.29 - Authenticated Stored Cross-Site Scripting",
    "slug": "rss-for-yandex-turbo",
    "type": "plugin",
    "affected_version": "* - 1.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24277",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subway – Private Site Option \u003c= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API",
    "slug": "subway",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1678",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Heateor Social Login WordPress \u003c= 1.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "heateor-social-login",
    "type": "plugin",
    "affected_version": "* - 1.1.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35707",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pagerank Tools \u003c= 1.1.5 - Reflected Cross-Site Scripting",
    "slug": "pagerank-tools",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5730",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.6.1 - Deserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-4338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4338",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooDiscuz – WooCommerce Comments \u003c= 2.3.0 - Cross-Site Request Forgery",
    "slug": "woodiscuz-woocommerce-comments",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49759",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ForumWP – Forum \u0026 Discussion Board \u003c= 2.1.2 - Reflected Cross-Site Scripting via url Parameter",
    "slug": "forumwp",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11204",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shopp \u003c= 1.4 - Unauthenticated Arbitrary File Upload",
    "slug": "shopp",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24493",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "easy.jobs \u003c= 2.4.6 - Missing Authorization to Settings Update",
    "slug": "easyjobs",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6843",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Idyllic \u003c= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "idyllic",
    "type": "theme",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Remote Site Search \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-remote-site-search",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51397",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Help Desk \u003c= 2.8.1 - Unauthenticated SQL Injection via email and trackingid",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "[*, 2.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-50839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50839",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "List Pages Shortcode \u003c= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "list-pages-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4757",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Count \u003c= 3.00 - Unauthenticated PHP Object Injection",
    "slug": "quick-count",
    "type": "plugin",
    "affected_version": "* - 3.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.00",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-23932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23932",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship \u003c= 3.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) View Order Tracking Details",
    "slug": "biteship",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5816",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule \u003c= 2020.1.0 - Cross-Site Request Forgery",
    "slug": "buffer-my-post",
    "type": "plugin",
    "affected_version": "* - 2020.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2020.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58846",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Help Center by BestWebSoft \u003c= 1.0.4 - Cross-Site Scripting",
    "slug": "zendesk-help-center",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18542",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yoast SEO \u003c= 21.0 - Authenticated (Seo Manager+) Stored Cross-Site Scripting",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "* - 21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40680",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible \u003c= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation",
    "slug": "wc-frontend-manager",
    "type": "plugin",
    "affected_version": "* - 6.7.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8290",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VK All in One Expansion Unit \u003c= 9.85.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "vk-all-in-one-expansion-unit",
    "type": "plugin",
    "affected_version": "* - 9.85.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.85.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0230",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Header Image Slider \u003c= 0.3 - Reflected Cross-Site Scripting",
    "slug": "header-image-slider",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7247",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Categorify \u003c= 1.0.7.5 - Missing Authorization",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "* - 1.0.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59005",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NextGen Cooliris Gallery \u003c= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nextgen-cooliris-gallery",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25091",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EKC Tournament Manager \u003c= 2.2.1 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "ekc-tournament-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9765",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CRM Perks Forms \u003c= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "crm-perks-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2836",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto iFrame \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "auto-iframe",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10151",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Buzzsprout Podcasting \u003c= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "buzzsprout-podcasting",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5335",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Majestic Support \u003c= 1.1.0 - Unauthenticated SQL Injection",
    "slug": "majestic-support",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48283",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPGlobus – Multilingual Everything! \u003c= 1.9.6 - Cross-Site Scripting via wpglobus_option[post_type][post]",
    "slug": "wpglobus",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5367",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.17",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.10",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.9",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.8",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.5",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.20",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.18",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.17",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.14",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.4",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Mishandling Post Meta Values via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.20",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9062",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Kento Post View Counter \u003c= 2.8 - SQL Injection",
    "slug": "kento-post-view-counter",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-15040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-15040",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Web To Print Shop : uDraw \u003c= 3.3.3 - Unauthenticated Arbitrary File Access",
    "slug": "udraw",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0656",
    "auth_type": "Unauth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Yotpo Reviews for WooCommerce (Unofficial) \u003c= 2.0.4 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "yotpo-reviews-for-woocommerce",
    "type": "plugin",
    "affected_version": "2.0.4",
    "from_version": "2.0.4",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2555",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP LMS – Best WordPress LMS Plugin \u003c= 1.1.5 - Cross-Site Scripting",
    "slug": "learn-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24504",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DriCub \u003c= 2.9 - Missing Authorization",
    "slug": "dricub-driving-school",
    "type": "theme",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58004",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Premmerce Permalink Manager for WooCommerce \u003c= 2.3.10 - Unauthenticated Local File Inclusion",
    "slug": "woo-permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-27971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27971",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Safety Exit \u003c= 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "safety-exit",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35640",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Login by BestWebSoft \u003c= 0.1 - Multiple Cross-Site Scripting",
    "slug": "social-login-bws",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18501",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Tranzila Gateway \u003c= 1.0.8 - Unauthenticated PHP Object Injection",
    "slug": "woo-tranzila-gateway",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-52218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52218",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "دکمه، شبکه اجتماعی خرید \u003c= 2.0.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "dokme",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30570",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "All Post Contact Form \u003c= 1.8.0 - Unauthenticated Arbitrary File Upload",
    "slug": "allpost-contactform",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50523",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Links \u003c= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "social-links",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25112",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Checkout Mestres WP \u003c= 8.6 - Authenticated (Admin+) Local File Inclusion",
    "slug": "checkout-mestres-wp",
    "type": "plugin",
    "affected_version": "* - 8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-44030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44030",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Jetpack \u003c= 4.0.3 - Cross-Site Scripting",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[*, 4.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10705",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.2.12 - Authenticated Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.2.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-2324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2324",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SmartLink Dynamic URLs \u003c= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "smartlink-dinamic-urls",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51657",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.7.1006 - Authenticated (Admin+) Server Side Request Forgery",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1006",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1006",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26990",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Third Party Cookie Eraser \u003c= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "third-party-cookie-eraser",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53755",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prime Slider – Addons For Elementor \u003c= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rubix Widget",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1507",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker \u003c= 2.0.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-26256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-26256",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPQA - Builder forms Addon For WordPress \u003c 5.2 - Insecure Direct Object Reference to Profile Picture Deletion",
    "slug": "wpqa",
    "type": "plugin",
    "affected_version": "[*, 5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1349",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.50",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2431",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Calendar \u003c= 1.1.50 - Reflected Cross-Site Scripting",
    "slug": "event-calendar-wd",
    "type": "plugin",
    "affected_version": "* - 1.1.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25024",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zotpress \u003c= 7.3.4 - Reflected Cross-Site Scripting via 'PHP_SELF'",
    "slug": "zotpress",
    "type": "plugin",
    "affected_version": "* - 7.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46313",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP AutoKeyword \u003c= 1.0 - Missing Authorization",
    "slug": "wp-autokeyword",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28997",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Classified Listings \u003c= 1.3 - Unauthenticated Local File Inclusion",
    "slug": "ultimate-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5882",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Manager \u003c= 2.0.28 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "booking-manager",
    "type": "plugin",
    "affected_version": "* - 2.0.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1977",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Fatcat Apps Analytics Cat \u003c= 1.0.9 - Cross-Site Request Forgery",
    "slug": "analytics-cat",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-27855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27855",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Analytics Reduce Bounce Rate \u003c= 2.3 - Cross-Site Request Forgery",
    "slug": "analytics-unbounce",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9635",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Community Events \u003c= 1.5.1 - Unauthenticated SQL Injection",
    "slug": "community-events",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-10586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10586",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Makeaholic \u003c= 1.8.5 - Missing Authorization",
    "slug": "makeaholic",
    "type": "theme",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58210",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Visual Recent Posts \u003c= 1.2.3 - Reflected Cross-Site Scripting",
    "slug": "visual-recent-posts",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54403",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formula \u003c= 0.5.1 - Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_plugins",
    "slug": "formula",
    "type": "theme",
    "affected_version": "* - 0.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5638",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Akismet \u003c= 3.1.4 - Cross-Site Scripting",
    "slug": "akismet",
    "type": "plugin",
    "affected_version": "[*, 3.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9357",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GSheets Connector \u003c= 1.1.1 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "sheetlink",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53465",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VK Blocks \u003c= 1.53.0.1 - Stored (Contributor+) Cross-Site Scripting in Post",
    "slug": "vk-blocks-pro",
    "type": "plugin",
    "affected_version": "* - 1.53.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.53.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27925",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VK Blocks \u003c= 1.53.0.1 - Stored (Contributor+) Cross-Site Scripting in Post",
    "slug": "vk-blocks",
    "type": "plugin",
    "affected_version": "* - 1.53.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.53.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27925",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bradesco Gateway \u003c= 2.0 - Cross-Site Scripting",
    "slug": "bradesco-gateway",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-5916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5916",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XStore \u003c= 9.5.3 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "xstore",
    "type": "theme",
    "affected_version": "* - 9.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60100",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Spotlight Social Feeds \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spotlight-social-photo-feeds",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0379",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FunnelKit Checkout \u003c= 3.10.3 - Unauthenticated Arbitrary Content Deletion",
    "slug": "woofunnels-aero-checkout",
    "type": "plugin",
    "affected_version": "* - 3.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51672",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "StreamCast \u003c= 2.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "streamcast",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43148",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Cross-Site Request Forgery via 'deleteCacheToolbar'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1926",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VideoWhisper Video Presentation \u003c= 4.1.4 - Arbitrary File Upload",
    "slug": "videowhisper-video-presentation",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9272",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Icegram \u003c= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 3.1.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24542",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Socializer \u003c= 7.13.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "super-socializer",
    "type": "plugin",
    "affected_version": "* - 7.13.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.13.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35882",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CF7 Submissions \u003c= 0.26 - Missing Authorization",
    "slug": "cf7-submissions",
    "type": "plugin",
    "affected_version": "* - 0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58016",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Security Checker \u003c= 4.2 - Cross-Site Request Forgery",
    "slug": "ultimate-security-checker",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31456",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Under Construction / Maintenance Mode from Acurax \u003c= 2.6 - Information Exposure",
    "slug": "coming-soon-maintenance-mode-from-acurax",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1476",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 5.1.9.2 - Cross-Site Request Forgery leading to Form Metadata Deletion",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25991",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Plugmatter Optin Feature Box \u003c 2.0.14 - SQL Injection",
    "slug": "plugmatter-optin-feature-box-lite",
    "type": "plugin",
    "affected_version": "[*, 2.0.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9450",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multi-column Tag Map \u003c= 17.0.24 - Authenticated (Contributor+) Stored Cross Site Scripting",
    "slug": "multi-column-tag-map",
    "type": "plugin",
    "affected_version": "* - 17.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23815",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "amr users \u003c= 4.59.4 - Authenticated (Subscriber+) CSV Injection",
    "slug": "amr-users",
    "type": "plugin",
    "affected_version": "* - 4.59.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.59.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45348",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "ForumEngine \u003c= 1.8 - Reflected Cross-Site Scripting",
    "slug": "forumengine",
    "type": "theme",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10623",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Post Grid \u003c= 7.2.7 - Cross-Site Request Forgery",
    "slug": "the-post-grid",
    "type": "plugin",
    "affected_version": "* - 7.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39923",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slivery Extender \u003c= 1.0.2 - Authenticated(Contributor+) Remote Code Execution via shortcode",
    "slug": "slivery-extender",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-27191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27191",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sync WooCommerce Product feed to Google Shopping \u003c= 1.2.4  - Authenticated (Admin+) SQL Injection",
    "slug": "exportfeed-for-woocommerce-google-product-feed",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25068",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \u003c= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 6.0.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2836",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WangGuard \u003c 1.8.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wangguard",
    "type": "plugin",
    "affected_version": "[*, 1.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-20177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20177",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 8.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 8.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4468",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce 2.6.10-2.8.4 - Information Disclosure via Arbitrary File Read",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "2.6.10 - 2.8.4",
    "from_version": "2.6.10",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4140",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Participants Database \u003c= 2.4.5 - Cross Site Request Forgery",
    "slug": "participants-database",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47612",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPAMS \u003c= 44.0 (17-08-2023) - Unauthenticated Arbitrary File Upload",
    "slug": "apartment-management",
    "type": "plugin",
    "affected_version": "[*, 44.0 (17-08-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "44.0 (17-08-2023)",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39401",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Category Tree \u003c= 2.5 - Cross-Site Request Forgery",
    "slug": "product-category-tree",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46151",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP PagSeguro Payments \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-pagseguro-payments",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51847",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hostiko - Hosting WordPress \u0026 WHMCS Theme \u003c 30.1 - Unauthenticated Local File Inclusion",
    "slug": "hostiko",
    "type": "theme",
    "affected_version": "[*, 30.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "30.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-27015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27015",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.12 - Cross-Site Request Forgery in savetmplfile function",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25707",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0896",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Booking System \u003c= 2.0.19.10 - Missing Authorization via wpbs_refresh_calendar_editor",
    "slug": "wp-booking-system",
    "type": "plugin",
    "affected_version": "* - 2.0.19.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.19.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50425",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Live Gold Price \u0026 Silver Price Charts Widgets \u003c= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "gold-price-chart-widget",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47662",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PressApps Knowledge Base Contextual Sidebar Addon \u003c= 4.2.1 - Unauthenticated PHP Object Injection",
    "slug": "pressapps-knowledge-base",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49400",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JetBlocks For Elementor \u003c= 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30987",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 6.2.9 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 6.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-30533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-30533",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pop-Up Chop Chop \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pop-up",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41638",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.0.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2006-1796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-1796",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for WPBakery Page Builder \u003c= 3.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "Ultimate_VC_Addons",
    "type": "plugin",
    "affected_version": "* - 3.19.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46211",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Live Chat Support \u003c= 8.0.27 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-live-chat-support",
    "type": "plugin",
    "affected_version": "* - 8.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14950",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VForm \u003c= 3.1.9 - Reflected Cross-Site Scripting",
    "slug": "v-form",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30778",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventbee RSVP Widget \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "eventbee-rsvp-widget",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31838",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Feed \u003c= 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 6.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1219",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cooked – Recipe Management \u003c= 1.7.15.4 - Authenticated (Contributor+) HTML Injection",
    "slug": "cooked",
    "type": "plugin",
    "affected_version": "* - 1.7.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.15.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39682",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "UsersWP – Front-end login form, User Registration, User Profile \u0026 Members Directory plugin for WordPress \u003c= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'",
    "slug": "userswp",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6265",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgets",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1680",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio \u003c= 3.6.4 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "play-ht",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1772",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "POST SMTP Mailer \u003c= 2.5.6 - Cross-Site Request Forgery to Account Compromise",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3179",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WoodMart \u003c= 7.1.1 - Missing Authorization to Shortcode Injection",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 7.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25790",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Events Manager \u003c= 6.4.7.1 - Cross-Site Request Forgery",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30421",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Google Review Slider \u003c= 15.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-google-places-review-slider",
    "type": "plugin",
    "affected_version": "* - 15.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11109",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory \u003c= 2.8.97 - Unauthenticated SQL Injection",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.8.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.97",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13507",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "QuBotChat \u003c= 1.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "qubotchat",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2401",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "* - 7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53566",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MC Woocommerce Wishlist \u003c=  1.7.2 - Missing Authorization",
    "slug": "smart-wishlist-for-more-convert",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34819",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ActiveCampaign \u003c 8.0.2 - Cross-Site Request Forgery",
    "slug": "activecampaign-subscription-forms",
    "type": "plugin",
    "affected_version": "[*, 8.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24133",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Small Package Quotes – USPS Edition \u003c= 1.3.9 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "small-package-quotes-usps-edition",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58218",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Core Control \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "core-control",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1760",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.5.41.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.41.7212",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.41.7212",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29122",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CHP Ads Block Detector \u003c= 3.9.4 - Missing Authorization to Plugin Settings Update",
    "slug": "chp-ads-block-detector",
    "type": "plugin",
    "affected_version": "* - 3.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2353",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Universal Video Player - Addon for WPBakery Page Builder \u003c= 3.2.1 - Reflected Cross-Site Scripting",
    "slug": "lbg-universal-video-player-addon-visual-composer",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48170",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Affiliate Platform \u003c= 6.5.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "wp-affiliate-platform",
    "type": "plugin",
    "affected_version": "* - 6.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5280",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DarkMySite – Advanced Dark Mode Plugin for WordPress \u003c= 1.2.8 - Cross-Site Request Forgery",
    "slug": "darkmysite",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50466",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive Filterable Portfolio \u003c=1.0.8 - Authenticated (Admin+) SQL Injection",
    "slug": "responsive-filterable-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-25221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25221",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Manual Image Crop \u003c= 1.10 - Reflected Cross-Site Scripting",
    "slug": "manual-image-crop",
    "type": "plugin",
    "affected_version": "[*, 1.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9426",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 3.4.2.3 - Reflected Cross-Site Scripting",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 3.4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37264",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Call Now by ThikShare \u003c= 1.1.0 - Cross-Site Request Forgery via settings_page",
    "slug": "easy-call-now",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47819",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPB Advanced FAQ \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wpb-advanced-faq",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0370",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "A Forms \u003c= 1.4.2 - Reflected Cross-Site Scripting",
    "slug": "a-forms",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-10020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-10020",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi Rating \u003c= 5.0.6 - Missing Authorization to Arbitrary Ratings Value Change",
    "slug": "multi-rating",
    "type": "plugin",
    "affected_version": "* - 5.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32127",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Cross-Site Request Forgery to Profile Creation",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4935",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Camera slideshow \u003c= 1.4.0.1 - Reflected Cross-Site Scripting",
    "slug": "camera-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22682",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AR For WordPress \u003c= 7.98 - Cross-Site Request Forgery",
    "slug": "ar-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 7.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.98",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60156",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sitemap \u003c= 4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "sitemap",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4545",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DELUCKS SEO \u003c 2.1.8 -  Stored Cross Site Scripting",
    "slug": "delucks-seo",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-25146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25146",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AGCA – Custom Dashboard \u0026 Login Page \u003c= 7.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ag-custom-admin",
    "type": "plugin",
    "affected_version": "* - 7.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2907",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GMap - Venturit \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'h' Parameter",
    "slug": "gmap-venturit",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8568",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lijit Search \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-lijit-wijit",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22778",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customify \u003c= 0.4.8 - Missing Authorization",
    "slug": "customify-theme",
    "type": "theme",
    "affected_version": "* - 0.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26920",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cab fare calculator \u003c= 1.0.3 - Unauthenticated Local File Inclusion",
    "slug": "cab-fare-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1391",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ShortPixel Adaptive Images \u003c= 3.7.1 - Cross-Site Request Forgery via shortpixel_ai_handle_page_action",
    "slug": "shortpixel-adaptive-images",
    "type": "plugin",
    "affected_version": "[*, 3.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-32512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32512",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "The Hack Repair Guy's Plugin Archiver \u003c= 2.0.4 - Authenticated (Administrator+) Arbitrary File Deletion",
    "slug": "hackrepair-plugin-archiver",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10176",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Genesis Blocks \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes",
    "slug": "genesis-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3563",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c 3.0.0 - Arbitrary File Upload",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "[*, 3.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9340",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Easy FAQs \u003c= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via WP_EASY_FAQ Shortcode",
    "slug": "wp-easy-faqs",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8686",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Builder, Contact Widget \u003c= 2.1.7 - Reflected Cross-Site Scripting",
    "slug": "contact-forms-builder",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46075",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Currency per Product for WooCommerce \u003c= 1.6.0 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "currency-per-product-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31920",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Helloprint \u003c= 1.4.6 - Reflected Cross-Site Scripting",
    "slug": "helloprint",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3908",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram \u003c= 1.9.18 - Cross-Site Scripting",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "[*, 1.9.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10963",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Silencesoft RSS Reader \u003c= 0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "external-rss-reader",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60183",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LayerSlider \u003c= 7.1.1 - Admin+ Stored Cross-Site Scripting",
    "slug": "LayerSlider",
    "type": "plugin",
    "affected_version": "* - 7.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1153",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Motors – Car Dealership \u0026 Classified Listings Plugin \u003c= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.66",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.66",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3437",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SMTP Mailing Queue \u003c= 1.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "smtp-mailing-queue",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1090",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import Excel to Gravity Forms \u003c= 1.18 - Reflected Cross-Site Scripting",
    "slug": "gf-excel-import",
    "type": "plugin",
    "affected_version": "* - 1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24629",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "RegistrationMagic Plugin \u003c= 5.2.4.5 - Authenticated(Administrator+) SQL Injection",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "[*, 5.2.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50846",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Theme Changer \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "theme-changer",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39438",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Uncode Core \u003c= 2.8.6 - Reflected Cross-Site Scripting",
    "slug": "uncode-core",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51501",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation \u003c= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "ai-content-generator",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52384",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hybrid \u003c 0.10 - Cross-Site Scripting",
    "slug": "hybrid",
    "type": "theme",
    "affected_version": "[*, 0.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2011-3853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3853",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Taskbuilder \u003c= 4.0.7 - Missing Authorization",
    "slug": "taskbuilder",
    "type": "plugin",
    "affected_version": "* - 4.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30945",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Page Transition \u003c= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-page-transition",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30606",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coachify \u003c= 1.0.7 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "coachify",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37417",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "mTheme-Unus \u003c 2.3 - Directory Traversal to Unauthenticated Arbitrary File Read",
    "slug": "mTheme-Unus",
    "type": "theme",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9406",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPSpeed \u003c= 2.6.5 - Cross-Site Request Forgery",
    "slug": "wpspeed",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47590",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Cross-Site Request Forgery on ajax_save_folder",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0728",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Cookie Notice \u0026 Compliance for GDPR / CCPA \u003c= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cookies_revoke_shortcode' Shortcode",
    "slug": "cookie-notice",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0823",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Slider \u003c= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12173",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Call To Action \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "call-to-action-popup",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23605",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Limit Login Attempts \u003c= 5.5 - Unauthenticated SQL Injeciton",
    "slug": "wp-limit-failed-login-attempts",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54234",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "License For Envato \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "license-envato",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCS \u003c= 1.2.0.3 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38700",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.13 - Reflected Cross-Site Scripting",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "* - 4.9.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45458",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Email \u003c= 1.3.24 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "contact-form-to-email",
    "type": "plugin",
    "affected_version": "* - 1.3.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-42361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42361",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MDTF \u003c= 1.3.3.7 - Unauthenticated SQL Injection",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54707",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "KiwiChat NextClient \u003c= 6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter",
    "slug": "kiwichat",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3670",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ebook Store \u003c= 5.8012 - Unauthenticated Arbitrary File Upload",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.8012",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8012",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7437",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "amazing neo icon font for elementor \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "amazing-neo-icon-font-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50543",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Stripe Checkout \u003c= 1.2.2.37 - Sensitive Information Exposure via Debug Log",
    "slug": "wp-stripe-checkout",
    "type": "plugin",
    "affected_version": "* - 1.2.2.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-52143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52143",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "uContext for Clickbank \u003c= 3.9.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "ucontext",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2542",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cart66 Lite :: WordPress Ecommerce \u003c 1.5.1.15 - Cross-Site Request Forgery",
    "slug": "cart66-lite",
    "type": "plugin",
    "affected_version": "[*, 1.5.1.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-5977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5977",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Countdown \u0026 Clock \u003c= 2.8.8 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "countdown-builder",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30841",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 4.2.2 - Missing Authorization to Test Email",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19980",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Location Click Map \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "location-click-map",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51844",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XiSearch bar \u003c= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "xisearch-bar",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6063",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.112",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.112",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6170",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Frontend \u003c= 4.1.12 - Missing Authorization",
    "slug": "wp-user-frontend",
    "type": "plugin",
    "affected_version": "* - 4.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58672",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Web Accessibility with Max Access \u003c= 2.0.9 - Cross-Site Request Forgery",
    "slug": "accessibility-toolbar",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47681",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hide login page \u003c= 1.1.7 - Login Page Disclosure",
    "slug": "hide-login-page",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48335",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Bookalet \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bookalet",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23899",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart PopUp Blaster \u003c= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-popup-blaster",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GravatarLocalCache \u003c= 1.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "gravatarlocalcache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23901",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Google Universal Analytics \u003c= 1.0.3 - Missing Authorization",
    "slug": "advanced-google-universal-analytics",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28962",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Site Reviews \u003c= 2.15.2 - Cross-Site Scripting",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "[*, 2.15.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-0603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0603",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Table Builder – WordPress Table Plugin \u003c= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-table-builder",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46852",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kama Click Counter \u003c= 3.4.9 - Cross-Site Scripting",
    "slug": "kama-clic-counter",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18615",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ExactMetrics \u003c= 7.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-analytics-dashboard-for-wp",
    "type": "plugin",
    "affected_version": "* - 7.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23880",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Firebase Push Notification \u003c= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification",
    "slug": "wp-push-notification-firebase",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5924",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Media folder \u003c= 5.7.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-media-folder",
    "type": "plugin",
    "affected_version": "* - 5.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-25909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25909",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar \u003c= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode",
    "slug": "mp3-music-player-by-sonaar",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5664",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CouponXxL \u003c= 4.5.0 - Cross-Site Request Forgery",
    "slug": "couponxxl",
    "type": "theme",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58013",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "3com – Asesor de Cookies \u003c= 3.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "3com-asesor-de-cookies",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40697",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hide Real Download Path \u003c= 1.6 - Cross-Site Request Forgery",
    "slug": "hide-real-download-path",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58849",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Content Mask \u003c= 1.8.5.2 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "content-mask",
    "type": "plugin",
    "affected_version": "* - 1.8.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58011",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Portfolio for Elementor \u0026 Image Gallery | PowerFolio \u003c= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS",
    "slug": "portfolio-elementor",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7046",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Game Server Status \u003c= 1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "game-server-status",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24662",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Template Kit – Import \u003c= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload",
    "slug": "template-kit-import",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2334",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4643",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms File Uploads \u003c= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload",
    "slug": "ninja-forms-uploads",
    "type": "plugin",
    "affected_version": "* - 3.3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1596",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Store Finder \u003c= 6.9.3 - Unauthenticated Email Creation/Sending",
    "slug": "superstorefinder-wp",
    "type": "plugin",
    "affected_version": "* - 6.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5054",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Elastic Email Sender \u003c= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "elastic-email-sender",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38387",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Multistore Locator — WP Store Locator Plugin: Effortless Integration With Snazzy Maps \u003c= 2.5.0 - Reflected Cross-Site Scripting",
    "slug": "wp-multi-store-locator",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24680",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accessibility by AllAccessible \u003c= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update",
    "slug": "allaccessible",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11643",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Forms: 3rd-Party Post Again \u003c= 0.3 - Reflected Cross-Site Scripting",
    "slug": "forms-3rdparty-post-again",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51783",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZenphotoPress \u003c= 1.8 - Reflected Cross-Site Scripting",
    "slug": "zenphotopress",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28924",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS Pro \u003c= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "masterstudy-lms-learning-management-system-pro",
    "type": "plugin",
    "affected_version": "* - 4.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4800",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EditionGuard for WooCommerce – eBook Sales with DRM \u003c= 3.4.2 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "editionguard-for-woocommerce-ebook-sales-with-drm",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56207",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin \u003c= 1.5.58 - Arbitrary File Upload",
    "slug": "users-ultra",
    "type": "plugin",
    "affected_version": "[*, 1.5.59)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.59",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9402",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pinpoint Booking System \u003c= 2.9.9.3.4 - Content Spoofing",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "* - 2.9.9.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38520",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider \u003c= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.15.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.15.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8442",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Throws SPAM Away \u003c= 3.3 - Cross-Site Request Forgery to Comment Modification",
    "slug": "throws-spam-away",
    "type": "plugin",
    "affected_version": "[*, 3.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1709",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Grace Mag \u003c= 1.1.5 - Unauthenticated Local File Inclusion",
    "slug": "grace-mag",
    "type": "theme",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39360",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Trinity Audio \u003c= 5.20.2 - Reflected Cross-Site Scripting",
    "slug": "trinity-audio",
    "type": "plugin",
    "affected_version": "* - 5.20.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.20.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9952",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Posts \u003c= 1.8.1 - Reflected Cross-Site Scripting",
    "slug": "related-posts",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9361",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BetterDocs \u003c= 3.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "betterdocs",
    "type": "plugin",
    "affected_version": "* - 3.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43227",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IP Blacklist Cloud \u003c= 3.42 - Authenticated (Admin+) Path Traversal",
    "slug": "ip-blacklist-cloud",
    "type": "plugin",
    "affected_version": "* - 3.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10105",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Youtube Shortcode \u003c= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "youtube-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23687",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sticky Social Bar \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "sticky-social-bar",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51631",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Slider \u003c= 1.4.8 - Authenticated (Admin+) SQL Injection",
    "slug": "logo-slider",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1687",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Poptin \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "poptin",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4961",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "igumbi Online Booking \u003c= 1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "igumbi-online-booking",
    "type": "plugin",
    "affected_version": "* - 1.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13455",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Slider – Responsive Touch Slider \u003c= 3.9.9 - Authenticated(Editor+) Stored Cross-Site Scripting via slider callback",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0611",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Site Verify \u003c= 1.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-site-verify",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36688",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All In One SEO Pack \u003c= 4.8.7.1 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "* - 4.8.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58649",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "En Masse \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "en-masse-wp",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23707",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP People \u003c= 3.4.1 - SQL Injection",
    "slug": "wp-people",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-0845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0845",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Greenshift – animation and page builder blocks \u003c= 9.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 9.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44005",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "xili-language \u003c= 2.21.2 - Reflected Cross-Site Scripting",
    "slug": "xili-language",
    "type": "plugin",
    "affected_version": "* - 2.21.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.21.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31085",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking for Appointments and Events Calendar – Amelia \u003c= 1.2.19 - Unauthenticated Full Path Disclosure",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2578",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPLegalPages \u003c= 2.9.2 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wplegalpages",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4968",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Pro \u003c= 1.10.4 - Reflected Cross-Site Scripting",
    "slug": "business-pro",
    "type": "theme",
    "affected_version": "* - 1.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40214",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog2Social: Social Media Auto Post \u0026 Scheduler \u003c= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "* - 7.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7302",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GSheetConnector For Gravity Forms \u003c= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation",
    "slug": "gsheetconnector-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 1.3.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8593",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Nasa Core \u003c= 6.3.2 - Reflected Cross-Site Scripting",
    "slug": "nasa-core",
    "type": "plugin",
    "affected_version": "* - 6.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39508",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Doc Embedder \u003c= 2.6.4 - Authenticated (Contributor+) Blind Server Side Request Forgery",
    "slug": "google-document-embedder",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0216",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meta Tag Manager \u003c= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "meta-tag-manager",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1770",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Restaurant Reservations \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nd-restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51403",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.0.11 - Missing Authorization to Unauthenticated Data Export",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1109",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Website Contact Form With File Upload \u003c= 1.3.4 - Arbitrary File Upload",
    "slug": "website-contact-form-with-file-upload",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-10137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10137",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NextMove Lite – Thank You Page for WooCommerce \u003c= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission",
    "slug": "woo-thank-you-page-nextmove-lite",
    "type": "plugin",
    "affected_version": "* - 2.19.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.19.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10860",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Popup Banners \u003c= 1.2.5 - Authenticated (Subscriber+) SQL Injection via 'value'",
    "slug": "wp-popup-banners",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28661",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "eCommerce Product Catalog \u003c= 3.3.28 - Cross-Site Request Forgery",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "* - 3.3.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32437",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MpOperationLogs \u003c= 1.0.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "mpoperationlogs",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5538",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gosign – Posts Slider Block \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gosign-posts-slider-block",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13399",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function",
    "slug": "ultimate-wp-mail",
    "type": "plugin",
    "affected_version": "1.0.17 - 1.3.6",
    "from_version": "1.0.17",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6993",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wpForo + wpForo Advanced Attachments \u003c= 3.1.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wpforo-advanced-attachments",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4224",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Compliance \u003c= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gdpr-cookie-compliance",
    "type": "plugin",
    "affected_version": "* - 4.15.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1620",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VForm \u003c= 3.0.0 - Reflected Cross-Site Scripting",
    "slug": "v-form",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54302",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Last Youtube Video \u003c= 1.0.7 - Cross-Site Request Forgery",
    "slug": "auto-last-youtube-video",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58843",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Form Integration \u003c= 1.95.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "advanced-form-integration",
    "type": "plugin",
    "affected_version": "* - 1.95.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.95.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56293",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Himalayas \u003c= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "himalayas",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39629",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exertio \u003c= 1.3.2 - Unauthenticated PHP Object Injection",
    "slug": "exertio",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54686",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler \u003c= 1.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting",
    "slug": "cf7-styler",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12419",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "LeadConnector \u003c= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion",
    "slug": "leadconnector",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1371",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function",
    "slug": "hydra-booking",
    "type": "plugin",
    "affected_version": "1.1.0 - 1.1.18",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7689",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Admin SMS Alert\u003c=1.1.0 - Cross-Site Request Forgery to Stored Cross Site Scripting",
    "slug": "admin-sms-alert",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51637",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Database Applications by Caspio \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-database-applications-by-caspio",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31559",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS – eLearning and online course solution \u003c= 1.7.6 - SQL Injection",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "[*, 1.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24181",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Geolocation IP Detection \u003c= 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "geoip-detect",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57993",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integrate Google Drive \u003c= 1.3.9 - Missing Authorization",
    "slug": "integrate-google-drive",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32813",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "VM Backups \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "vm-backups",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24172",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Amelia \u003c= 1.0.46 - Cross-Site Request Forgery",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.0.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0616",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Panorama \u003c= 1.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-panorama",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23799",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Catch Breadcrumb \u003c= 1.5.4 - Reflected Cross-Site Scripting",
    "slug": "catch-breadcrumb",
    "type": "plugin",
    "affected_version": "[*, 1.5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-12054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12054",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The World \u003c= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "the-world",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31388",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Everest News Pro \u003c= 1.1.7 - Reflected Cross-Site Scripting",
    "slug": "everest-news-pro",
    "type": "theme",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41235",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Monitor.chat \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "monitor-chat",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49639",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Student Results \u003c= 2.2.8 -  Missing Authorization to Sensitive Information Disclosure",
    "slug": "easy-student-results",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2379",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Real Spaces - WordPress Properties Directory Theme \u003c= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member'",
    "slug": "real-spaces",
    "type": "theme",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8218",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Thrive Automator \u003c= 1.17 - Cross-Site Request Forgery",
    "slug": "thrive-automator",
    "type": "plugin",
    "affected_version": "* - 1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51531",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "my-related-posts \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "my-related-posts",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23476",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Checkout with Zelle on Woocommerce \u003c= 3.1 - Missing Authorization",
    "slug": "wc-zelle",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-37969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37969",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Portfolio Manager Pro  3.8 - Unauthenticated PHP Object Injection",
    "slug": "otw-portfolio-manager",
    "type": "plugin",
    "affected_version": "3.8",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49409",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "link-list-manager \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "link-list-manager",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39311",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page View Counts \u003c= 2.4.8 - Contributor+ Stored Cross-Site Scripting",
    "slug": "page-views-count",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24509",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Attachments \u003c= 5.0.11 - Cross-Site Request Forgery",
    "slug": "wp-attachments",
    "type": "plugin",
    "affected_version": "* - 5.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45651",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Genesis Style Shortcodes \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "genesis-style-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22823",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Terser \u003c 4.8.1 and 5.0.0-5.14.1 - Regular Expression Denial of Service",
    "slug": "publisher-media-kit",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25858",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Terser \u003c 4.8.1 and 5.0.0-5.14.1 - Regular Expression Denial of Service",
    "slug": "retro-winamp-block",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25858",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Terser \u003c 4.8.1 and 5.0.0-5.14.1 - Regular Expression Denial of Service",
    "slug": "maps-block-apple",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25858",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Terser \u003c 4.8.1 and 5.0.0-5.14.1 - Regular Expression Denial of Service",
    "slug": "autoshare-for-twitter",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25858",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "SEO Redirection \u003c= 6.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "seo-redirection",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24327",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ActiveDEMAND \u003c= 0.2.41 - Unauthenticated Arbitrary File Upload",
    "slug": "activedemand",
    "type": "plugin",
    "affected_version": "* - 0.2.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.41",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32809",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Stripe Payments For WooCommerce by Checkout \u003c= 1.9.1 - Cross-Site Request Forgery",
    "slug": "checkout-plugins-stripe-woo",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43316",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce POS \u003c= 1.7.8 - Missing Authorization",
    "slug": "woocommerce-pos",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48117",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Listingo \u003c= 3.2.5 - Unauthenticated Arbitrary File Upload",
    "slug": "listingo",
    "type": "theme",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3921",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Content Shortcode \u003c= 4.0.1 - Authenticated Arbitrary File Access / Local File Inclusion",
    "slug": "custom-content-shortcode",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24825",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Image Zoom \u003c= 1.23 - Cross-Site Request Forgery to Denial of Service",
    "slug": "wp-image-zoooom",
    "type": "plugin",
    "affected_version": "* - 1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-1000510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000510",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.5.6 - Authorization Bypass",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3794",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Roi Calculator \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "roi-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24756",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Demo My WordPress \u003c= 1.0.9.1 - Unauthenticated Privilege Escalation",
    "slug": "demo-my-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Softtemplates For Elementor \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "softtemplates-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53764",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ask Me \u003c 6.8.7 - Cross-Site Request Forgery",
    "slug": "ask-me",
    "type": "theme",
    "affected_version": "[*, 6.8.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-3750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3750",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Super Store Finder \u003c= 6.9.7 - Unauthenticated SQL Injection",
    "slug": "superstorefinder-wp",
    "type": "plugin",
    "affected_version": "* - 6.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43978",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "SEO Tools \u003c= 4.0.7 - Reflected Cross-Site Scripting",
    "slug": "seo-automatic-seo-tools",
    "type": "plugin",
    "affected_version": "* - 4.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13853",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsReady Addons for Elementor \u003c= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "element-ready-lite",
    "type": "plugin",
    "affected_version": "* - 6.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5152",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integration for WooCommerce and Zoho CRM \u003c= 1.3.6 - Open Redirect via setup_plugin",
    "slug": "woo-zoho",
    "type": "plugin",
    "affected_version": "[*, 1.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-38481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38481",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CM Tooltip Glossary \u003c= 4.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "enhanced-tooltipglossary",
    "type": "plugin",
    "affected_version": "* - 4.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme Junkie Team Content \u003c= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "theme-junkie-team-content",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53301",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video List Manager \u003c= 1.7 - Reflected Cross-Site Scripting",
    "slug": "video-list-manager",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52776",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy CSV Importer BETA \u003c= 7.0.0 - Unauthenticated Arbitrary File Upload",
    "slug": "easy-csv-importer",
    "type": "plugin",
    "affected_version": "* - 7.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52372",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Membership \u003c= 4.5.3 - Unauthenticated Open Redirect",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49682",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery \u003c= 3.38 - Authenticated (Admin+) PHAR Deserialization",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.38",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3154",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dashboard Widget Sidebar \u003c= 1.2.3 - Missing Authorization",
    "slug": "dashboard-widget-sidebar",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53293",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cookies by JM \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cookies-by-jm",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40604",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DL Leadback \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "dl-leadback",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26585",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet \u003c= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "paid-membership",
    "type": "plugin",
    "affected_version": "* - 2.9.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13391",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wbcom Designs - Custom Font Uploader \u003c= 2.3.4 - Missing Authorization to Font Deletion",
    "slug": "custom-font-uploader",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5489",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Participants Database \u003c= 2.5.9.2 - Unauthenticated PHP Object Injection",
    "slug": "participants-database",
    "type": "plugin",
    "affected_version": "* - 2.5.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43141",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 4.1.6 - Cross-Site Scripting",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 4.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14364",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Datepicker \u003c= 2.6.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "contact-form-7-datepicker",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11516",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \u003c= 1.27.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-and-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.27.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22759",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON \u003c= 2.4 - Unauthenticated Local File Inclusion",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32614",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.3 - Missing Authorization in 'saveSitemapSettings'",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1023",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5790",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARMember \u003c= 3.4.11 - Unauthenticated SQL Injection",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 3.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-46808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46808",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP BrowserUpdate \u003c= 4.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-browser-update",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28690",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Action Network 1.4.3 -Authentcated (Admin+) SQL Injection",
    "slug": "wp-action-network",
    "type": "plugin",
    "affected_version": "1.4.3",
    "from_version": "1.4.3",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2954",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.12.10 - Cross-Site Request Forgery to Membership Modification",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 2.12.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1407",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Post Duplicator \u003c= 2.23 - Cross-Site Scripting",
    "slug": "post-duplicator",
    "type": "plugin",
    "affected_version": "[*, 2.24)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.24",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-33852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-33852",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobCareer | Job Board Responsive WordPress Theme \u003c= 2.5.1 - Stored Cross-Site Scripting",
    "slug": "jobcareer",
    "type": "plugin",
    "affected_version": "[*, 2.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15869",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mingle Forum \u003c= 1.0.33.3 - SQL Injection",
    "slug": "mingle-forum",
    "type": "plugin",
    "affected_version": "* - 1.0.33.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.33.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-0735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-0735",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP MathJax \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-mathjax-plus",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53758",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Facebook Chat Plugin \u003c= 1.5 - Missing Capabilities Check",
    "slug": "facebook-messenger-customer-chat",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36838",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "DELUCKS SEO \u003c= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "delucks-seo",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53570",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SimpleGMaps \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simplegmaps",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52346",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nimbata Call Tracking \u003c= 1.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "nimbata-call-tracking",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32616",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3518",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.12.10 - Cross-Site Request Forgery",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 2.12.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32793",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Bicycleshop \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bicycleshop",
    "type": "theme",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54345",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Doctor Appointment Booking \u003c= 1.0.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "doctor-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27263",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Charitable \u003c= 1.8.1.7 - Missing Authorization to Unauthorized Donation",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "* - 1.8.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37506",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Google Photos Gallery with Shortcodes \u003c= 4.0.2 - Reflected Cross-Site Scripting",
    "slug": "google-picasa-albums-viewer",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51373",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "QRMenu Restaurant QR Menu Lite \u003c= 1.0.3 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "qrmenu-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52445",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DMCA WaterMarker \u003c 1.1 - Cross-Site Scripting",
    "slug": "dmca-watermarker",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4520",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ditty \u003c= 3.0.32 - Authenticated (Contributor+) Stored Cross-Scripting via Shortcode",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.0.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23874",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sign-up Sheets \u003c= 2.2.8 - Cross-Site Request Forgery",
    "slug": "sign-up-sheets",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39165",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Cross-Site Request Forgery via 'wpfc_purgecache_varnish_callback'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1920",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Compliance \u003c= 4.15.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gdpr-cookie-compliance",
    "type": "plugin",
    "affected_version": "* - 4.15.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1623",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Stored Cross-Site Scripting via filenames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.17",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Stored Cross-Site Scripting via filenames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.17",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Stored Cross-Site Scripting via filenames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.14",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Stored Cross-Site Scripting via filenames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.9",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Stored Cross-Site Scripting via filenames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.8",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Stored Cross-Site Scripting via filenames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.5",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Stored Cross-Site Scripting via filenames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.20",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Stored Cross-Site Scripting via filenames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.10",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Stored Cross-Site Scripting via filenames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.4",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Stored Cross-Site Scripting via filenames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.7.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Stored Cross-Site Scripting via filenames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.18",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GS Testimonial Slider \u003c= 3.3.0 - Missing Authorization",
    "slug": "gs-testimonial",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47467",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Affiliates Manager \u003c= 2.6.5 - Cross-Site Request Forgery",
    "slug": "affiliates-manager",
    "type": "plugin",
    "affected_version": "[*, 2.6.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15868",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Time Slots Booking Form \u003c= 1.1.62 - Stored Cross-Site Scripting",
    "slug": "wp-time-slots-booking-form",
    "type": "plugin",
    "affected_version": "* - 1.1.62",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.62",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0389",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Realtyna Organic IDX plugin \u003c= 4.14.4 - Reflected Cross-Site Scripting",
    "slug": "real-estate-listing-realtyna-wpl",
    "type": "plugin",
    "affected_version": "* - 4.14.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33924",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Vietnam Checkout \u003c= 2.0.4 - Reflected Cross-Site Scripting",
    "slug": "woo-vietnam-checkout",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46843",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra \u003c= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Weather Station \u003c= 3.8.11 - Cross-Site Request Forgery",
    "slug": "live-weather-station",
    "type": "plugin",
    "affected_version": "* - 3.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25478",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.5.1.8 - Reflected Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-1002008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1002008",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Biagiotti Core \u003c= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "biagiotti-core",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9057",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8282",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Database Backup for WordPress \u003c= 2.5 - Admin+ SQL Injection",
    "slug": "wp-db-backup",
    "type": "plugin",
    "affected_version": "[*, 2.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0255",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry \u0026 Carousel \u003c= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 2.4.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12119",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sitewide Discount for WooCommerce: Apply Discount to All Products \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "global-shop-discount-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48248",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Content by Country \u003c= 3.1.2 - Cross-Site Request Forgery",
    "slug": "custom-content-by-country",
    "type": "plugin",
    "affected_version": "3.1.2",
    "from_version": "3.1.2",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41650",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Activity Log \u003c= 5.2.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-security-audit-log",
    "type": "plugin",
    "affected_version": "* - 5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0924",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder – More than Just a Page Builder \u003c= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.25.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8236",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 1.6.5 - Cross-Site Scripting via langid parameter",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19111",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woo Custom Emails \u003c= 2.2 - Missing Authorization to Unauthenticated Settings Change",
    "slug": "woo-custom-emails",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32507",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP System Information \u003c= 1.5 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "wp-system-info",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57916",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP-PostViews \u003c 1.63 - Cross-Site Request Forgery",
    "slug": "wp-postviews",
    "type": "plugin",
    "affected_version": "[*, 1.63)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.63",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-3252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3252",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Blocks – Gutenberg Blocks for WordPress \u003c= 2.1.42 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-blocks-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.1.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56245",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Delete Comments By Status \u003c= 2.1.1 - Unauthenticated Local File Inclusion",
    "slug": "delete-comments-by-status",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-25130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25130",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP OAuth Server \u003c= 3.0.4 - Authentication Bypass",
    "slug": "miniorange-oauth-20-server",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-34149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34149",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Pricing Table \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-pricing-table",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51899",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Page Generator Plugin \u003c= 3.3.17 - Cross-Site Request Forgery to SQL Injection",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 3.3.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.17",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-2608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2608",
    "auth_type": "Unauth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "UX Flat \u003c= 4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ux-flat",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2459",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Transposh WordPress Translation \u003c= 1.0.9.6 - Authorization Bypass",
    "slug": "transposh-translation-filter-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2536",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Testimonial Widget \u003c= 3.1 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-testimonial-widget",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43966",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Edwiser Bridge – WordPress Moodle LMS Integration \u003c= 3.0.8 - Reflected Cross-Site Scripting",
    "slug": "edwiser-bridge",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24593",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MSHOP MY SITE \u003c= 1.1.7 - Missing Authorization via update_settings",
    "slug": "mshop-mysite",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47243",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Print Barcode Labels for your WooCommerce products/orders \u003c= 3.4.9 - Missing Authorization",
    "slug": "a4-barcode-generator",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43310",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LetsRecover \u003c= 1.1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "letsrecover-woocommerce-abandoned-cart",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4355",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Booking System – Booking Calendar \u003c 1.4 - Cross-Site Scripting",
    "slug": "wp-booking-system",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-2168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2168",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Booking System – Booking Calendar \u003c 1.4 - Cross-Site Scripting",
    "slug": "wp-booking-system-premium",
    "type": "plugin",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-2168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2168",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Banner \u003c= 2.10.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-banner",
    "type": "plugin",
    "affected_version": "* - 2.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24574",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PayPal Responder \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "paypal-responder",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53750",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Comments Extension \u003c= 4.0.6 - Missing Authorization",
    "slug": "mainwp-comments-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23663",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShopLentor \u003c= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34767",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscription Popup \u003c= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode",
    "slug": "email-subscribe",
    "type": "plugin",
    "affected_version": "* - 1.2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11195",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Master \u003c= 3.4.10 - Reflected Cross-Site Scripting",
    "slug": "ajax-filter-posts",
    "type": "plugin",
    "affected_version": "* - 3.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43156",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "leenk.me \u003c 2.6.0 - Stored Cross-Site Scripting",
    "slug": "leenkme",
    "type": "plugin",
    "affected_version": "[*, 2.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10988",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MoveTo \u003c= 6.2 - Missing Authorization to Unauthenticated Options Update",
    "slug": "moveto",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-25912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25912",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ElementsKit Pro \u003c= 3.6.6 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "elementskit",
    "type": "plugin",
    "affected_version": "* - 3.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7063",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Crayon Syntax Highlighter \u003c= 2.8.4 - Authenticated (Contributor+) Server Side Request Forgery",
    "slug": "crayon-syntax-highlighter",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4893",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Contact Form 7 \u003c= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'",
    "slug": "ultimate-addons-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 3.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6220",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JetPopup \u003c= 2.0.15 - Authenticated (Subscriber+) Information Disclosure",
    "slug": "jet-popup",
    "type": "plugin",
    "affected_version": "* - 2.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53993",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ADFO – Custom data in admin dashboard \u003c= 1.9.0 - Reflected Cross-Site Scripting",
    "slug": "admin-form",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4104",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes \u003c= 1.4.9 - Authenticated (Subscriber+) SQL Injection",
    "slug": "elex-bulk-edit-products-prices-attributes-for-woocommerce-basic",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47645",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "If Menu \u003c= 0.16.3 - Missing Authorization to Admin Settings Modification",
    "slug": "if-menu",
    "type": "plugin",
    "affected_version": "* - 0.16.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.16.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41698",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Popup \u003c= 4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-popup-plugin",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38689",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress \u0026 WooCommerce \u003c= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication",
    "slug": "hurrytimer",
    "type": "plugin",
    "affected_version": "* - 2.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8667",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Coder \u003c= 3.5 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-coder",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2578",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS in Page \u003c= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rss-in-page",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25096",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YourMembers \u003c= 3.0 - SQL Injection",
    "slug": "yourmembers",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-100003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-100003",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cresta Addons for Elementor \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cresta-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51680",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker \u003c 1.5.6 - Authenticated SQL Injection",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "[*, 1.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24459",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rss for Yandex Turbo \u003c= 1.30 - Admin+ Stored Cross-Site Scripting",
    "slug": "rss-for-yandex-turbo",
    "type": "plugin",
    "affected_version": "* - 1.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24428",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Login Redirect \u003c= 2.2.4 - Cross-Site Request Forgery",
    "slug": "woo-login-redirect",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44995",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Folder \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "media-folder",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52786",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yuki \u003c= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset",
    "slug": "yuki",
    "type": "theme",
    "affected_version": "* - 1.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1388",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup Builder – Create highly converting, mobile friendly marketing popups. \u003c= 4.1.11 - Cross-Site Request Forgery to Settings Update",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 4.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29495",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Donation Forms WP by Givecloud \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "donation-forms-by-givecloud",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58842",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 2.1.6 - Authenticated (Contributor+) SQL Injection",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25151",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Unlimited Addons for WPBakery Page Builder \u003c= 1.0.42 - Authenticated (Editor+) Arbitrary File Upload",
    "slug": "unlimited-addons-for-wpbakery-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.42",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6925",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FL3R FeelBox \u003c= 8.1 - Cross-Site Request Forgery leading to Plugin Settings Reset",
    "slug": "fl3r-feelbox",
    "type": "plugin",
    "affected_version": "* - 8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4553",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Aajoda Testimonials \u003c= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "aajoda-testimonials",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51614",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid  \u003c= 5.9.4.3 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26999",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Autoglot \u003c= 2.4.7 - Reflected Cross-Site Scripting",
    "slug": "autoglot",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24548",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.3.1 - Captcha Bypass",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Engine \u003c= 6.4.0 - Missing Authorization",
    "slug": "wplr-sync",
    "type": "plugin",
    "affected_version": "* - 6.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43332",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PhoneTrack Meu Site Manager \u003c= 0.1 - Cross-Site Scripting",
    "slug": "phonetrack-meu-site-manager",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24534",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Selection Lite \u003c= 1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "selection-lite",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43147",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Download Manager \u003c= 2.7.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "cm-download-manager",
    "type": "plugin",
    "affected_version": "[*, 2.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-27344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-27344",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web and WooCommerce Addons for WPBakery Builder \u003c= 1.4.7 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "vc-addons-by-bit14",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43960",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Table Manager \u003c= 1.5.6 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-table-manager",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4858",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML filter and csv-file search \u003c= 2.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode",
    "slug": "hk-filter-and-search",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5099",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation \u003c= 2.15.3 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "optinmonster",
    "type": "plugin",
    "affected_version": "* - 2.15.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33691",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gaxx Keywords \u003c= 0.2 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "gaxx-keywords",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54438",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
  },
  {
    "title": "Feed Them Social – for Twitter feed, Youtube and more \u003c= 2.9.9 - Reflected Cross-Site Scripting",
    "slug": "feed-them-social",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2383",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Connexion Logs \u003c= 3.0.2 - Cross-Site Request Forgery to Log Deletion",
    "slug": "logs-de-connexion",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11373",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "underConstruction \u003c= 1.20 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "underconstruction",
    "type": "plugin",
    "affected_version": "[*, 1.21)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1896",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "E Unlocked - Student Result \u003c= 1.0.4 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "e-unlocked-student-result",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2381",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Broken Images \u003c= 0.2 - Cross-Site Request Forgery",
    "slug": "wp-broken-images",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31093",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fotomoto \u003c= 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "fotomoto",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45007",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YOP Poll \u003c= 5.8.0 - Reflected Cross-Site Scripting",
    "slug": "yop-poll",
    "type": "plugin",
    "affected_version": "[*, 5.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-2127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2127",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Residential Address Detection \u003c= 2.5.9 - Missing Authorization",
    "slug": "residential-address-detection",
    "type": "plugin",
    "affected_version": "* - 2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48155",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WCFM – Frontend Manager for WooCommerce \u003c= 6.7.8 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "wc-frontend-manager",
    "type": "plugin",
    "affected_version": "* - 6.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29929",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextGEN Gallery \u003c= 3.59.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.59.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.59.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39627",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 3.15.1 - Unauthenticated Full Path Disclosure",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.15.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6551",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SlimStat Analytics \u003c= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1073",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider \u003c= 3.2.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "post-slider-and-carousel",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4567",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Metabox \u003c= 1.5 - Cross-Site Request Forgery via gallery_remove",
    "slug": "gallery-metabox",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47134",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "jAlbum Bridge \u003c= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jalbum-bridge",
    "type": "plugin",
    "affected_version": "* - 2.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30768",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Knowledge Base for Documentation, FAQs with AI Assistance \u003c= 11.30.2 - Unauthenticated PHP Object Injection in is_article_recently_viewed",
    "slug": "echo-knowledge-base",
    "type": "plugin",
    "affected_version": "* - 11.30.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.30.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-24842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24842",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Business Contact Widget \u003c= 2.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "business-contact-widget",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46529",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Passwordless WP – Login with your glance or fingerprint \u003c= 1.1.6 - Reflected Cross-Site Scripting",
    "slug": "passwordless-wp",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23792",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 8.0.7 - Cross-Site Request Forgery",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46862",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BlockSpare: Gutenberg Blocks \u0026 Patterns for Blogs, Magazines, Business Sites \u003c= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets",
    "slug": "blockspare",
    "type": "plugin",
    "affected_version": "* - 3.2.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4684",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cozy Blocks \u003c= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cozy-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50502",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPLMS \u003c 1.9.9.5 - Authenticated (Student+) Remote Code Execution",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "[*, 1.9.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-56051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56051",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GS Coaches \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gs-coach",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56262",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classified Listing – Classified ads \u0026 Business Directory Plugin \u003c= 3.1.7 - Missing Authorization",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7888",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "GamiPress – The #1 gamification plugin to reward points, achievements, badges \u0026 ranks in WordPress \u003c= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 7.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11036",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WPCasa \u003c= 1.2.13 - Insecure Direct Object Reference",
    "slug": "wpcasa",
    "type": "plugin",
    "affected_version": "* - 1.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53826",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SEUR Oficial \u003c= 2.2.11 - Reflected Cross-Site Scripting",
    "slug": "seur",
    "type": "plugin",
    "affected_version": "* - 2.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9438",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Glossy Blog \u003c= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "glossy-blog",
    "type": "theme",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26934",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Limit Login Attempts (Spam Protection) \u003c= 4.9.1 - Unauthenticated SQL Injection",
    "slug": "wp-limit-failed-login-attempts",
    "type": "plugin",
    "affected_version": "* - 4.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0787",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Amelia \u003c= 1.0.46 - Stored Cross Site Scripting via lastName",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.0.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.46",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0834",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "QuickCal \u003c= 1.0.15 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "quickcal",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32299",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Replyable – Subscribe to Comments and Reply by Email \u003c 1.4.6 - Cross-Site Scripting",
    "slug": "postmatic",
    "type": "plugin",
    "affected_version": "[*, 1.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9411",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Genealogical Tree \u003c= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "genealogical-tree",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58023",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Media Share Buttons \u0026 Social Sharing Icons \u003c= 2.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ultimate-social-media-icons",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10362",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ashe Extra \u003c= 1.2.91 - Missing Authorization via multiple AJAX actions",
    "slug": "ashe-extra",
    "type": "plugin",
    "affected_version": "* - 1.2.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46079",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Healsoul \u003c= 2.0.2 - Unauthenticated Local File Inclusion",
    "slug": "healsoul",
    "type": "theme",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32309",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Classified Listing – Classified ads \u0026 Business Directory Plugin \u003c= 4.0.4 - Unauthenticated Settings Exposure",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1063",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Bridge - Creative Multipurpose WordPress Theme \u003c 11.2 - Cross-Site Scripting",
    "slug": "bridge",
    "type": "theme",
    "affected_version": "[*, 11.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-13138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-13138",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KiviCare – Clinic \u0026 Patient Management System (EHR) \u003c= 3.6.4 - Unauthenticated SQL Injection",
    "slug": "kivicare-clinic-management-system",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11728",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Cancel order request WooCommerce \u003c= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cancel-order-request-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29423",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Himer - Social Questions and Answers \u003c= 2.1.2 - Cross-Site Request Forgery to Arbitrary User Invites",
    "slug": "himer",
    "type": "theme",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2232",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WP DS Blog Map \u003c= 3.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-ds-blog-map",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2425",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailChimp Forms by MailMunch \u003c= 3.2.3 - Reflected Cross-Site Scripting",
    "slug": "mailchimp-forms-by-mailmunch",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8726",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 7.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49244",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LetterPress – Elevate Your WordPress Site\u0026#039;s E-Mail Campaigns and Marketing \u003c= 1.2.2 - Cross-Site Request Forgery",
    "slug": "letterpress",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3590",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "BookingPress \u003c= 1.1.22 - Unauthenticated File Export Download",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12274",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NewStatPress \u003c 1.2.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "newstatpress",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18575",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon Booking System and Salon Booking System Pro \u003c= 7.6.2 - Sensitive Information Disclosure",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 7.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0920",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Buddypress Force Password Change \u003c= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update",
    "slug": "buddy-press-force-password-change",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3793",
    "auth_type": "Auth",
    "cvss_score": 4.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.17 - Authenticated Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-13136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-13136",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP YouTube Live \u003c= 1.7.21 - Reflected Cross-Site Scripting",
    "slug": "wp-youtube-live",
    "type": "plugin",
    "affected_version": "* - 1.7.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1187",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Whitelist \u003c= 3.5 - Reflected Cross-Site Scripting",
    "slug": "fifthsegment-whitelist",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49643",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada \u003c= 7.11.1 - Authenticated(Author+) Arbitrary File Upload via Zip Extraction",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-39312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39312",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Loan Repayment Calculator and Application Form \u003c= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "quick-interest-slider",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50829",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO For Images \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "seo-for-images",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48307",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UTM tags tracking for Contact Form 7 \u003c= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cf7-utm-tracking",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26544",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Excellent \u003c= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "excellent",
    "type": "theme",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35763",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import CSV or XML Datafeed With Ease \u003c= 3.7.2 - Cross-Site Request Forgery",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 3.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10125",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.19 - Authenticated (Administrator+) Remote Code Execution",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-51661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51661",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Testimonial Carousel For Elementor \u003c= 10.2.0 - Missing Authorization to Limited Setting Update",
    "slug": "testimonials-carousel-elementor",
    "type": "plugin",
    "affected_version": "* - 10.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4858",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Easy Google Analytics for WordPress \u003c= 1.6.0 - Cross-Site Request Forgery",
    "slug": "easy-google-analytics-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23887",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hotel Booking Lite \u003c= 4.6.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "motopress-hotel-booking-lite",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28498",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Best Restaurant Menu by PriceListo \u003c= 1.4.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "best-restaurant-menu-by-pricelisto",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-38793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38793",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WOOF - Products Filter for WooCommerce \u003c= 1.1.9 - Remote Code Execution",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-8710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-8710",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Navigation Tree Elementor \u003c= 1.0.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "navigation-tree-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30562",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simpul Events by Esotech \u003c= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simpul-events-by-esotech",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51867",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RightMessage WP \u003c= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rightmessage",
    "type": "plugin",
    "affected_version": "* - 0.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager \u003c= 4.67 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.67",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3063",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "External image replace \u003c= 1.0.8 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "external-image-replace",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4279",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.6.2 - Arbitrary User Password Reset",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-4106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-4106",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Etsy Shop \u003c= 3.0.3 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "etsy-shop",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25975",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Policy Genius \u003c= 2.0.4 - Reflected Cross-Site Scripting",
    "slug": "policy-genius",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13219",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Revolution \u003c= 6.7.10 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.7.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MSRP (RRP) Pricing for WooCommerce \u003c= 1.8.1 - Reflected Cross-Site Scripting",
    "slug": "msrp-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32552",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.12",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.9",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.8",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.24",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.21",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.21",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.14",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.13",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.4",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.1",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.24",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.22",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.2 - Authenticated Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.18",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Downgrade \u003c= 1.2.2 - Admin+ Stored Cross-Site Scripting",
    "slug": "wp-downgrade",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1001",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Z-Downloads \u003c= 1.11.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "z-downloads",
    "type": "plugin",
    "affected_version": "* - 1.11.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54206",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Administrator Z \u003c= 2025.09.27 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "administrator-z",
    "type": "plugin",
    "affected_version": "* - 2025.09.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2025.09.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32187",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Comments \u003c 1.2.5 - Cross-Site Request Forgery",
    "slug": "feature-comments",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-10382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10382",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery PhotoBlocks \u003c= 1.2.8 - Cross-Site Request Forgery",
    "slug": "photoblocks-grid-gallery",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36292",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2788",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Project Manager \u003c= 2.6.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-34383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34383",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Canto \u003c= 1.9.0 - Blind Server-Side Request Forgery via download.php",
    "slug": "canto",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-24063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24063",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "rezo",
    "type": "theme",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31013",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "shopo",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31013",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "edmin",
    "type": "theme",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31013",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "folo",
    "type": "theme",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31013",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "newsy",
    "type": "theme",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31013",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "sidepane",
    "type": "theme",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31013",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "slide",
    "type": "theme",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31013",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themify Themes \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "photobox",
    "type": "theme",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31013",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EC Authorize.net \u003c=  0.3.3 - Reflected Cross-Site Scripting",
    "slug": "ec-authorizenet",
    "type": "plugin",
    "affected_version": "* - 0.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46487",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bookingor \u003c= 1.0.8 - Missing Authorization",
    "slug": "bookingor",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32231",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library",
    "slug": "simplelightbox",
    "type": "plugin",
    "affected_version": "* - 2.14.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5878",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.59.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.59.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5878",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Altra Side Menu \u003c= 2.0 - Authenticated (Admin+) SQL Injection",
    "slug": "altra-side-menu",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12773",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ultimate Addons for Contact Form 7 \u003c= 3.1.0 - Reflected Cross-Site Scripting via 'page'",
    "slug": "ultimate-addons-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30493",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoho Campaigns \u003c= 2.0.7 - Cross-Site Request Forgery via zcwc_optin_save",
    "slug": "zoho-campaigns",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32441",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Secondary Title \u003c= 2.0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "secondary-title",
    "type": "plugin",
    "affected_version": "* - 2.0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28773",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mailchimp for WooCommerce \u003c= 2.7.1 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "mailchimp-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2556",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Radius Blocks \u003c= 2.2.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "radius-blocks",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32159",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All In One Redirection \u003c= 2.1.0 - Authenticated(Administrator+) SQL Injection",
    "slug": "all-in-one-redirection",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2493",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Gallery Slideshow \u0026 Masonry Tiled Gallery \u003c= 1.0.13 - Reflected Cross-Site Scripting",
    "slug": "wp-responsive-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2402",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.9.0 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54715",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Audio Comparison Lite \u003c= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "audio-comparison-lite",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51627",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARMember \u003c= 4.0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27995",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfect Survey \u003c= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via IP",
    "slug": "perfect-survey",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24765",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swifty Page Manager \u003c= 3.0.1 - Cross-Site Request Forgery",
    "slug": "swifty-page-manager",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0088",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins By FunnelKit \u003c= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library",
    "slug": "wp-marketing-automations",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7654",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins By FunnelKit \u003c= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library",
    "slug": "funnel-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7654",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Car Dealer \u003c= 4.46 - Missing Authorization",
    "slug": "cardealer",
    "type": "plugin",
    "affected_version": "* - 4.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54298",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "MakeStories (for Google Web Stories) \u003c= 3.0.3 - Authenticated (Subscriber+) Arbitrary File Download and Server-Side Request Forgery",
    "slug": "makestories-helper",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38746",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Responsive header image slider \u003c= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "responsive-header-image-slider",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5334",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive jQuery Slider \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-jquery-slider",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22798",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Code Snippets Extension \u003c= 4.0.2 - Authenticated (Subscriber+) PHP Code Injection",
    "slug": "mainwp-code-snippets-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23645",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Taeggie Feed \u003c= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Attribute",
    "slug": "taeggie-feed",
    "type": "plugin",
    "affected_version": "* - 0.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6382",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Custom CSS PHP \u0026 ADS \u003c= 3.3 - Unauthenticated Full Path Disclosure",
    "slug": "my-custom-css",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7410",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Booklet \u003c= 2.1.8 - Authenticated (Subscriber+) Remote Code Execution",
    "slug": "wp-booklet",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-22677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22677",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Qi Addons For Elementor \u003c= 1.8.0 - Sensitive Information Exposure",
    "slug": "qi-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9530",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Duplicator – WordPress Migration Plugin \u003c= 0.4.4 - Cross-Site Scripting",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "* - 0.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-4625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4625",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Void Contact Form 7 Widget For Elementor Page Builder \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute",
    "slug": "cf7-widget-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5419",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EELV Newsletter \u003c= 4.6.0 - Cross-Site Request Forgery",
    "slug": "eelv-newsletter",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-18523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18523",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Interactive World Map \u003c= 3.2.0 - Reflected Cross-Site Scripting",
    "slug": "interactive-world-map",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47767",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Posts Carousel \u003c= 1.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-posts-carousel",
    "type": "plugin",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39573",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-PostRatings \u003c= 1.61 - SQL Injection",
    "slug": "wp-postratings",
    "type": "plugin",
    "affected_version": "* - 1.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.61",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2011-4646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4646",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP VR \u003c= 8.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0174",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Ultimate Dashboard \u003c= 3.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ultimate-dashboard",
    "type": "plugin",
    "affected_version": "* - 3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1525",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sports Rankings and Lists \u003c= 1.0.2 - Unauthenticated Arbitrary File Download",
    "slug": "sports-rankings-lists",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-25162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25162",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9868",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Groups and Communities \u003c= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6977",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Strong Testimonials \u003c= 3.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "strong-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3261",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Risk Free Cash On Delivery (COD) - WooCommerce \u003c= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "risk-free-cash-on-delivery-cod-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48358",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple HTML Sitemap \u003c= 2.7 - Missing Authorization",
    "slug": "wp-simple-html-sitemap",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49850",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video.js – HTML5 Video Player for WordPress \u003c= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "videojs-html5-video-player-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4786",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bot for Telegram on WooCommerce \u003c= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass",
    "slug": "bot-for-telegram-on-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9821",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All in One B2B for WooCommerce \u003c= 1.0.3 - Cross-Site Request Forgery",
    "slug": "all-in-one-b2b-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3547",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "ThemeMakers Visual Content Composer \u003c= 1.5.8 - Unauthenticated PHP Object Injection",
    "slug": "tmm_content_composer",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53299",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Better Comments \u003c= 1.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "better-comments",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2404",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inline Google Spreadsheet Viewer \u003c= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "inline-google-spreadsheet-viewer",
    "type": "plugin",
    "affected_version": "* - 0.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom field finder \u003c= 0.3 - Authenticated (Author+) PHP Object Injection",
    "slug": "custom-field-finder",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-33641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33641",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TARIFFUXX \u003c= 1.4 - Authenticated (Contributor+) SQL Injection via tariffuxx_configurator Shortcode",
    "slug": "tariffuxx",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10682",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.3.2 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-2402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2402",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Hubbub Lite \u003c= 1.35.1 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "social-pug",
    "type": "plugin",
    "affected_version": "* - 1.35.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.35.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58007",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Mang Board WP \u003c= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mangboard",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22306",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arconix Shortcodes \u003c= 2.1.11 - Missing Authorization",
    "slug": "arconix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38769",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wux Blog Editor \u003c= 3.0.0 - Unauthenticated Arbitrary File Upload",
    "slug": "wux-blog-editor",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9932",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Custom CSS and JS \u003c= 3.3 - Cross-Site Scripting",
    "slug": "custom-css-js",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-2285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2285",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event List \u003c 0.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "event-list",
    "type": "plugin",
    "affected_version": "* - 0.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0418",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Button Block \u003c= 1.1.5 - Missing Authorization",
    "slug": "button-block",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22787",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP-Asambleas \u003c= 2.85.0 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "wp-asambleas",
    "type": "plugin",
    "affected_version": "* - 2.85.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.85.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27294",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Revision Manager TMC \u003c= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending",
    "slug": "revision-manager-tmc",
    "type": "plugin",
    "affected_version": "* - 2.8.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7622",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.89 - Authenticated Stored Cross-Site Scripting",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.89",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5120",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formula \u003c= 0.5.1 - Reflected Cross-Site Scripting via quality_customizer_notify_dismiss_action",
    "slug": "formula",
    "type": "theme",
    "affected_version": "* - 0.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5613",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Whitish Lite \u003c= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "whitish-lite",
    "type": "theme",
    "affected_version": "* - 2.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22278",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stagtools \u003c= 2.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stagtools",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – XPO Edition \u003c= 4.3.7 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-xpo-edition",
    "type": "plugin",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13490",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Recipe Card Blocks for Gutenberg \u0026 Elementor \u003c= 3.3.1 - Missing Authorization",
    "slug": "recipe-card-blocks-by-wpzoom",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43293",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2047",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Frontend File Manager \u003c= 18.2 - Unauthenticated HTML Injection leading to Spam Emails",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "[*, 18.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4350",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"
  },
  {
    "title": "WP Event Ticketing \u003c= 1.3.4 - Reflected Cross-Site Scripting",
    "slug": "wpeventticketing",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28899",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 12.6.6.1 - Unauthenticated Blind SQL Injection",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 12.6.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.6.6.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-13275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13275",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Font Awesome Integration \u003c= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "font-awesome-integration",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5233",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Tables \u003c= 5.0.5 - Missing Authorization",
    "slug": "ninja-tables",
    "type": "plugin",
    "affected_version": "* - 5.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Mail Log \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "wp-mail-log",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45807",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Card Elements for Elementor \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "card-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43123",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Car Dealer \u003c= 3.04 - Missing Authorization to Arbitrary Plugin Installation",
    "slug": "cardealer",
    "type": "plugin",
    "affected_version": "* - 3.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3879",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Jobs \u003c 1.5 - SQL Injection",
    "slug": "wp-jobs",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-9603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9603",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-FlyBox \u003c= 6.46 - Cross-Site Request Forgery",
    "slug": "wp-flybox",
    "type": "plugin",
    "affected_version": "* - 6.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38381",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP REST API FNS \u003c= 1.0.0 - Privilege Escalation",
    "slug": "rest-api-fns",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49328",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rehub \u003c= 19.9.7 - Unauthenticated Arbitrary Shortcode Execution via re_filterpost",
    "slug": "rehub-theme",
    "type": "theme",
    "affected_version": "* - 19.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7366",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Serial Codes Generator and Validator with WooCommerce Support \u003c= 2.4.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "serial-codes-generator-and-validator",
    "type": "plugin",
    "affected_version": "[*, 2.4.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4376",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bricksforge \u003c= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Update",
    "slug": "bricksforge",
    "type": "plugin",
    "affected_version": "* - 2.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31244",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PWA for WP \u0026 AMP \u003c= 1.7.72 - Missing Authorization",
    "slug": "pwa-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.7.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47318",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Findgo \u003c= 1.3.57 - Cross-Site Request Forgery",
    "slug": "findgo",
    "type": "theme",
    "affected_version": "* - 1.3.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.57",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53587",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blocksy Companion \u003c= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode",
    "slug": "blocksy-companion",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9565",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Century ToolKit \u003c= 1.2.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "century-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48357",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple visitor stat \u003c= 1.0 - Cross-Site Scripting",
    "slug": "simple-visitor-stat",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9453",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NiceJob \u003c= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nicejob",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10887",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Composer Starter \u003c= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "visual-composer-starter",
    "type": "theme",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43263",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BookIt \u003c=2.4.0 - Price Bypass",
    "slug": "bookit",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24715",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Tournamatch \u003c= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tournamatch",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4594",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinpoint Booking System – #1 WordPress Booking Plugin \u003c= 2.9.9.5.7 - Missing Authorization",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "* - 2.9.9.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54252",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Hostel \u003c= 1.1.5.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "hostel",
    "type": "plugin",
    "affected_version": "* - 1.1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39566",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Blog Stats \u003c= 20250416 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-blog-stats",
    "type": "plugin",
    "affected_version": "* - 20250416",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20250416",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47499",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Trendy News \u003c= 1.0.15 - Cross-Site Request Forgery",
    "slug": "trendy-news",
    "type": "theme",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37473",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HAPPY – Helpdesk Support Ticket System \u003c= 1.0.6 - Missing Authorization",
    "slug": "happy-helpdesk-support-ticket-system",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53571",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Limit Posts Automatically \u003c= 0.7 - Cross-Site Request Forgery leading to Cross-Site Scripting",
    "slug": "wp-limit-posts-automatically",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9401",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cost Calculator Builder PRO \u003c= 3.1.75 - Unauthenticated Arbitrary Email Sending",
    "slug": "cost-calculator-builder-pro",
    "type": "plugin",
    "affected_version": "* - 3.1.75",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.75",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4787",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "AZ Content Finder \u003c= 0.1 - Reflected Cross-Site Scripting",
    "slug": "az-content-finder",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23727",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Helloprint \u003c= 2.0.7 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "helloprint",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26540",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Table Block by Tableberg \u003c= 0.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tableberg",
    "type": "plugin",
    "affected_version": "* - 0.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32171",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Surveys 1.01.8 - Authenticated SQL Injection",
    "slug": "surveys",
    "type": "plugin",
    "affected_version": "* - 1.01.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002020",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via list_id parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6098",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wordpress Header Builder Plugin \u003c= 1.3.8 - Cross-Site Request Forgery to Header Deletion",
    "slug": "pearl-header-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12206",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AffiliateWP \u003c= 2.28.2 - Unauthenticated SQL Injection",
    "slug": "affiliate-wp",
    "type": "plugin",
    "affected_version": "* - 2.28.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.28.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8877",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "OneStore Sites \u003c= 0.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Installation",
    "slug": "onestore-sites",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25107",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP125 \u003c= 1.4.9 - Cross-Site Request Forgery",
    "slug": "wp125",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-2700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2700",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LearnPress \u003c= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1463",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoho Campaigns \u003c= 2.0.6 - Authenticated (Contributor+) SQL Injection",
    "slug": "zoho-campaigns",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30239",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "RB Internal Links \u003c= 2.0.16 - Cross-Site Request Forgery to Settings update and Cross-Site Scripting",
    "slug": "rb-internal-links",
    "type": "plugin",
    "affected_version": "* - 2.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1759",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Stylish Cost Calculator \u003c= 7.0.3 - Stored Cross-Site Scripting",
    "slug": "stylish-cost-calculator",
    "type": "plugin",
    "affected_version": "* - 7.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24822",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35759",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DoLogin Security \u003c= 3.7.1 - Missing Authorization via REST Endpoints",
    "slug": "dologin",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46608",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Pods – Custom Content Types and Fields \u003c= 3.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11849",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FLAP - Business WordPress Theme \u003c= 1.5 - Unauthenticated PHP Object Injection",
    "slug": "flap",
    "type": "theme",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31396",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Vite Coupon \u003c= 1.0.9 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "vite-coupon",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32642",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Nexter Extension \u003c= 2.0.3 - Reflected Cross-Site Scripting via post and post_id",
    "slug": "nexter-extension",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45750",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Keyword Strategy Internal Links \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "keyword-strategy-internal-links",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4537",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coupon Affiliates \u003c= 5.4.5 - Reflected Cross-Site Scripting via 'page'",
    "slug": "woo-coupon-usage",
    "type": "plugin",
    "affected_version": "* - 5.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30475",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp Easy Allopass \u003c= 4.1.1 - Cross-Site Request Forgery",
    "slug": "wordpress-easy-allopass",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49435",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "surveys \u003c= 1.01.8 - Authenticated SQL Injection",
    "slug": "surveys",
    "type": "plugin",
    "affected_version": "* - 1.01.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1002022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002022",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ACF City Selector \u003c= 1.16.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "acf-city-selector",
    "type": "plugin",
    "affected_version": "* - 1.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31832",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "KB Support – Customer Support Ticket \u0026 Helpdesk Plugin, Knowledge Base Plugin \u003c= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "kb-support",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13604",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ZhinaTwitterWidget \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "zhina-twitter-widget",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23719",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Latest Post Accordian Slider \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "latest-post-accordian-slider",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress WP-Advanced-Search \u003c= 3.3.6 - SQL Injection",
    "slug": "wp-advanced-search",
    "type": "plugin",
    "affected_version": "* - 3.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-12104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12104",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Extra Product Options for WooCommerce \u003c= 3.0.6 - Missing Authorization",
    "slug": "extra-product-options-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35727",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Category Template \u003c= 0.1 - Cross-Site Request Forgery",
    "slug": "advanced-category-template",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50835",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventON \u003c= 3.0.5 - Reflected Cross-Site Scripting",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-29395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-29395",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Made Easy \u003c= 2.2.23 - Admin+ Stored Cross-Site Scripting",
    "slug": "events-made-easy",
    "type": "plugin",
    "affected_version": "[*, 2.2.24)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.24",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24813",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themes4WP YouTube External Subtitles \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themes4wp-youtube-external-subtitles",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50470",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.18 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-45071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45071",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sofass \u003c= 1.3.4 - Unauthenticated Local File Inclusion",
    "slug": "sofass",
    "type": "theme",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24760",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Testimonials by BestWebSoft \u003c= 0.1.8 - Reflected Cross-Site Scripting",
    "slug": "bws-testimonials",
    "type": "plugin",
    "affected_version": "* - 0.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18558",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Login Logo \u003c= 1.1.7 - Cross-Site Request Forgery",
    "slug": "ideal-wp-login-logo-changer",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30822",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iONE360 configurator \u003c= 2.0.57 - Reflected Cross-Site Scripting",
    "slug": "ione360-configurator",
    "type": "plugin",
    "affected_version": "* - 2.0.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.57",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32529",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCHURCH \u003c= 2.7.0 - Unauthenticated SQL Injection",
    "slug": "church-management",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32303",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Compress \u003c= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.30.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.30.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2109",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "Easy Testimonials \u003c= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2337",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons \u003c= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update",
    "slug": "easy-sticky-sidebar",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8152",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zoho SalesIQ \u003c= 1.0.8 - Cross-Site Request Forgery",
    "slug": "zoho-salesiq",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15645",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DN Footer Contacts \u003c= 1.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "dn-footer-contacts",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3410",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscribe to Category \u003c= 2.7.4 - Unauthenticated SQL Injection",
    "slug": "subscribe-to-category",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-32590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32590",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Tickets \u003c= 1.9.10 - Cross-Site Request Forgery",
    "slug": "my-tickets",
    "type": "plugin",
    "affected_version": "* - 1.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47440",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Time Sheets \u003c 1.5.0 - Reflected Cross-Site Scripting",
    "slug": "time-sheets",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18581",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Posterity \u003c= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "posterity",
    "type": "theme",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43995",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "St Daily Tip \u003c= 4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "st-daily-tip",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24487",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailChimp for Wordpress \u003c= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mailchimp-for-wp",
    "type": "plugin",
    "affected_version": "* - 4.9.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8680",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress \u0026 WooCommerce \u003c= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8771",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Digital Downloads 3.1 - 3.1.1.4.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "[3.1, 3.1.1.4.2)",
    "from_version": "3.1",
    "from_inclusive": true,
    "to_version": "3.1.1.4.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-30869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30869",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Events Calendar Plugin – connectDaily \u003c= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "connect-daily-web-calendar",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32597",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVPMarker  \u003c= 10.6.6 - Unauthenticated SQL Injection",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 10.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-41652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41652",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RS Survey \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "rs-survey",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23485",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login/Signup Popup \u003c= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "easy-login-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0215",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shortcodes Ultimate Pro \u003c= 7.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcodes-ultimate-pro",
    "type": "plugin",
    "affected_version": "* - 7.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extensions by HocWP Team \u003c= 0.2.3.2 - Authentication Bypass",
    "slug": "sb-core",
    "type": "plugin",
    "affected_version": "* - 0.2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9930",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Leyka \u003c= 3.30.2 - Reflected Cross-Site Scripting",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "* - 3.30.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.30.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39314",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Table Manager \u003c= 3.5.2 - Missing Authorization",
    "slug": "wp-table-manager",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47601",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "wp_amaps \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-amaps",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23794",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extra User Details \u003c= 0.5 - Cross-Site Request Forgery",
    "slug": "extra-user-details",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35877",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Carousel Slider \u0026 Grid Ultimate for WooCommerce \u003c= 1.9.10 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "woo-product-carousel-slider-and-grid-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-44048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44048",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy!Appointments \u003c= 1.4.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "easyappointments",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31828",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WC Price History for Omnibus \u003c= 2.1.3 - Missing Authorization",
    "slug": "wc-price-history",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12617",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Shantz WordPress QOTD \u003c= 1.2.2 - Cross-Site Request Forgery",
    "slug": "shantz-wordpress-qotd",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24380",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stripe Payment Plugin for WooCommerce \u003c= 3.7.7 - Authentication Bypass",
    "slug": "payment-gateway-stripe-and-woocommerce-integration",
    "type": "plugin",
    "affected_version": "* - 3.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-3162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3162",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sell Tickets Online – TicketSource Ticket Shop for WordPress \u003c= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ticketsource-events",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11784",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Listdom – Business Directory and Classified Ads Listings WordPress Plugin \u003c= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Parameter",
    "slug": "listdom",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11854",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart External Link Click Monitor [Link Log] \u003c= 5.0.2 - Reflected Cross-Site Scripting",
    "slug": "link-log",
    "type": "plugin",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49771",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Lead Plus X \u003c= 0.99 - Cross-Site Request Forgery",
    "slug": "free-sales-funnel-squeeze-pages-landing-page-builder-templates-make",
    "type": "plugin",
    "affected_version": "* - 0.99",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.99",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36839",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H"
  },
  {
    "title": "Custom Word Cloud \u003c= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via angle Parameter",
    "slug": "custom-word-cloud",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8317",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Loginizer \u003c= 1.3.5 - Blind SQL Injection",
    "slug": "loginizer",
    "type": "plugin",
    "affected_version": "[*, 1.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-12650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-12650",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Regenerate \u0026 Select Crop \u003c= 7.1.0 - Missing Authorization",
    "slug": "image-regenerate-select-crop",
    "type": "plugin",
    "affected_version": "* - 7.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36680",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Statistics \u003c= 12.6.3 - Referer Cross-Site Scripting",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 12.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-10864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-10864",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "2 Click Social Media Buttons \u003c 0.34 - Cross-Site Scripting",
    "slug": "2-click-socialmedia-buttons",
    "type": "plugin",
    "affected_version": "[*, 0.34)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.34",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-4273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4273",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Code Snippets CPT \u003c= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "code-snippets-cpt",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13895",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Logo Showcase with Slick Slider – Logo Carousel, Logo Slider \u0026 Logo Grid \u003c= 1.2.4 - Cross-Site Request Forgery",
    "slug": "logo-showcase-with-slick-slider",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24730",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPZOOM Addons for Elementor (Templates, Widgets) \u003c= 1.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget",
    "slug": "wpzoom-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.1.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4370",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UPC/EAN/GTIN Code Generator \u003c= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "upc-ean-barcode-generator",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31878",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Count per Day Plugin \u003c 3.2.3 - Cross-Site Scripting",
    "slug": "count-per-day",
    "type": "plugin",
    "affected_version": "[*, 3.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6714",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PictoBrowser Gallery \u003c= 0.3.1 - Cross-Site Request Forgery",
    "slug": "pictobrowser-gallery",
    "type": "plugin",
    "affected_version": "* - 0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9392",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple URLs \u003c= 120 - Cross-Site Request Forgery via Multiple AJAX Actions",
    "slug": "simple-urls",
    "type": "plugin",
    "affected_version": "* - 120",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "120",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45606",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "mEintopf \u003c= 0.2.1 - Reflected Cross-Site Scripting",
    "slug": "meintopf",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13876",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HUSKY – Products Filter for WooCommerce (formerly WOOF) \u003c= 1.3.4.2 - Missing Authorization via woof_meta_get_keys()",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40334",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction \u0026 Membership Plugin \u003c= 2.9.1 - Information Exposure",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0318",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Page Specific Sidebars \u003c= 2.14.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "page-specific-sidebars",
    "type": "plugin",
    "affected_version": "* - 2.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51633",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Header Builder Plugin – Pearl \u003c= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion",
    "slug": "pearl-header-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5468",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "B2BKing \u003c= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Information Disclosure",
    "slug": "b2bking-wholesale-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.6.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3126",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "The E-Commerce ERP \u003c= 2.1.1.3 - Unauthenticated Privilege Escalation",
    "slug": "profitori",
    "type": "plugin",
    "affected_version": "* - 2.1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-52836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52836",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Simple PayPal Shopping Cart \u003c= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter",
    "slug": "wordpress-simple-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3529",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
  },
  {
    "title": "Design Approval System \u003c= 3.6 - Cross-Site Scripting",
    "slug": "design-approval-system",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-5711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5711",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AffiliateImporterEb \u003c= 1.0.6 - Reflected Cross-Site Scripting via 'module'",
    "slug": "affiliateimportereb",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12732",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscription Popup \u003c= 1.2.18 -  Reflected Cross-Site Scripting",
    "slug": "email-subscribe",
    "type": "plugin",
    "affected_version": "* - 1.2.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6527",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shop Page WP \u003c= 1.2.7 - Authenticated Cross-Site Scripting",
    "slug": "shop-page-wp",
    "type": "plugin",
    "affected_version": "[*, 1.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24811",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode",
    "slug": "cm-on-demand-search-and-replace",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11202",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode",
    "slug": "cm-video-lesson-manager",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11202",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode",
    "slug": "enhanced-tooltipglossary",
    "type": "plugin",
    "affected_version": "* - 4.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11202",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode",
    "slug": "cm-pop-up-banners",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11202",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode",
    "slug": "cm-header-footer-script-loader",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11202",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode",
    "slug": "cm-email-blacklist",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11202",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode",
    "slug": "cm-business-directory",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11202",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Reviews \u003c= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "* - 6.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27612",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Memphis Documents Library \u003c= 2.6.16 - Cross-Site Scripting",
    "slug": "memphis-documents-library",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-10385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10385",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar Contact Form \u003c= 1.2.34 - Missing Authorization to Authenticated (Subscriber+) Feedback Form Submission",
    "slug": "booking-calendar-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.2.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25037",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP JobSearch \u003c= 2.3.3 - Unauthenticated Arbitrary File Upload",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6585",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pin Generator \u003c= 2.0.0 - Missing Authorization",
    "slug": "pin-generator",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31791",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Invoice – Web Invoice and Billing \u003c= 4.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-invoice",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1617",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Manager for WooCommerce \u003c= 4.2.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43138",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Uncanny Toolkit for LearnDash \u003c= 3.7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "uncanny-learndash-toolkit",
    "type": "plugin",
    "affected_version": "* - 3.7.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57988",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBITS Addons For Elementor Page Builder \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "wpbits-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4862",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments Capcha Box \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "comments-capcha-box",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53226",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stylish Price List \u003c 6.9.0 - Arbitrary Image Upload",
    "slug": "stylish-price-list",
    "type": "plugin",
    "affected_version": "[*, 6.9.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24757",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content – ProfilePress \u003c= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2867",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Popup Manager \u003c= 1.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-popup-manager",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34797",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Website Chat Button: Kommo integration \u003c= 1.3.1 - Missing Authorization",
    "slug": "website-chat-button-kommo-integration",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58666",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Bet sport Free \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "bet-sport-free",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54396",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Interactive World Map \u003c= 3.2.0 - Cross-Site Request Forgery",
    "slug": "interactive-world-map",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45060",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE \u003c= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag'",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3725",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modula Image Gallery \u003c= 2.11.10 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "modula-best-grid-gallery",
    "type": "plugin",
    "affected_version": "* - 2.11.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12853",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.5 - Cross-Site Scripting via Network Settings Page",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-6634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-6634",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.2.5 - Missing Authorization",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47869",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Field Manager \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "custom-field-manager",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12873",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Youtube Feeder \u003c= 2.0.1 - Cross-Site Request Forgery",
    "slug": "youtube-feeder",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-34633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34633",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Gallery Slider for WooCommerce \u003c= 2.2.8 - Cross-Site Request Forgery",
    "slug": "woo-product-gallery-slider",
    "type": "plugin",
    "affected_version": "[*, 2.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-45372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45372",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Plug your WooCommerce into the largest catalog of customized print products from Helloprint \u003c= 2.0.4 - Unauthenticated Arbitrary File Upload",
    "slug": "helloprint",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50525",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WebinarPress \u003c= 1.33.27 - Open Redirect",
    "slug": "wp-webinarsystem",
    "type": "plugin",
    "affected_version": "* - 1.33.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32693",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donations \u003c 1.4 - Unauthenticated Arbitrary Options Change",
    "slug": "nd-donations",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15772",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L"
  },
  {
    "title": "Simple Membership \u003c= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3730",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Image Gallery, Gallery Album \u003c= 2.0.3 - Cross-Site Request Forgery",
    "slug": "gallery-album",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45629",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Jetpack CRM \u003c= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization",
    "slug": "zero-bs-crm",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3342",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Japanized For WooCommerce \u003c= 2.5.4 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-for-japan",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0942",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Maintenance \u003c= 6.1.6 - Information Exposure",
    "slug": "wp-maintenance",
    "type": "plugin",
    "affected_version": "* - 6.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1472",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Mail Log \u003c= 1.1.2 - Authenticated (Contributor+) SQL injection via key",
    "slug": "wp-mail-log",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5645",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Hijri \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "wp-hijri",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Custom Google Search \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-custom-google-search",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23698",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GarageSale \u003c 1.2.3 - Cross-Site Scripting",
    "slug": "garagesale",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4532",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add User Meta \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "add-user-meta",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7688",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.17",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.15",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.14",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.14",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.7",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.6",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.5",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.17",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.11",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.2",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authenticated SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.1",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5611",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP2LEADS \u003c= 3.5.0 - Reflected Cross-Site Scripting",
    "slug": "wp2leads",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49316",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) \u003c= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.10.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1457",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4151",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4151",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UberMenu \u003c= 3.8.3 - Cross-Site Request Forgery to Settings Reset",
    "slug": "ubermenu",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3593",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"
  },
  {
    "title": "WPB Show Core \u003c= 2.2 - Unauthenticated Local File Inlclusion",
    "slug": "wpb-show-core",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-4922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4922",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution \u003c= 4.2.4 - Cross-Site Request Forgery to Vendor Updates",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9943",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Astra Pro Addon \u003c= 3.5.1 - Unauthenticated SQL Injection",
    "slug": "astra-addon",
    "type": "plugin",
    "affected_version": "[*, 3.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24507",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Online Order for Clover \u003c= 1.5.6 - Missing Authorization",
    "slug": "clover-online-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43253",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShortPixel Adaptive Images \u003c= 3.8.3 - Cross-Site Request Forgery",
    "slug": "shortpixel-adaptive-images",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4689",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flyzoo Chat \u003c= 2.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "flyzoo",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46817",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cook\u0026Meal \u003c= 1.2.3 - Unauthenticated Local File Inclusion",
    "slug": "cookandmeal",
    "type": "theme",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48149",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multi Currency For WooCommerce \u003c= 1.5.5 - Missing Authorization",
    "slug": "wc-multi-currency",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32516",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Post Corrector \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "wp-post-corrector",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22764",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c= 2.1.7 - Cross-Site Request Forgery",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "[*, 2.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-5673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5673",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Taxonomy Chain Menu \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via pn_chain_menu Shortcode",
    "slug": "taxonomy-chain-menu",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3748",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orange Form \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "orange-form",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24704",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ocean Extra \u003c= 2.1.2 - Authenticated (Subscriber+) Arbitrary Post Access",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0749",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "User Submitted Posts \u003c= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content'",
    "slug": "user-submitted-posts",
    "type": "plugin",
    "affected_version": "* - 20230809",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20230809",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4308",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam \u003c= 2.0.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8914",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mass Pages/Posts Creator \u003c= 1.2.2 - Missing Authorization",
    "slug": "mass-pagesposts-creator",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-11580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11580",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Hesabfa Accounting \u003c= 2.2.4 - Unauthenticated Sensitive Information Exposure via Log File",
    "slug": "hesabfa-accounting",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48361",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Remove/hide Author, Date, Category Like Entry-Meta \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "removehide-author-date-category-like-entry-meta",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41650",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slider by Supsystic \u003c= 1.8.10 - Authenticated (Admin+) SQL Injection",
    "slug": "slider-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30237",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Simple:Press – WordPress Forum Plugin \u003c= 6.6.0 - Arbitrary File Upload",
    "slug": "simplepress",
    "type": "plugin",
    "affected_version": "[*, 6.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-36706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36706",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "0.1.0 - 3.1.3",
    "from_version": "0.1.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24203",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Sidebars \u003c= 3.0.9 - Cross-Site Request Forgery",
    "slug": "custom-sidebars",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-18510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18510",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Poll Maker – Versus Polls, Anonymous Polls, Image Polls \u003c= 5.5.4 - Unauthenticated HTML Injection",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56277",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Realtyna Organic IDX plugin \u003c= 5.0.0 - Unauthenticated Local File Inclusion",
    "slug": "real-estate-listing-realtyna-wpl",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54052",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom 404 Pro \u003c= 3.8.1 - Reflected Cross-Site Scripting via 'page'",
    "slug": "custom-404-pro",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32740",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.2 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11710",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Website Optimization – Plerdy \u003c= 1.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "plerdy-heatmap",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5715",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0543",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pro Bulk Watermark Plugin for WordPress \u003c= 2.0 - Authenticated (Subscriber+) Path Traversal",
    "slug": "pro-watermark",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28973",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Import Export WordPress Users \u003c= 2.5.2 - Authenticated (Shop Manager+) Path Traversal",
    "slug": "users-customers-import-export-for-wp-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-30492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30492",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Category Dropdown \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter",
    "slug": "wp-category-dropdown",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8103",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetSmartFilters \u003c= 3.6.7 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "jet-smart-filters",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54008",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Memberships, Groups and Communities \u003c= 5.8.3 - Missing Authorization",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3606",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stackable – Page Builder Gutenberg Blocks \u003c= 3.12.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Posts Block",
    "slug": "stackable-ultimate-gutenberg-blocks",
    "type": "plugin",
    "affected_version": "* - 3.12.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2039",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complianz - GDPR/CCPA Cookie Consent \u003c= 5.5.2 - Reflected Cross-Site Scripting via s parameter",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "[*, 6.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0193",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shibboleth \u003c= 1.6 - Reflected Cross-Site Scripting",
    "slug": "shibboleth",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14313",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SurveyJS: Drag \u0026 Drop WordPress Form Builder \u003c= 1.9.136 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "surveyjs",
    "type": "plugin",
    "affected_version": "* - 1.9.136",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.136",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50427",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AMP for WP \u003c= 0.9.97.20 - Stored Cross-Site Scripting",
    "slug": "accelerated-mobile-pages",
    "type": "plugin",
    "affected_version": "* - 0.9.97.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.97.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20838",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Timetics \u003c= 1.0.23 - Authorization Bypass",
    "slug": "timetics",
    "type": "plugin",
    "affected_version": "* - 1.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43923",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web – Mobile-Friendly Drag \u0026 Drop Contact Form Builder \u003c= 1.15.23 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32534",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xpro Theme Builder \u003c= 1.2.9 - Missing Authorization",
    "slug": "xpro-theme-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58198",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.1.11 - Authenticated Privilege Escalation via Profile Update",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.1.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.12",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-36156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36156",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP Project Manager \u003c= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2541",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Docs RSVP \u003c= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "google-docs-rsvp-guestlist",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49672",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WpTravelly \u003c= 1.6.0 - Cross-Site Request Forgery",
    "slug": "tour-booking-manager",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32450",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery \u003c= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters",
    "slug": "simply-gallery-block",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5424",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "best bootstrap widgets for elementor \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "best-bootstrap-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51851",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoice Builder \u003c= 1.2.101 - Cross-Site Request Forgery",
    "slug": "woo-pdf-invoice-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.101",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.101",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51486",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Add Subtitle \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "add-subtitle",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24897",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "JS Multi Hotel \u003c= 2.2.1 - Cross-Site Scripting",
    "slug": "js-multihotel",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-100008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-100008",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anti-Malware Security and Brute-Force Firewall \u003c= 4.20.95 - Reflected Cross-Site Scripting",
    "slug": "gotmls",
    "type": "plugin",
    "affected_version": "[*, 4.20.96)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.20.96",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0953",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Role Pricing \u003c= 3.5.5 - Cross-Site Request Forgery",
    "slug": "woocommerce-role-pricing",
    "type": "plugin",
    "affected_version": "* - 3.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32271",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ReFlex Gallery » WordPress Photo Gallery \u003c 3.1.4 - Arbitrary File Upload",
    "slug": "reflex-gallery",
    "type": "plugin",
    "affected_version": "[*, 3.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-4133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4133",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lime Developer Login \u003c= 1.4.0 - Reflected Cross-Site Scripting",
    "slug": "lime-developer-login",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23701",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ThemeLoom Widgets \u003c= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themeloom-widgets",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9861",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetMenu \u003c= 2.4.9 - Missing Authorization",
    "slug": "jet-menu",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26953",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RT Easy Builder – Advanced addons for Elementor \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-site Scripting",
    "slug": "rt-easy-builder-advanced-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2254",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Delete User Accounts \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-delete-user-accounts",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58704",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YourChannel \u003c= 1.2.3 - Missing Authorization to Plugin Settings Reset",
    "slug": "yourchannel",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1865",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Visual Form Builder \u003c= 3.0.6 - Admin+ Cross-Site Scripting",
    "slug": "visual-form-builder",
    "type": "plugin",
    "affected_version": "[*, 3.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1046",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPO365 | Mail Integration for Office 365 / Outlook \u003c= 1.9.0 - reflected Cross-Site Scripting via error_description",
    "slug": "mail-integration-365",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32119",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SupportFlow \u003c= 0.6 - Stored Cross-Site Scripting via discussion ticket title",
    "slug": "supportflow",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10969",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar \u003c= 8.4.3 - SQL injection",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 8.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20556",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pie Register – User Registration Forms \u003c= 3.7.0.0 - Reflected Cross-Site Scripting",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "[*, 3.7.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24239",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPaudio MP3 Player \u003c= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wpaudio-mp3-player",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0069",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fastly \u003c= 1.2.25 - Missing Authorization via AJAX actions",
    "slug": "fastly",
    "type": "plugin",
    "affected_version": "* - 1.2.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34768",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ZotPress \u003c= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname'",
    "slug": "zotpress",
    "type": "plugin",
    "affected_version": "* - 7.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4666",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Interactive Contact Form and Multi Step Form Builder with Drag \u0026 Drop Editor – Funnelforms Free \u003c= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Upload",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.7.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7447",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Query – WP Query Builder \u003c= 2.0.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "easy-query",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32120",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "TablePress \u003c= 3.1.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters",
    "slug": "tablepress",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5096",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BulletProof Security \u003c= 6.0 - Stored Cross-Site Scripting",
    "slug": "bulletproof-security",
    "type": "plugin",
    "affected_version": "[*, 6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1265",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Push Notifications for WordPress by PushAssist \u003c= 3.0.8 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "push-notification-for-wp-by-pushassist",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52408",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Maker \u003c= 1.16.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.16.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4362",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11910",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Bookings for Zoom GoogleMeet and more – Wappointment \u003c= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "wappointment",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32454",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive WordPress Slider \u003c= 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "motopress-slider-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24544",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Builder \u003c= 7.6.7 - Missing Authorization",
    "slug": "themify-builder",
    "type": "plugin",
    "affected_version": "* - 7.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49396",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP MyLinks \u003c= 1.0.6 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-mylinks",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47371",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ClipArt \u003c= 0.2 - Reflected Cross-Site Scripting",
    "slug": "clipart",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12726",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.13.2 - Authenticated SQL Injection",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "[*, 1.13.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-10866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-10866",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CF7 File Download – File Download for CF7 \u003c= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cf7-file-download",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33697",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.25",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.25",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.17",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.17",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.16",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.13",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.26",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.18",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.8",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.28",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.28",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.22",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.22",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.12",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.28",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.28",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.25",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.25",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.9",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.3",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9787",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "aBlocks – WordPress Gutenberg Blocks \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ablocks",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13465",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Checkout Field Editor for WooCommerce (Pro) \u003c= 3.6.2 - Unauthenticated Arbitrary File Deletion",
    "slug": "woocommerce-checkout-field-editor-pro",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-35658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35658",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FAT Services Booking \u003c= 5.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "fat-services-booking",
    "type": "plugin",
    "affected_version": "* - 5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39355",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SysBasics Customize My Account for WooCommerce \u003c= 2.7.29 - Reflected Cross-Site Scripting via tab Parameter",
    "slug": "customize-my-account-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.7.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Latest Custom Post Type Updates \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "latest-custom-post-type-updates",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30616",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP EIS \u003c= 1.3.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-eis",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51623",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls \u0026 Member Access Subscriptions \u003c= 230815 - Information Exposure",
    "slug": "s2member",
    "type": "plugin",
    "affected_version": "* - 230815",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "230815",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0899",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Lock User Account \u003c= 1.0.3 - Cross-Site Request Forgery to Account Lock/Unlock",
    "slug": "lock-user-account",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4307",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hostel \u003c= 1.1.5 - Reflected Cross-Site Scripting",
    "slug": "hostel",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30848",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DWT - Directory \u0026 Listing WordPress Theme \u003c= 3.3.6 - Unauthenticated Arbitrary User Password Reset",
    "slug": "dwt-listing",
    "type": "theme",
    "affected_version": "* - 3.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12827",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wyzi - Social Directory WordPress Theme \u003c= 2.4.2 - Reflected Cross-Site Scripting",
    "slug": "wyzi-business-finder",
    "type": "theme",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1164",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Malware Finder \u003c= 1.1 - Cross-Site Scripting",
    "slug": "malware-finder",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4538",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "GamiPress – Link \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gamipress-link",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5536",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Meta Data and Taxonomies Filter (MDTF) \u003c= 1.3.3.4 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50450",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "bbp topic count \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bbp-topic-count",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60163",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Lead Capturing Pages \u003c= 2.3 - Unauthenticated SQL Injection",
    "slug": "leadcapture",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31424",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Export and Import Users and Customers \u003c= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function",
    "slug": "users-customers-import-export-for-wp-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1973",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "School Management System for Wordpress \u003c= 93.0.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 93.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "93.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12610",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Membership Subscriptions – Effortless Memberships, Recurring Payments \u0026 Content Restriction \u003c= 2.13.7 - Authentication Bypass via pms_payment_id",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.13.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12919",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WpZon – Amazon Affiliate Plugin \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wpzon",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46506",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Interview \u003c= 1.01 - Authenticated (Contributor+) SQL Injection",
    "slug": "interview",
    "type": "plugin",
    "affected_version": "* - 1.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48137",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Jquery news ticker \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "jquery-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5432",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CoSchool LMS \u003c= 1.4- Missing Authorization to Privilege Escalation",
    "slug": "coschool",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54296",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Icegram \u003c= 3.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 3.1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43344",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce – Payphone Gateway \u003c= 3.2.0 - Reflected Cross-Site Scripting",
    "slug": "wc-payphone-gateway",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32523",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Product Tabs For WooCommerce \u003c= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection",
    "slug": "wb-custom-product-tabs-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12721",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Checklist \u003c= 1.1.8 - Cross-Site Scripting",
    "slug": "checklist",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16525",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FileBird – WordPress Media Library Folders \u0026 File Manager \u003c= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference",
    "slug": "filebird",
    "type": "plugin",
    "affected_version": "* - 5.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2346",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ask Me \u003c= 6.8.1 - Reflected Cross-Site Scripting",
    "slug": "ask-me",
    "type": "theme",
    "affected_version": "[*, 6.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1241",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JB News Ticker \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jb-news-ticker",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11804",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM and Lead Management by vcita \u003c= 2.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "crm-customer-relationship-management-by-vcita",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2405",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-In-One Cufon \u003c= 1.3.0 - Cross-Site Request Forgery",
    "slug": "all-in-one-cufon",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27315",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Email posts to subscribers \u003c= 6.2 - Missing Authorization to Sensitive Information Exposure",
    "slug": "email-posts-to-subscribers",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41735",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form 7 \u003c= 5.3.1 - Arbitrary File Upload via Bypass",
    "slug": "contact-form-7",
    "type": "plugin",
    "affected_version": "[*, 5.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-35489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35489",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bold Page Builder \u003c= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 4.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1157",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Club Manager \u003c= 2.2.11 - Authenticated (Player+) Stored Cross-Site Scripting",
    "slug": "wp-club-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32566",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Community Events \u003c= 1.4.8 - Authenticated (Administrator+) Stored Cross Site Scripting",
    "slug": "community-events",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44742",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultra Companion \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultra-companion",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24803",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TH Variation Swatches \u003c= 1.2.7 - Cross-Site Request Forgery via delete_settings",
    "slug": "th-variation-swatches",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28688",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Premium Age Verification / Restriction for WordPress \u003c= 3.0.2 - Unauthenticated Arbitrary File Read and Write via remote_tunnel.php",
    "slug": "age-restriction",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7401",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Linker \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "linker",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47177",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radio Player \u003c= 2.0.73 - Missing Authorization",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "* - 2.0.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34753",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Endpoints With Rest Api \u003c= 2.2.2 - Reflected Cross-Site Scripting",
    "slug": "custom-wp-rest-api",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12260",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adning Advertising \u003c= 1.5.5 - Arbitrary File Upload",
    "slug": "angwp",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36705",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ticket Tailor \u003c= 1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ticket-tailor",
    "type": "plugin",
    "affected_version": "* - 1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29104",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro  \u003c= 2.4.2 - Cross-Site Request Forgery Bypass",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "[*, 2.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36754",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SaasLauncher \u003c= 1.3.0 - Missing Authorization",
    "slug": "saaslauncher",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58606",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Showpass WordPress Extension \u003c= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "showpass",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58850",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor Pro \u003c= 5.4.8 - Reflected Cross-Site Scripting",
    "slug": "essential-addons-elementor",
    "type": "plugin",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32241",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Stats \u003c 2.52 - Cross-Site Request Forgery",
    "slug": "wp-stats",
    "type": "plugin",
    "affected_version": "[*, 2.52)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.52",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-10001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10001",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Community Events \u003c= 1.4.9 - Cross-Site Request Forgery",
    "slug": "community-events",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6271",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bricks \u003c= 1.9.6 - Unauthenticated Remote Code Execution",
    "slug": "bricks",
    "type": "theme",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-25600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25600",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS \u003c= 2.2.0 - Authenticated (Student+) SQL Injection",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25800",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Download Manager \u003c= 3.1.24 - Authenticated File Upload",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-34639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34639",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quick Chat \u003c 4.00 - SQL Injection",
    "slug": "quick-chat",
    "type": "plugin",
    "affected_version": "[*, 4.00)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.00",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-12534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12534",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blocks Post Grid \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blocks-post-grid",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51928",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infogram \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "infogram",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52191",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation",
    "slug": "miniorange-firebase-sms-otp-verification",
    "type": "plugin",
    "affected_version": "3.1.0 - 3.6.2",
    "from_version": "3.1.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7665",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP 2FA with Telegram \u003c= 3.0 - Two-Factor Authentication Bypass",
    "slug": "two-factor-login-telegram",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9820",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.1.3 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3128",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "4.0.1 - 7.2.4",
    "from_version": "4.0.1",
    "from_inclusive": true,
    "to_version": "7.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13744",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wpDiscuz \u003c= 7.6.11 - Cross-Site Request Forgery",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47775",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WS Theme Addons \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ws_weather Shortcode",
    "slug": "ws-theme-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8062",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Read Time \u003c= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "post-read-time",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28926",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ACF Quick Edit Fields \u003c= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Reference",
    "slug": "acf-quickedit-fields",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7286",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Better Author Bio \u003c= 2.7.10.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "better-author-bio",
    "type": "plugin",
    "affected_version": "* - 2.7.10.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.10.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49229",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.0.5 - Insecure Direct Object Reference to Forum Privacy Change",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40206",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Flickr Shortcode Importer \u003c= 2.2.3 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "flickr-shortcode-importer",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-46481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46481",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ListingPro Plugin \u003c= 2.9.4 - Authenticated (Author+) Local File Inclusion",
    "slug": "listingpro-plugin",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-39621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39621",
    "auth_type": "Auth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"
  },
  {
    "title": "LWS Cleaner \u003c= 2.3.0 - Cross-Site Request Forgery",
    "slug": "lws-cleaner",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35781",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Webpushr \u003c= 4.34.0 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting",
    "slug": "webpushr-web-push-notifications",
    "type": "plugin",
    "affected_version": "* - 4.34.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.34.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5620",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AF Tell a Friend \u003c= 1.4 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "af-tell-a-friend",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31404",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SimpleFlickr \u003c= 3.0.3 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "simpleflickr",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9396",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "POEditor \u003c= 0.9.10 - Cross-Site Request Forgery",
    "slug": "poeditor",
    "type": "plugin",
    "affected_version": "* - 0.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49237",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP EasyCart \u003c= 5.4.8 - Cross-Site Request Forgery via process_bulk_deactivate_product",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2894",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress \u003c= 3.6.12 - Authenticated (Administrator+) PHP Objection Injection",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2903",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3866",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Help Desk – The Ultimate Help Desk \u0026 Support Plugin \u003c= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-7094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7094",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ANAC XML Bandi di Gara \u003c= 7.5 - Cross-Site Request Forgery via settings.php",
    "slug": "avcp",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47655",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Portfolio Builder – Portfolio Gallery \u003c= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "uber-grid",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1757",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ocean Extra \u003c= 1.5.7 - Unauthenticated Options update and CSS injection",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16250",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "KJM Admin Notices \u003c= 2.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "kjm-admin-notices",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39344",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "URL Shortify \u003c= 1.10.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "url-shortify",
    "type": "plugin",
    "affected_version": "* - 1.10.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32134",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce \u003c= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode",
    "slug": "wp-cafe",
    "type": "plugin",
    "affected_version": "* - 2.2.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5431",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Clap \u003c= 1.5 - Reflected Cross-Site Scripting",
    "slug": "wp-clap",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23647",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Internal Link Builder \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "internal-link-builder",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23989",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Media folder \u003c= 5.7.2 - Missing Authorization to Authenticated(Subscriber+) Title Modification",
    "slug": "wp-media-folder",
    "type": "plugin",
    "affected_version": "* - 5.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25908",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SiteBuilder Dynamic Components \u003c= 1.0 - Unauthenticated PHP Object Injection",
    "slug": "sitebuilder-dynamic-components",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49625",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modern Events Calendar lite \u003c 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "[*, 7.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4021",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wordpress Core \u003c 4.0.1 - Hash Collision",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9037",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wordpress Core \u003c 4.0.1 - Hash Collision",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9037",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wordpress Core \u003c 4.0.1 - Hash Collision",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.4",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9037",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wordpress Core \u003c 4.0.1 - Hash Collision",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.4",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9037",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wordpress Core \u003c 4.0.1 - Hash Collision",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.2",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9037",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ayyash Studio \u003c= 1.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "ayyash-studio",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2576",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 1.1.120 - Missing Authorization to Feedback Submission",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 1.1.120",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.120",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26523",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Miraculous \u003c 2.0.9 - Unauthenticated SQL Injection",
    "slug": "miraculous",
    "type": "theme",
    "affected_version": "[*, 2.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-58628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58628",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP User Manager – User Profile Builder \u0026 Membership \u003c= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal",
    "slug": "wp-user-manager",
    "type": "plugin",
    "affected_version": "* - 2.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10216",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPFunnels \u003c= 3.5.18 - Unauthenticated PHP Object Injection",
    "slug": "wpfunnels",
    "type": "plugin",
    "affected_version": "* - 3.5.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47530",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stackable \u003c= 3.18.1 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "stackable-ultimate-gutenberg-blocks",
    "type": "plugin",
    "affected_version": "* - 3.18.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60095",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ocean Social Sharing \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ocean-social-sharing",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.8.20 - Missing Authorization",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33586",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP e-Commerce Style Email \u003c= 0.6.2 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "wp-e-commerce-style-email",
    "type": "plugin",
    "affected_version": "* - 0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30615",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "微信群发助手-Wechat Broadcast \u003c= 1.2.0 - Directory Traversal",
    "slug": "wechat-broadcast",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-16283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16283",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YITH WooCommerce Gift Cards Premium \u003c= 3.23.1 - Missing Authorization",
    "slug": "yith-woocommerce-gift-cards-premium",
    "type": "plugin",
    "affected_version": "* - 3.23.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.23.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44633",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "LearnPress \u003c= 3.2.6.6 - Privilege Escalation",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 3.2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-7916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7916",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "SrbTransLatin – SrbTransLatin \u003c= 1.46 - Cross-Site Scripting",
    "slug": "srbtranslatin",
    "type": "plugin",
    "affected_version": "* - 1.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5369",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPLMS \u003c 1.9.9.5.2 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "[*, 1.9.9.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-56057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56057",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slider Revolution \u003c= 4.1.4 - Directory Traversal",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9734",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "User Role \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "user-roles",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25114",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Absolute Addons For Elementor \u003c= 1.0.14 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "absolute-addons",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52496",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Envo Extra \u003c= 1.9.9 - Missing Authorization",
    "slug": "envo-extra",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47471",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Beaver Builder – Lite \u003c= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget",
    "slug": "ultimate-addons-for-beaver-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2142",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directorist \u003c= 7.2.2 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2046",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin \u003c= 3.1.2 - Stored Cross-Site Scripting",
    "slug": "mainwp",
    "type": "plugin",
    "affected_version": "[*, 3.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-15041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-15041",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customer Service Software \u0026 Support Ticket System \u003c 5.10.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-ticket",
    "type": "plugin",
    "affected_version": "[*, 5.10.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24622",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Before Download \u003c= 6.9.7 - Cross-Site Request Forgery",
    "slug": "email-before-download",
    "type": "plugin",
    "affected_version": "* - 6.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23519",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI Power: Complete AI Pack \u003c= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "gpt3-ai-content-generator",
    "type": "plugin",
    "affected_version": "* - 1.8.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.96",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13361",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Bubble Menu – circle floating menu \u003c= 4.0.2 - Cross-Site Request Forgery",
    "slug": "bubble-menu",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24714",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fyrebox Quizzes \u003c= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fyrebox-shortcode",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50035",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Download Manager \u003c 2.8.0 - Directory Traversal to Arbitrary File Deletion and Denial of Service",
    "slug": "cm-download-manager",
    "type": "plugin",
    "affected_version": "[*, 2.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-24146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24146",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Essential Blocks – Page Builder Gutenberg Blocks, Patterns \u0026 Templates \u003c= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP GoToWebinar \u003c= 14.45 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "wp-gotowebinar",
    "type": "plugin",
    "affected_version": "* - 14.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45832",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Featured Content Slider \u003c= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-featured-content-slider",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30634",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageInject \u003c= 1.15 - Cross-Site Request Forgery",
    "slug": "wp-inject",
    "type": "plugin",
    "affected_version": "* - 1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-5285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5285",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CC Child Pages \u003c= 1.42 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "cc-child-pages",
    "type": "plugin",
    "affected_version": "* - 1.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LikeBot – Decentralized like-system \u003c= 0.85 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "likebot",
    "type": "plugin",
    "affected_version": "* - 0.85",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.85",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media.net Ads Manager \u003c= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "media-net-ads-manager",
    "type": "plugin",
    "affected_version": "* - 2.10.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6431",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Maps GPX Viewer \u003c= 3.6 - Reflected Cross-Site Scripting",
    "slug": "google-maps-gpx-viewer",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27313",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multifox Plus \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "multifox-plus",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51916",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Tracker \u003c= 5.3.12 - Authenticated (Admin+) SQL Injection",
    "slug": "email-tracker",
    "type": "plugin",
    "affected_version": "* - 5.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10047",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Create by Mediavine \u003c= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mediavine-create",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37495",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Behance Portfolio Manager \u003c= 1.7.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "portfolio-manager-powered-by-behance",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32124",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Payment Gateway Based Fees and Discounts for WooCommerce \u003c= 2.12.1 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "checkout-fees-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33585",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sur.ly \u003c= 3.0.3 - Missing Authorization",
    "slug": "surly",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23957",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "StaffList \u003c= 3.2.6 - Unauthenticated Sensitive Information Exposure",
    "slug": "stafflist",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32255",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BuddyBoss Platform \u003c= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'",
    "slug": "buddyboss-platform",
    "type": "plugin",
    "affected_version": "* - 2.8.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13860",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "dwnldr \u003c 1.01 - Cross-Site Scripting",
    "slug": "dwnldr",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10964",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.3 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-0287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-0287",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 5.12.7 - Authenticated (Subscriber+) Arbitrary Post Access via Shortcode",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 5.12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0890",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) \u003c= 2.7.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5327",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Recall – Registration, Profile, Commerce \u0026 More \u003c= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8292",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "XootiX Framework \u003c= Various Plugin Versions - Missing Authorization to Arbitrary Options Update",
    "slug": "waitlist-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5324",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "XootiX Framework \u003c= Various Plugin Versions - Missing Authorization to Arbitrary Options Update",
    "slug": "side-cart-woocommerce",
    "type": "plugin",
    "affected_version": "2.5",
    "from_version": "2.5",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5324",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "XootiX Framework \u003c= Various Plugin Versions - Missing Authorization to Arbitrary Options Update",
    "slug": "easy-login-woocommerce",
    "type": "plugin",
    "affected_version": "2.7.1 - 2.7.2",
    "from_version": "2.7.1",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5324",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "XootiX Framework \u003c= Various Plugin Versions - Missing Authorization to Arbitrary Options Update",
    "slug": "mobile-login-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5324",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Download Monitor \u003c 3.3.6.2 - Cross-Site Scripting via sort Parameter",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "[*, 3.3.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-5098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5098",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Milat jQuery Automatic Popup \u003c= 1.3.1 - Cross-Site Request Forgery to Stored Cross-site Scripting",
    "slug": "milat-jquery-automatic-popup",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46514",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cooked – Recipe Management \u003c= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "cooked",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-41816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-41816",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid \u003c= 5.5.1 - Missing Authorization to User Import",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3403",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "canvasio3D Light \u003c= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "canvasio3d-light",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-34411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34411",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Forminator – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.13.4 - Cross-Site Request Forgery Bypass",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "[*, 1.13.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4417",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Cryptocurrency Widgets – Price Ticker \u0026 Coins List \u003c= 2.8.0 - Reflected Cross-Site Scripting",
    "slug": "cryptocurrency-price-ticker-widget",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43304",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Us Page – Contact People \u003c= 3.7.0 - Cross Site Request Forgery",
    "slug": "contact-us-page-contact-people",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23973",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "A5 Custom Login Page \u003c= 2.8.1 - Reflected Cross-Site Scripting",
    "slug": "custom-login-page",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13226",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TopBar \u003c= 1.0.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "topbar",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10300",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ashe \u003c= 2.233 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "ashe",
    "type": "theme",
    "affected_version": "* - 2.233",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.233",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37478",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blocksy \u003c= 2.0.22 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "blocksy",
    "type": "theme",
    "affected_version": "* - 2.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31382",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Download Manager \u003c= 3.1.24 - Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34638",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Twitch TV Embed Suite \u003c= 2.1.0 - Cross-Site Request Forgery",
    "slug": "twitch-tv-embed-suite",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53313",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TaxoPress \u003c= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "simple-tags",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2170",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Helloprint \u003c= 2.0.7 - Unauthenticated Arbitrary File Deletion",
    "slug": "helloprint",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26534",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Auto Rename Media On Upload \u003c= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "auto-rename-media-on-upload",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0605",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video.js HLS Player \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "videojs-hls-player",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27325",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nudgify Social Proof, Sales Popup \u0026 FOMO \u003c= 1.3.3 - Cross-Site Request Forgery via sync_orders_manually()",
    "slug": "nudgify",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31239",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Subtitle for WooCommerce \u003c= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameter",
    "slug": "product-subtitle-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5285",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Login - WordPress / WooCommerce Plugin \u003c= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider",
    "slug": "woo-social-login",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10114",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Ads – Ad Manager \u0026 AdSense \u003c= 1.31.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "advanced-ads",
    "type": "plugin",
    "affected_version": "* - 1.31.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-32776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-32776",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c 2.0.4 - Authenticated Unrestricted File Upload",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-0587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0587",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Comic Easel \u003c= 1.15 - Reflected Cross-Site Scripting",
    "slug": "comic-easel",
    "type": "plugin",
    "affected_version": "* - 1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31092",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rating by BestWebSoft \u003c= 1.5 - Rating Denial of Service",
    "slug": "rating-bws",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25121",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Product Slider For WooCommerce Lite \u003c= 1.1.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Keys",
    "slug": "product-slider-for-woocommerce-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0537",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SSV MailChimp \u003c= 3.1.5 - Unauthenticated Local File Inclusion",
    "slug": "ssv-mailchimp",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49285",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Continuous announcement scroller \u003c= 13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "continuous-announcement-scroller",
    "type": "plugin",
    "affected_version": "* - 13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46819",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form builder with drag \u0026 drop for WordPress – Kali Forms \u003c= 2.3.41 - Missing Authorization",
    "slug": "kali-forms",
    "type": "plugin",
    "affected_version": "* - 2.3.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1218",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "cformsII \u003c= 14.12.3 - Authenticated SQL Injection",
    "slug": "cforms2",
    "type": "plugin",
    "affected_version": "[*, 14.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.13",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18570",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.5.54 - SQL Injection via bwg_search_x Parameter",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.55)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.55",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24139",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Pricing Table \u003c= 5.1.10 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "dk-pricr-responsive-pricing-table",
    "type": "plugin",
    "affected_version": "* - 5.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1333",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventer \u003c= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees",
    "slug": "eventer",
    "type": "plugin",
    "affected_version": "* - 3.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11135",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Live updates from Excel \u003c= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ipushpull",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5116",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chatter \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "chatter",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23760",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mega Addons For WPBakery Page Builder \u003c= 4.3.0 - Authenticated (Subscriber+) Settings Update",
    "slug": "mega-addons-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4501",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "EZ InLinkz linkup \u003c= 0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "inlinkz-scripter",
    "type": "plugin",
    "affected_version": "* - 0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27329",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management System – WPSchoolPress \u003c= 2.2.14 - Authenticated (Student/Parent+) SQL Injection",
    "slug": "wpschoolpress",
    "type": "plugin",
    "affected_version": "* - 2.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12332",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23511",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Archivist – Custom Archive Templates \u003c= 1.7.5 - Reflected Cross-Site Scripting",
    "slug": "archivist-custom-archive-templates",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1810",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sale with Razorpay \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "sell-with-razorpay",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23516",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker \u003c= 5.1.6.3 - Unauthenticated Authorization Bypass",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 5.1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32275",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inpersttion For Theme \u003c= 1.0 - Authenticated (Contributor+) Arbitrary Function Call",
    "slug": "err-our-team",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8905",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Webhooks  \u003c= 3.3.5 - Unauthenticated Arbitrary File Copy",
    "slug": "wp-webhooks",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-8895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8895",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ActivityPub \u003c= 0.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content",
    "slug": "activitypub",
    "type": "plugin",
    "affected_version": "* - 0.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3746",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Manager Pro \u003c= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "wp-file-manager-pro",
    "type": "plugin",
    "affected_version": "* - 8.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8507",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EazyDocs \u003c= 2.3.5 - Missing Authorization via doc_one_page and edit_doc_one_page",
    "slug": "eazydocs",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47648",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Social Link Pages: link-in-bio landing pages for your social media profiles \u003c= 1.6.9 - Missing Authorization to Arbitrary Page Creation and Cross-Site Scripting",
    "slug": "social-link-pages",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3555",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Directory Free \u003c= 1.6.9 - Unauthenticated SQL Injection",
    "slug": "web-directory-free",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3552",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cleverwise Daily Quotes \u003c= 3.2 - Reflected Cross-Site Scripting",
    "slug": "cleverwise-daily-quotes",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-40335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40335",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dextaz Ping \u003c= 0.65 - Authenticated (Admin+) Remote Code Execution",
    "slug": "dextaz-ping",
    "type": "plugin",
    "affected_version": "* - 0.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.65",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-34792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34792",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FormFacade – WordPress plugin for Google Forms \u003c= 1.3.6 - Reflected Cross-Site Scripting",
    "slug": "formfacade",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9613",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Code for WooCommerce \u003c= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "product-code-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51669",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez CRM \u003c= 1.3.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "houzez-crm",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-36529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36529",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Theme Builder For Elementor \u003c= 1.2.3 - Cross-Site Request Forgery",
    "slug": "theme-builder-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54033",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sassy Social Share \u003c= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sassy-social-share",
    "type": "plugin",
    "affected_version": "* - 3.3.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.56",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1448",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Slide Box Builder \u003c= 3.2.9 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-visual-slidebox-builder",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1182",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Video Gallery – YouTube Playlist, Channel Gallery by YotuWP \u003c= 1.3.13 - Unauthenticated Local File Inclusion",
    "slug": "yotuwp-easy-youtube-embed",
    "type": "plugin",
    "affected_version": "* - 1.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4258",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Missing Authorization in 'queue_posts'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1334",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking and Rental Manager \u003c= 2.3.8 - Missing Authorization",
    "slug": "booking-and-rental-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47585",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tajer \u003c= 1.0.5 - Arbitrary File Upload",
    "slug": "tajer",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-9206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-9206",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Administrator Z \u003c= 2025.03.28 - Authenticated (Admin+) Directory Traversal",
    "slug": "administrator-z",
    "type": "plugin",
    "affected_version": "* - 2025.03.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2025.03.28",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-39598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39598",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BuddyPress \u003c= 11.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "buddypress",
    "type": "plugin",
    "affected_version": "* - 11.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50880",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Content Writer, RSS Feed to Post, Autoblogging SEO Help \u003c= 6.1.3 - Reflected Cross-Site Scripting",
    "slug": "seo-help",
    "type": "plugin",
    "affected_version": "* - 6.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12156",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maintenance \u003c= 4.02 - Authenticated Stored Cross-Site Scripting",
    "slug": "maintenance",
    "type": "plugin",
    "affected_version": "[*, 4.03)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.03",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24533",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tabs Responsive \u003c= 2.2.7 - Editor+ Stored Cross-Site Scripting",
    "slug": "tabs-responsive",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1298",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 3.5.1 - Remote Code Execution via Remote File Inclusion",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2012-10025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10025",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "JSON Content Importer \u003c= 1.3.15 - Authenticated (Admin+) Cross Site Scripting",
    "slug": "json-content-importer",
    "type": "plugin",
    "affected_version": "* - 1.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25485",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TypoFR \u003c= 0.11 - Reflected Cross-Site Scripting",
    "slug": "typofr",
    "type": "plugin",
    "affected_version": "* - 0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34657",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Vendors \u003c= 2.1.76 - Authenticated (Vendor admin+) SQL Injection",
    "slug": "woocommerce-product-vendors",
    "type": "plugin",
    "affected_version": "* - 2.1.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.76",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-33331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33331",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Favicon Generator \u003c= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion",
    "slug": "favicon-generator",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-7568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7568",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Geo Controller \u003c= 8.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cf-geoplugin",
    "type": "plugin",
    "affected_version": "* - 8.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51513",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme Editor \u003c= 3.0 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "theme-editor",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9890",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Constructor \u003c= 1.6.5 - Missing Authorization to Authenticated (Subscriber+) Theme Clean",
    "slug": "constructor",
    "type": "theme",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9194",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elessi \u003c 6.4.1 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "elessi-theme",
    "type": "theme",
    "affected_version": "[*, 6.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-49070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49070",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Visibility Logic for Elementor \u003c= 2.3.4 - Cross-Site Request Forgery via toggle_option",
    "slug": "visibility-logic-elementor",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47169",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Youneeq Recommendations \u003c= 3.0.7 - Reflected Cross-Site Scripting",
    "slug": "youneeq-panel",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52457",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2305",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UMich OIDC Login \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "umich-oidc-login",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11753",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event post \u003c= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "event-post",
    "type": "plugin",
    "affected_version": "* - 5.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46228",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Menu Editor \u003c= 1.12 - Cross-Site Request Forgery via ajax_hide_hint()",
    "slug": "admin-menu-editor",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24876",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Filebird 4.7.3 - Unauthenticated SQL Injection",
    "slug": "filebird",
    "type": "plugin",
    "affected_version": "4.7.3",
    "from_version": "4.7.3",
    "from_inclusive": true,
    "to_version": "4.7.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24385",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Saan World Clock \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "saan-world-clock",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0145",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.24.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.1.3 - Security Hardening",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3125",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Anps Theme plugin \u003c= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "anps_theme_plugin",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13812",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Mind Doodle Visual Sitemaps \u0026 Tasks \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mind-doodle-sitemap",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22544",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Slider - Responsive Touch Slider \u003c= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6382",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Deliver via Shipos for WooCommerce \u003c= 2.1.7 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameter",
    "slug": "wc-shipos-delivery",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12222",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Bet \u003c= 1.0.7 - Authenticated(Contributor+) SQL Injection",
    "slug": "easy-bet",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-31092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31092",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Super Socializer \u003c= 7.13.54 - Cross-Site Request Forgery",
    "slug": "super-socializer",
    "type": "plugin",
    "affected_version": "* - 7.13.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.13.54",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41802",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IRM Newsroom \u003c= 1.2.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcode",
    "slug": "irm-newsroom",
    "type": "plugin",
    "affected_version": "* - 1.2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4586",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bookly \u003c= 21.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bookly-responsive-appointment-booking-tool",
    "type": "plugin",
    "affected_version": "21.7",
    "from_version": "21.7",
    "from_inclusive": true,
    "to_version": "21.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1159",
    "auth_type": "Privileged",
    "cvss_score": 4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "畅言评论系统 \u003c= 2.0.5 - Missing Authorization",
    "slug": "changyan",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55994",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Campus Directory \u003c= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter",
    "slug": "campus-directory",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8313",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sastra Essential Addons for Elementor \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sastra-essential-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Greenshift \u003c= 10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 10.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26884",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ATP Call Now \u003c= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "atp-call-now",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50024",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "افزونه پیامک ووکامرس Persian WooCommerce SMS \u003c 3.3.3 - Cross-Site Scripting",
    "slug": "persian-woocommerce-sms",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10987",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Good \u0026 Bad Comments \u003c= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "good-bad-comments",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1090",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exchange Addon Custom URL Tracking \u003c 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "exchange-addon-custom-url-tracking",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9366",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Template Kit – Export \u003c= 1.0.21 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "template-kit-export",
    "type": "plugin",
    "affected_version": "* - 1.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37550",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Count per Day \u003c= 3.1 - Cross-Site Scripting",
    "slug": "count-per-day",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-0895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-0895",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Single Page Checkout \u003c= 1.2.7 - Cross-Site Request Forgery",
    "slug": "woo-single-page-checkout",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58804",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Controller \u003c= 3.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-management-controller",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54411",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WOLF \u003c= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via profile_title",
    "slug": "bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22159",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Category Post List Widget \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "wp-category-posts-list",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23828",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP CSV Exporter \u003c= 1.3.6 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-csv-exporter",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3249",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARForms \u003c= 6.4 - Missing Authorization to Arbitrary File Deletion",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32703",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Xavin's Review Ratings \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xavins-review-ratings",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4170",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Brands \u003c= 1.6.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "woocommerce-brands",
    "type": "plugin",
    "affected_version": "* - 1.6.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32746",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.1.0.1.1 - Unauthenticated CSV Injection",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.1.0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3600",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zenon Lite \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode",
    "slug": "zenon-lite",
    "type": "theme",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5964",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Compliance \u003c= 4.12.4 - Cross-Site Request Forgery to License Modification",
    "slug": "gdpr-cookie-compliance",
    "type": "plugin",
    "affected_version": "* - 4.12.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4013",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newsletter \u003c= 8.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "* - 8.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3584",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DeepL Pro API translation \u003c= 2.1.4 - Cross-Site Request Forgery via saveSettings",
    "slug": "wpdeepl",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27446",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin \u003c= 1.0.21 - Missing Authorization to Limited Privilege Escalation",
    "slug": "timetics",
    "type": "plugin",
    "affected_version": "* - 1.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1094",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WOLF \u003c= 1.0.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44990",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Location for WP Job Manager via Google \u003c= 1.0 - Authenticated (Administrator+) Stored Cross Site Scripting",
    "slug": "auto-location-for-wp-job-manager",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3344",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rate my Post – WP Rating System \u003c= 3.3.4 - Race Condition",
    "slug": "rate-my-post",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40310",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IP Based Login \u003c= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ip-based-login",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12800",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.24",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.8",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.24",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.16",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.12",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.27",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.25",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.21",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.17",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.11",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.7",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.15",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.27",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-8942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form by BestWebSoft \u003c= 3.95 - ReflectedCross-Site Scripting",
    "slug": "contact-form-plugin",
    "type": "plugin",
    "affected_version": "[*, 3.96)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.96",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9295",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp Ultimate Review \u003c= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-ultimate-review",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28751",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Boostify Header Footer Builder for Elementor \u003c= 1.3.5 - Missing Authorization to Page/Post Creation",
    "slug": "boostify-header-footer-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4788",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup4Phone \u003c= 1.3.2 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "popup4phone",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3580",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Search 360 \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "site-search-360",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11780",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload for WooCommerce \u003c= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function",
    "slug": "drag-and-drop-multiple-file-upload-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4403",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YITH Maintenance Mode \u003c= 1.1.4 - Reflected Cross-Site Scripting",
    "slug": "yith-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9429",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39992",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload for WooCommerce \u003c= 1.0.8 - Missing Authorization in upload and delete_file",
    "slug": "drag-and-drop-multiple-file-upload-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45377",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Responsive FlipBook Plugin Wordpress \u003c= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "responsive-flipbook",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11929",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tida URL Screenshot \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "tida-url-screenshot",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49641",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support SVG \u003c= 1.0.0 - Authenticated (Author+) Stored Cross-site Scripting via SVG",
    "slug": "support-svg",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4272",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Improved Sale Badges – Free Version \u003c= 1.0.1 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "improved-sale-badges-free-version",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23949",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kata Plus \u003c= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kata-plus",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50501",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Sermons \u003c= 3.1 - Reflected Cross-Site Scripting via s",
    "slug": "advanced-sermons",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29928",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Builder \u003c= 7.6.2 - Reflected Cross-Site Scripting",
    "slug": "themify-builder",
    "type": "plugin",
    "affected_version": "* - 7.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9385",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calendar \u003c= 1.3.2 - Cross-Site Request Forgery",
    "slug": "calendar",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2698",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor \u003c= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2128",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Related Posts \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "wp-related-posts",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2011-0760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-0760",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "OttoKit: All-in-One Automation Platform (Formerly SureTriggers) \u003c= 1.0.82 - Unauthenticated Privilege Escalation",
    "slug": "suretriggers",
    "type": "plugin",
    "affected_version": "* - 1.0.82",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.82",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-27007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27007",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Checkout for PayPal \u003c= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "checkout-for-paypal",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3983",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Block for Font Awesome \u003c= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "block-for-font-awesome",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35705",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bravo Translate \u003c= 1.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "bravo-translate",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49161",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll Widget",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6575",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GS Pins for Pinterest \u003c= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shorcode",
    "slug": "gs-pinterest-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30192",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget Bundle \u003c= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-widget-bundle",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4970",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailPoet Newsletters \u003c= 2.2 - Multiple SQL Injections",
    "slug": "wysija-newsletters",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-1408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1408",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SMS Alert Order Notifications – WooCommerce \u003c= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "sms-alert",
    "type": "plugin",
    "affected_version": "* - 3.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11725",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TheCartPress eCommerce Shopping Cart \u003c= 1.5.3.6 - Multiple Cross-Site Scripting",
    "slug": "thecartpress",
    "type": "plugin",
    "affected_version": "* - 1.5.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3300",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP fancybox \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-fancybox",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26591",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – Limb Image Gallery \u003c= 1.5.7 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "limb-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49258",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MailPress \u003c= 7.2.1 - Cross-Site Request Forgery",
    "slug": "mailpress",
    "type": "plugin",
    "affected_version": "* - 7.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1843",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.8.1 - LoDash Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.6, 5.6.5)",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-8203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8203",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.8.1 - LoDash Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.7, 5.7.3)",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-8203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8203",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.8.1 - LoDash Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.8, 5.8.1)",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-8203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8203",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.8.1 - LoDash Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.4, 5.4.7)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-8203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8203",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.8.1 - LoDash Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.5, 5.5.6)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-8203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8203",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Noindex Nofollow Tool II \u003c= 1.3.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ultimate-noindex-nofollow-tool-ii",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1663",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "custom-post-edit \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "front-end-post-edit",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23667",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON \u003c= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6180",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Query Shortcode \u003c= 0.4.0 - Authenticated (Contributor+) Path Traversal via lens Parameter",
    "slug": "custom-query-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8562",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Product Stock Alert \u003c= 2.0.1 - Missing Authorization via API",
    "slug": "woocommerce-product-stock-alert",
    "type": "plugin",
    "affected_version": "[*, 2.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-37971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37971",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Xelion Webchat \u003c=  9.1.0 - Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "xelion-webchat",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3058",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YouTube Embed \u003c= 5.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "youtube-embed",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31008",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DocumentPress \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "documentpress-display-any-document-on-your-site",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49656",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xenon - Bootstrap Admin Theme with AngularJS \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "xenon",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-14010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-14010",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SPID Italia \u003c= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-spid-italia",
    "type": "plugin",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11758",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chatra Live Chat + ChatBot + Cart Saver \u003c= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chatra-live-chat",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24735",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode Ninja \u003c= 1.4 - Cross-Site Scripting",
    "slug": "shortcode-ninja",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4550",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GuardGiant Brute Force Protection \u003c= 2.2.6 - Reflected Cross-Site Scripting",
    "slug": "guardgiant",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10869",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All in One SEO 4.0.0 - 4.1.5.2 Authorization Bypass",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "4.0.0 - 4.1.5.2",
    "from_version": "4.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Registration Forms \u003c= 2.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode",
    "slug": "easy-registration-forms",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5134",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Alink Tap \u003c= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "alink-tap",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4198",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1261",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SupportCandy \u003c= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27991",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM Perks Forms \u003c= 1.1.4 - Unauthenticated SQL Injection",
    "slug": "crm-perks-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30498",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "GD Star Rating \u003c= 1.9.22 - Blind SQL Injection",
    "slug": "gd-star-rating",
    "type": "plugin",
    "affected_version": "* - 1.9.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-2839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2839",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kento Post View Counter \u003c= 2.8 - Cross-Site Request Forgery",
    "slug": "kento-post-view-counter",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10982",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Download Monitor \u003c= 4.9.13 - Missing Authorization",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 4.9.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3269",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WPLMS \u003c 1.9.9.5.3 - Unauthenticated SQL Injection",
    "slug": "wplms_plugin",
    "type": "plugin",
    "affected_version": "[*, 1.9.9.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-56042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56042",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Booking Calendar \u003c= 9.7.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "[*, 9.7.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-51520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51520",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoho Marketing Automation \u003c= 1.2.7 - Authenticated (Contributor+) SQL Injection",
    "slug": "zoho-marketinghub",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37225",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Service Finder SMS System \u003c= 2.0.0 - Authentication Bypass",
    "slug": "aone-sms",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5955",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smush – Lazy Load Images, Optimize \u0026 Compress Images \u003c= 3.16.4 - Missing Authorization to Resmush List Deletion",
    "slug": "wp-smushit",
    "type": "plugin",
    "affected_version": "* - 3.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3352",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "uDesign \u003c= 4.11.2 - Missing Authorization",
    "slug": "udesign",
    "type": "theme",
    "affected_version": "* - 4.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24757",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Seos Contact Form \u003c= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "seos-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50830",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez Property Feed \u003c= 2.5.4 - Unauthenticated Arbitrary File Download",
    "slug": "houzez-property-feed",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30793",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Booking Widget \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "simple-booking-widget",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54433",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SysBasics Customize My Account for WooCommerce  \u003c= 2.8.22 - Reflected Cross-Site Scripting",
    "slug": "customize-my-account-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.8.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24592",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder – More than Just a Page Builder \u003c= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.23.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.23.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5416",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arrow Custom Feed for Twitter \u003c= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "arrow-twitter-feed",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31897",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uix Shortcodes – Compatible with Gutenberg \u003c= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "uix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9772",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Delete All Comments Easily \u003c= 1.3 - All Comments Deletion via Cross-Site Request Forgery",
    "slug": "delete-all-comments-easily",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36505",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-custom-registration-forms-builder",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-custom-fields-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-product-labels-and-stickers",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-product-dynamic-pricing-and-discounts",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-abandoned-cart-recovery",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-checkout-fields-manager",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-order-tracking-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-free-gifts-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-image-watermark-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-gift-registry-for-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-order-approval-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-price-calculator-for-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Addify Plugins \u003c= (Various Versions) - Cross-Site Request Forgery",
    "slug": "addify-custom-order-number",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Brizy Pro \u003c= 2.6.1 - Cross-Site Request Forgery",
    "slug": "brizy-pro",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26902",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Checkout Field Editor \u003c= 1.7.2 - Authenticated (Admin+) PHP Object Injection",
    "slug": "woo-checkout-field-editor-pro",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3490",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Login Lockdown \u0026 Protection \u003c= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting",
    "slug": "login-lockdown",
    "type": "plugin",
    "affected_version": "* - 2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3766",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce osCommerce Sync \u003c= 2.0.20 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "woo-oscommerce-sync",
    "type": "plugin",
    "affected_version": "* - 2.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25119",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Drag And drop All Import : WP Ultimate CSV Importer \u003c 3.8.1 - Cross-Site Scripting",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "[*, 3.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9306",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Step by Step \u003c= 0.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "step-by-step",
    "type": "plugin",
    "affected_version": "* - 0.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50535",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Catch Themes Demo Import \u003c= 2.1 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "catch-themes-demo-import",
    "type": "plugin",
    "affected_version": "[*, 2.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0440",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Bulletin Board \u003c= 1.1.4 - Reflected Cross-Site Scripting",
    "slug": "wp-bulletin-board",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22776",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CopySafe Web Protection \u003c 2.6 - Cross-Site Request Forgery",
    "slug": "wp-copysafe-web",
    "type": "plugin",
    "affected_version": "[*, 2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-8100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-8100",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Dummy Content Generator \u003c= 2.3.0 - Missing Authorization",
    "slug": "wp-dummy-content-generator",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37394",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "URL Shortener | Conversion Tracking | AB Testing | WooCommerce \u003c= 9.0.2 - Reflected Cross-Site Scripting",
    "slug": "easy-broken-link-checker",
    "type": "plugin",
    "affected_version": "* - 9.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23789",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Off-Canvas Sidebars \u0026 Menus (Slidebars) \u003c= 0.5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "off-canvas-sidebars",
    "type": "plugin",
    "affected_version": "* - 0.5.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29762",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Real Estate \u003c= 4.3.5 - Missing Authorization to Denial of Service",
    "slug": "essential-real-estate",
    "type": "plugin",
    "affected_version": "* - 4.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6139",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ThreeWP Email Reflector \u003c 1.16 - Cross-Site Scripting",
    "slug": "threewp-email-reflector",
    "type": "plugin",
    "affected_version": "[*, 1.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-2572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2572",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonials Widget \u003c= 3.5.1 - Multiple Authenticated Stored Cross-Site Scripting",
    "slug": "testimonials-widget",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24136",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy WP SMTP \u003c= 1.4.9 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "easy-wp-smtp",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3334",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Affiliate Disclosure Statement \u003c= 0.3 - Cross-Site Request Forgery",
    "slug": "affiliate-disclosure-statement",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22552",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sponsors Carousel \u003c= 4.02 - Authenticated (Admin+) Stored Cross-Site Scripting in show",
    "slug": "sponsors-carousel",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23808",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS \u003c= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4391",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Counter Up – Animated Number Counter \u0026 Milestone Showcase \u003c= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-counter-up",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10895",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multisite Content Copier/Updater \u003c= 1.4.0 - Reflected Cross-Site Scripting",
    "slug": "wp-multisite-content-copier",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25039",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OPSI Israel Domestic Shipments \u003c= 2.6.5 - Reflected Cross-Site Scripting",
    "slug": "woo-ups-pickup",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13100",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Disc Golf Manager \u003c= 1.0.0 - Unauthenticated PHP Object Injection",
    "slug": "disc-golf-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-48026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48026",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "10CentMail \u003c= 2.1.50 - Reflected Cross-Site Scripting",
    "slug": "10centmail-subscription-management-and-analytics",
    "type": "plugin",
    "affected_version": "* - 2.1.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56030",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Upload Types by WPForms \u003c= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "file-upload-types",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10016",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6163",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Videojs HTML5 Player \u003c= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "videojs-html5-player",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3985",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetWidgets For Elementor \u003c= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Box Widget",
    "slug": "jetwidgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2138",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Branda – White Label WordPress, Custom Login Page Customizer \u003c= 3.4.18 - Unauthenticated Full Path Disclosure",
    "slug": "branda-white-labeling",
    "type": "plugin",
    "affected_version": "* - 3.4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6554",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "viral-news",
    "type": "theme",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33923",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "hashone",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33923",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "viral",
    "type": "theme",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33923",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Page Visit Counter \u003c= 7.1.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "advanced-page-visit-counter",
    "type": "plugin",
    "affected_version": "* - 7.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-45074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45074",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All In One Favicon \u003c= 4.7 - Authenticated(Admin+) Directory Traversal",
    "slug": "all-in-one-favicon",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24416",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "AliExpress Dropshipping with AliNext Lite \u003c= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "ali2woo-lite",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2381",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BP Better Messages \u003c= 1.9.9.37 - Cross-Site Request Forgery",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "[*, 1.9.9.41)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.41",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24809",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Samex - Clean, Minimal Shop WooCommerce WordPress Theme \u003c= 2.6 - Unauthenticated Local File Inclusion",
    "slug": "samex",
    "type": "theme",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25998",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LiteSpeed Cache \u003c= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4372",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPPizza \u003c= 3.19.8 - Missing Authorization",
    "slug": "wppizza",
    "type": "plugin",
    "affected_version": "* - 3.19.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57894",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gutenverse \u003c= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutenverse",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3692",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Time Sheets \u003c 1.5.2 - Cross-Site Scripting",
    "slug": "time-sheets",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18582",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accounting for WooCommerce \u003c= 1.6.8 - Unauthenticated Local File Inclusion",
    "slug": "accounting-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30835",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Allow SVG Files \u003c= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "asf-allow-svg-files",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2299",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fontsampler \u003c= 0.4.14 - Reflected Cross-Site Scripting",
    "slug": "fontsampler",
    "type": "plugin",
    "affected_version": "* - 0.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27337",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Registration Forms \u003c= 2.0.6 - CSV Injection",
    "slug": "easy-registration-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-22275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-22275",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP FullCalendar \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-fullcalendar",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22261",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traveler Code \u003c= 3.1.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "traveler-code",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22700",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Comments Import \u0026 Export \u003c= 2.3.1 - CSV Injection",
    "slug": "comments-import-export-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45370",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization \u003c= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL",
    "slug": "shortpixel-adaptive-images",
    "type": "plugin",
    "affected_version": "* - 3.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6626",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wholesale Suite \u003c= 2.1.5 - Authenticated (Subscriber+) Cross-Site Scripting",
    "slug": "woocommerce-wholesale-prices",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41640",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tourfic – Ultimate Hotel Booking, Travel Booking \u0026 Apartment Booking WordPress Plugin | WooCommerce Booking \u003c= 2.15.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "tourfic",
    "type": "plugin",
    "affected_version": "* - 2.15.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12032",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Particle Background \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "particle-background",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11775",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yoo Slider \u003c= 2.1.1 - Reflected Cross-Site Scripting",
    "slug": "yoo-slider",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31106",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Re:WP \u003c= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "rewp",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9271",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP To Do \u003c= 1.3.0 - Cross-Site Request Forgery via wptodo_settings",
    "slug": "wp-todo",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3947",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FreeMind WP Browser \u003c= 1.2 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "freemind-wp-browser",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2443",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "twitterDash \u003c= 2.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "twitterdash",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9368",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Youtube Channel Pagination \u003c= 1.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "advanced-youtube-channel-pagination",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28693",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Private Messages for UserPro \u003c= 4.10.0 - Unauthenticated Local File Inclusion",
    "slug": "userpro-messaging",
    "type": "plugin",
    "affected_version": "* - 4.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-22311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22311",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multi Feed Reader \u003c= 2.2.4 - Cross-Site Request Forgery",
    "slug": "multi-feed-reader",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53718",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Send email only on Reply to My Comment \u003c= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "send-email-only-on-reply-to-my-comment",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6224",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "integration-for-contact-form-7-and-pipedrive",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34817",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Seraphinite Accelerator \u003c= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck",
    "slug": "seraphinite-accelerator",
    "type": "plugin",
    "affected_version": "* - 2.20.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1568",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Google Maps | by imbaa \u003c= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56011",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SendPress Newsletters \u003c= 1.23.11.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sendpress",
    "type": "plugin",
    "affected_version": "* - 1.23.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41729",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Avatar \u003c= 1.4.11 - Reflected Cross-Site Scripting",
    "slug": "user-avatar",
    "type": "plugin",
    "affected_version": "* - 1.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46621",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Showeblogin Social \u003c= 7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "showeblogin-facebook-page-like-box",
    "type": "plugin",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32169",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "hockeydata LOS \u003c= 1.2.4 - Unauthenticated Local File Inclusion",
    "slug": "hockeydata-los",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26889",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy MLS Listings Import \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-mls-listings-import",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12525",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extensions for Elementor \u003c= 2.0.40 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "extensions-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31889",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Moose Elementor Kit \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "moose-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51856",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Windows Live Writer \u003c=  0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "windows-live-writer",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32480",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Namaste! LMS \u003c= 2.6.3 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "namaste-lms",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50408",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Fastest Cache \u003c= 0.8.8.5 - Cross-Site Request Forgery via page to wpfastestcacheoptions",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 0.8.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-17584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17584",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Gmail SMTP \u003c= 1.0.7 - Sensitive Information Exposure",
    "slug": "wp-gmail-smtp",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53232",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Smarty for WordPress \u003c= 3.1.35 - Cross-Site Request Forgery via displaySmartyManagementPage",
    "slug": "smarty-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 3.1.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37992",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form to Any API \u003c= 1.1.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "contact-form-to-any-api",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30242",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Forms Google Sheet Connector \u003c= 1.0.6 - Reflected Cross-Site Scripting via 'code'",
    "slug": "gsheetconnector-for-elementor-forms-pro",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2324",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Forms Google Sheet Connector \u003c= 1.0.6 - Reflected Cross-Site Scripting via 'code'",
    "slug": "gsheetconnector-for-elementor-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2324",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FareHarbor for WordPress \u003c= 3.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "fareharbor",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5252",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Admin UI Customize \u003c= 1.5.13 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-admin-ui-customize",
    "type": "plugin",
    "affected_version": "* - 1.5.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53278",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plausible Analytics \u003c= 1.3.3 - Reflected Cross-Site Scripting via page-url",
    "slug": "plausible-analytics",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40553",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Map on Post/Page \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "google-map-on-postpage",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23517",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Select All Categories and Taxonomies, Change Checkbox to Radio Buttons \u003c 1.3.2 - Reflected Cross-Site Scripting",
    "slug": "select-all-categories-and-taxonomies-change-checkbox-to-radio-buttons",
    "type": "plugin",
    "affected_version": "[*, 1.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24287",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Draft List \u003c= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-draft-list",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11197",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form \u003c= 2.0.11 - Cross-Site Request Forgery",
    "slug": "contact-form-ready",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44231",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "URL Shortify \u003c= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via Referrer Header",
    "slug": "url-shortify",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4294",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailerLite – WooCommerce integration \u003c= 2.0.8 - Cross-Site Request Forgery via Multiple AJAX Functions",
    "slug": "woo-mailerlite",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52223",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "3D Photo Gallery \u003c= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "3d-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13751",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My auctions allegro \u003c= 3.6.18 - Reflected Cross-Site Scripting",
    "slug": "my-auctions-allegro-free-edition",
    "type": "plugin",
    "affected_version": "* - 3.6.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22733",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Content Pipelines \u003c= 1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "ai-content-pipelines",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2544",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Request a Quote \u003c= 2.3.8 - CSV Injection",
    "slug": "request-a-quote",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2240",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WP Slimstat \u003c= 4.8 - Unauthenticated Stored Cross-Site Scripting from Visitors",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15112",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress连接微博 \u003c= 2.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-connect",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12282",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadstreet Ads \u003c= 1.51.7 - Reflected Cross-Site Scripting",
    "slug": "broadstreet",
    "type": "plugin",
    "affected_version": "* - 1.51.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.51.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4652",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Time Slot \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "timeslot",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50418",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Tabs \u003c= 2.2.12 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "wp-expand-tabs-free",
    "type": "plugin",
    "affected_version": "* - 2.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48134",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Users Exporter \u003c= 1.4.2 - CSV Injection",
    "slug": "wp-users-exporter",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3026",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Login-Logout \u003c= 3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "login-logout",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53467",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IRM Newsroom \u003c= 1.2.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcode",
    "slug": "irm-newsroom",
    "type": "plugin",
    "affected_version": "* - 1.2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4584",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Filtering \u003c= 2.5.0 - Reflected Cross-Site Scripting",
    "slug": "easy-filtering",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23732",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.30",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.27",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.24",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.20",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.2",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.30",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.28",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.27",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.13",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.6",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.19",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.18",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.15",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.10",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.11",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery #2",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.3",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17670",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Forminator \u003c= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.44.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.44.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5341",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Widget \u003c= 1.3.9 - Sensitive Information Exposure",
    "slug": "new-contact-form-widget",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34754",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Fish House \u003c= 1.2.7 - Unauthenticated PHP Object Injection",
    "slug": "fish-house",
    "type": "theme",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31631",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Clear Sucuri Cache \u003c= 1.4 - Missing Authorization",
    "slug": "clear-sucuri-cache",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31469",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Delicious \u003c= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "delicious-recipes",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54023",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MelaPress Login Security \u003c= 1.3.0 - Authenticated (Admin+) Remote File Inclusion",
    "slug": "melapress-login-security",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35650",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Restrict \u003c= 2.5.5 - Cross-Site Request Forgery via pr_admin_page",
    "slug": "pagerestrict",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24702",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP2APP \u003c= 2.6.2 - Reflected Cross-Site Scripting",
    "slug": "wp2appir",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23811",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Slider With Description \u003c= 9.2 - Cross-Site Request Forgery",
    "slug": "image-slider-with-description",
    "type": "plugin",
    "affected_version": "* - 9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53308",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP EasyCart \u003c= 5.4.8 - Cross-Site Request Forgery via process_duplicate_product",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2896",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Hacker's Diet \u003c= 0.9.6b - SQL Injection",
    "slug": "the-hackers-diet",
    "type": "plugin",
    "affected_version": "* - 0.9.6b",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.6b",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2007-10003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-10003",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WC Marketplace \u003c= 4.1.3 - Missing Authorization",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31304",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sticky Buttons \u003c= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "sticky-buttons",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0703",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.1.6 - Missing Authorization to Unauthenticated Local File Inclusion, Arbitrary Settings Update, and User Creation",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-7950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7950",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themify - WooCommerce Product Filter \u003c= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter",
    "slug": "themify-wc-product-filter",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6027",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quick License Manager – WooCommerce Plugin \u003c= 2.4.17 - Reflected Cross-Site Scripting",
    "slug": "quick-license-manager",
    "type": "plugin",
    "affected_version": "* - 2.4.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11805",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto SEO \u003c= 2.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "auto-seo",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25147",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields: Extended \u003c= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "acf-extended",
    "type": "plugin",
    "affected_version": "* - 0.8.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5292",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business One Page \u003c= 1.2.9 - Missing Authorization to Notice Dismissal",
    "slug": "business-one-page",
    "type": "theme",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37505",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BestWebSoft Captcha \u003c= 4.0.6 - CAPTCHA Bypass",
    "slug": "captcha-bws",
    "type": "plugin",
    "affected_version": "[*, 4.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9283",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GNUCommerce \u003c 1.4.2 - Stored Cross-Site Scripting",
    "slug": "gnucommerce",
    "type": "plugin",
    "affected_version": "[*, 1.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18572",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Event Manager \u003c= 3.1.42 - Cross-Site Scripting",
    "slug": "wp-event-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.42",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47697",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Table Lite \u003c= 3.8.7 - Missing Authorization",
    "slug": "wc-product-table-lite",
    "type": "plugin",
    "affected_version": "* - 3.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24596",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PostBox \u003c= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Log Export",
    "slug": "postbox-email-logs",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54309",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Anonymous Restricted Content \u003c= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "anonymous-restricted-content",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11089",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Additional Custom Product Tabs for WooCommerce \u003c= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "product-tabs-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26749",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ValidateCertify \u003c= 1.6.2 - Cross-Site Request Forgery",
    "slug": "validar-certificados-de-cursos",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48115",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smash Balloon Social Post Feed \u003c= 4.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-facebook-feed",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4477",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Testimonials \u003c= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter",
    "slug": "sola-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9127",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenverse \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks",
    "slug": "gutenverse",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7727",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UpdraftPlus \u003c= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update",
    "slug": "updraftplus",
    "type": "plugin",
    "affected_version": "* - 1.23.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5982",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "XYDAC Ultimate Taxonomy Manager \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "ultimate-taxonomy-manager",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45836",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.24.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9047",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Search, Filters \u0026 Merchandising for WooCommerce \u003c= 3.0.58 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "instantsearch-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.0.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32181",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Learn \u003c= 1.0.1 - Unauthenticated PHP Object Injection",
    "slug": "quick-learn",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52441",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Customer Reviews \u003c= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "wp-customer-reviews",
    "type": "plugin",
    "affected_version": "* - 3.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4686",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Cross-Site Request Forgery Protection Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-5204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5204",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Cross-Site Request Forgery Protection Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.3",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5204",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Cross-Site Request Forgery Protection Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.3",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5204",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Cross-Site Request Forgery Protection Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.1",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5204",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AnyClip Luminous Studio \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "anyclip-media",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57910",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Daily Proverb \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "daily-proverb",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23859",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c= 3.2.1 - Unauthenticated Arbitrary File Upload",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3982",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Shipping – DPD baltic \u003c= 1.2.54 - Missing Authorization to Arbitrary Options Deletion",
    "slug": "woo-shipping-dpd-baltic",
    "type": "plugin",
    "affected_version": "* - 1.2.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.56",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3999",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "RegistrationMagic \u003c= 5.2.5.0 - IP Spoofing",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51543",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "QT KenthaRadio \u003c 2.0.2 \u0026 OnAir2 \u003c 3.9.9.2 - Server-Side Request Forgery \u0026 Remote File Inclusion",
    "slug": "onair2",
    "type": "theme",
    "affected_version": "[*, 3.9.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24472",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "QT KenthaRadio \u003c 2.0.2 \u0026 OnAir2 \u003c 3.9.9.2 - Server-Side Request Forgery \u0026 Remote File Inclusion",
    "slug": "qt-kentharadio",
    "type": "plugin",
    "affected_version": "[*, 2.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24472",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Link View \u003c= 0.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "link-view",
    "type": "plugin",
    "affected_version": "* - 0.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49039",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Poll Maker \u003c= 4.8.0 - Missing Authorization",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 4.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50904",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Create \u003c= 2.9.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "create",
    "type": "theme",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47356",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Addons for Elementor \u003c= 2.0.5.4.1 - Missing Authorization on Duplicate Post",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33595",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.8.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2009-2851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2851",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Newsletter \u003c= 20.15 - Unauthenticated SQL Injection",
    "slug": "email-newsletter",
    "type": "plugin",
    "affected_version": "* - 20.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9334",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WC Sales Notification \u003c= 1.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "wc-sales-notification",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1087",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Education Addon for Elementor \u003c= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode",
    "slug": "education-addon",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13854",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Video Downloader for TikTok \u003c 1.4 - Directory Traversal",
    "slug": "downloader-tiktok",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-24143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24143",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Layouts for Elementor \u003c= 1.7 - Missing Authorization to Unauthenticated Arbitrary File Upload",
    "slug": "layouts-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30533",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.253 - Cross-Site Request Fogery via extend_builder",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.253",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.253",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1361",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 2.3.1 - Missing Authorization to Settings Update",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15821",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Cloudflare \u003c= 4.12.2 - Missing Authorization via initProxy",
    "slug": "cloudflare",
    "type": "plugin",
    "affected_version": "* - 4.12.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0212",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Front End Users \u003c= 3.2.32 - Authenticated (Admin+) SQL injection",
    "slug": "front-end-only-users",
    "type": "plugin",
    "affected_version": "* - 3.2.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12410",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Eulerpool Research Systems \u003c= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "alleaktien-quantitativ",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10128",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "System Dashboard \u003c= 2.8.14 - Authenticated (Admin+) Arbitrary File Read",
    "slug": "system-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.8.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10708",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Decon WP SMS \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "decon-wp-sms",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27416",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OneStore Sites \u003c= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery",
    "slug": "onestore-sites",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13905",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Counter Box: Add Engaging Countdowns, Timers \u0026 Counters to Your WordPress Site \u003c= 2.0.6 - Authenticated (Administrator+) DOM-Based Stored Cross-Site Scripting",
    "slug": "counter-box",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13901",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pay with Vipps for WooCommerce \u003c= 1.14.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woo-vipps",
    "type": "plugin",
    "affected_version": "* - 1.14.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51485",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VK Blocks \u003c= 1.63.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block",
    "slug": "vk-blocks",
    "type": "plugin",
    "affected_version": "* - 1.63.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.63.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5706",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SpiderCalendar \u003c= 1.5.51 - SQL Injection",
    "slug": "spider-event-calendar",
    "type": "plugin",
    "affected_version": "* - 1.5.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.51",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-7719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-7719",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Ultimate CSV Importer \u003c= 6.5.7 - Missing Authorization",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 6.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3244",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GPT3 AI Content Writer \u003c= 1.9.14 - Cross-Site Request Forgery",
    "slug": "gpt3-ai-content-generator",
    "type": "plugin",
    "affected_version": "* - 1.9.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47470",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "My Restaurant Menu \u003c= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "my-restaurant-menu",
    "type": "plugin",
    "affected_version": "* - 0.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51849",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Giveaway \u003c= 1.2.2 - Authenticated (Admin+) SQL Injection",
    "slug": "giveaway",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24497",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Categorify \u003c= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "* - 1.0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1653",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SpeakPipe \u003c= 0.2 - Cross-Site Request Forgery",
    "slug": "speakpipe-voicemail-for-websites",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30619",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Copy Or Move Comments \u003c= 5.0.4 - Reflected Cross-Site Scripting",
    "slug": "copy-or-move-comments",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45634",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Excel Import Export \u0026 Bulk Edit for WooCommerce \u003c= 4.7 - Reflected Cross-Site Scripting",
    "slug": "webd-woocommerce-product-excel-importer-bulk-edit",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32674",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Increase upload file size \u0026 Maximum Execution Time limit \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "increase-upload-file-size-maximum-execution-time-limit",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9611",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feed Them Social – for Twitter feed, Youtube and more \u003c= 2.9.9 - Subscriber+ Stored Cross-Site Scripting",
    "slug": "feed-them-social",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2940",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Metrics \u003c= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "seo-metrics-helper",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6754",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Vuukle Comments, Reactions, Share Bar, Revenue \u003c= 3.4.31 - Cross-Site Request Forgery Bypass",
    "slug": "free-comments-for-wordpress-vuukle",
    "type": "plugin",
    "affected_version": "* - 3.4.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4427",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "phpinfo() WP \u003c= 5.0 - Unauthenticated Information Exposure",
    "slug": "phpinfo-wp",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35776",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MultiVendorX – MultiVendor Marketplace Solution For WooCommerce \u003c= 3.5.7 - Cross-Site Request Forgery Bypass",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "[*, 3.5.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36741",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SKT Blocks \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-blocks",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48270",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced iFrame \u003c= 2025.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 2025.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2025.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6987",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tidy Up \u003c= 1.3 - Cross-Site Request Forgery",
    "slug": "tidy-up",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56015",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Order auto complete for WooCommerce \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "order-auto-complete-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45072",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sticky Anything \u003c= 2.1.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "toast-stick-anything",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-30551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30551",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SimpleModal Contact Form (SMCF) \u003c= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simplemodal-contact-form-smcf",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29438",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBakery Visual Composer \u003c= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1841",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdRotate – Ad manager \u0026 AdSense Ads 3.9 - 3.9.4 - SQL Injection",
    "slug": "adrotate",
    "type": "plugin",
    "affected_version": "3.9 - 3.9.4",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-1854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-1854",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YellowPencil Visual CSS Style Editor \u003c= 7.5.8 - Reflected Cross-Site Scripting liveLink",
    "slug": "yellow-pencil-visual-theme-customizer",
    "type": "plugin",
    "affected_version": "* - 7.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-33961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33961",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme Editor \u003c= 2.7.1 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "theme-editor",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6091",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Post Disclaimer \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-post-disclaimer",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29761",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog Summary \u003c= 0.1.2 β - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blog-summary",
    "type": "plugin",
    "affected_version": "* - 0.1.2 β",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2 β",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23887",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Facilita Form Tracker \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "facilita-form-tracker",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25128",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Be POPIA Compliant \u003c= 1.1.5 - Sensitive Information Exposure",
    "slug": "be-popia-compliant",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1186",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Eventer \u003c= 3.11.2.1 -  Unauthenticated Arbitrary Shortcode Execution",
    "slug": "eventer",
    "type": "plugin",
    "affected_version": "* - 3.11.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39483",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 5.12.6 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 5.12.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23800",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JobSearch \u003c 3.0.6 - Reflected Cross-Site Scripting",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "[*, 3.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-52798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52798",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Secure Copy Content Protection and Content Locking \u003c= 2.6.6 - SQL Injection",
    "slug": "secure-copy-content-protection",
    "type": "plugin",
    "affected_version": "[*, 2.6.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24484",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YourChannel \u003c= 1.2.1 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "yourchannel",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4833",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Spotify Play Button \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spotify-play-button",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5199",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP News Sliders \u003c= 1.0 - Missing Authorization",
    "slug": "wp-news-sliders",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22779",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Popup Banners \u003c= 1.2.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-popup-banners",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1471",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Invite Anyone \u003c= 1.4.7 - Reflected Cross-Site Scripting",
    "slug": "invite-anyone",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43327",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Table Maker \u003c= 1.9.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "table-maker",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34574",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Accessibility Task Manager \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "accessibility-task-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23725",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flying Twitter Birds \u003c= 1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "flying-twitter-birds",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23710",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c 0.9.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "[*, 0.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24869",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Job Listings 0.1 - 0.1.1 - Unauthenticated Privilege Escalation via register_action Function",
    "slug": "job-listings",
    "type": "plugin",
    "affected_version": "0.1 - 0.1.1",
    "from_version": "0.1",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3918",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wpDiscuz \u003c= 7.6.10 - Insufficient Authorization to Comment Submission on Deleted Posts",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46309",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Visitor Details \u003c= 1.0.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "visitors-details",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25132",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoice Builder \u003c= 1.2.103 - Reflected Cross-Site Scripting",
    "slug": "woo-pdf-invoice-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.103",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.103",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46076",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PB MailCrypt \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pb-mailcrypt-antispam-email-encryption",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33935",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextCellent Gallery \u003c= 1.9.35 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "nextcellent-gallery-nextgen-legacy",
    "type": "plugin",
    "affected_version": "* - 1.9.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1971",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar \u003c= 1.1.7 - SQL Injection",
    "slug": "appointment-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-7319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7319",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GoDaddy Email Marketing \u003c= 1.4.3 - Missing Authorization",
    "slug": "godaddy-email-marketing-sign-up-forms",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49156",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "PromoBar by BestWebSoft – Customizable Advertisement Banner for WordPress Website \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "promobar",
    "type": "plugin",
    "affected_version": "[*, 1.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18529",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Map Plugin \u003c 2.3.10 - Cross-Site Request Forgery",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "[*, 2.3.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9308",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "menu shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "menu-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0395",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Interactive UK Map \u003c= 3.4.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "interactive-uk-map",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56267",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N"
  },
  {
    "title": "XO Slider \u003c= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xo-liteslider",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-32280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-32280",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slickr Flickr \u003c= 2.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "slickr-flickr",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3021",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VibeBP \u003c 1.9.9.5.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "vibebp",
    "type": "plugin",
    "affected_version": "[*, 1.9.9.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-56041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56041",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Genealogy – Your Family History Website \u003c= 0.1.9 - Missing Authorization",
    "slug": "wpgenealogy",
    "type": "plugin",
    "affected_version": "* - 0.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32252",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking Calendar and Notification \u003c= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions",
    "slug": "booking-calendar-and-notification",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13746",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ReverbNation Widgets \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "reverbnation-widgets",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25095",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 4.8.9  and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "4.9.2",
    "from_version": "4.9.2",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5212",
    "auth_type": "Auth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
  },
  {
    "title": "AI ChatBot \u003c= 4.8.9  and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5212",
    "auth_type": "Auth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
  },
  {
    "title": "Donations Made Easy – Smart Donations \u003c= 4.0.12 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "smart-donations",
    "type": "plugin",
    "affected_version": "* - 4.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40664",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fana \u003c= 1.1.28 - Unauthenticated Local File Inclusion",
    "slug": "fana",
    "type": "theme",
    "affected_version": "* - 1.1.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.28",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49251",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Netgsm \u003c= 2.8 - Reflected Cross-Site Scripting",
    "slug": "netgsm",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32544",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Gallery \u003c= 2.3.12 - Cross-Site Request Forgery",
    "slug": "simple-post-gallery",
    "type": "plugin",
    "affected_version": "* - 2.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45752",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.7.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22670",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Waiting: One-click countdowns \u003c= 0.6.2 - Authenticated (Administrator+) Cross-Site Scripting",
    "slug": "waiting",
    "type": "plugin",
    "affected_version": "* - 0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4954",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search Everything \u003c= 8.1.5 - SQL Injection",
    "slug": "search-everything",
    "type": "plugin",
    "affected_version": "[*, 8.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10917",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Timer \u003c= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode",
    "slug": "easy-timer",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9519",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Koalendar – Events \u0026 Appointments Booking Calendar \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter",
    "slug": "koalendar-free-booking-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11855",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support – WordPress HelpDesk \u0026 Support Plugin \u003c= 6.1.7 - Missing Authorization via editor_html()",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0596",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Video Player for YouTube \u003c= 1.3 - Cross-Site Scripting",
    "slug": "yt-player",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24414",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LinkLaunder SEO \u003c= 0.92.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "linklaunder-seo-plugin",
    "type": "plugin",
    "affected_version": "* - 0.92.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.92.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53727",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 4.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 4.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9428",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, \u0026 Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "5.1.16 - 6.1.1",
    "from_version": "5.1.16",
    "from_inclusive": true,
    "to_version": "6.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9260",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Forge – Front-End Page Builder \u003c= 1.4.6 - Cross-Site Request Forgery to Stored Cross-site Scripting",
    "slug": "forge",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22703",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Post Generator | AutoWriter \u003c= 3.3 - Missing Authorization",
    "slug": "ai-post-generator",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1850",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Global Gallery - WordPress Responsive Gallery \u003c= 9.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "global-gallery",
    "type": "plugin",
    "affected_version": "* - 9.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13814",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Admission AppManager \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "admission-appmanager",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4507",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.10 - Unauthenticated Local File Inclusion",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54034",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Builder by SiteOrigin \u003c= 2.29.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode",
    "slug": "siteorigin-panels",
    "type": "plugin",
    "affected_version": "* - 2.29.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.29.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4361",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Cross-Site Request Forgery via ajax_unassign_folders",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0685",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Miniorange OTP Verification with Firebase \u003c= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role Value",
    "slug": "miniorange-firebase-sms-otp-verification",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9863",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Frontend File Manager \u003c= 23.2 - Missing Authorization",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "* - 23.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "23.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57921",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI Mortgage Calculator \u003c= 1.0.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "ai-mortgage-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25995",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "affiliate-toolkit – WordPress Affiliate Plugin \u003c= 3.3.9 - Open Redirect via atkpout.php",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-45105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45105",
    "auth_type": "Unauth",
    "cvss_score": 3.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Simple Login Log \u003c 1.1.2 - SQL Injection",
    "slug": "simple-login-log",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-18573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18573",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP EasyPay \u003c= 4.0.4 - Cross-Site Request Forgery",
    "slug": "wp-easy-pay",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47177",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Events Addon for Elementor \u003c= 2.1.2 - Missing Authorization",
    "slug": "events-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47827",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bknewsticker \u003c= 1.0.5 - Cross-Site Request Forgery",
    "slug": "bknewsticker",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39433",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ajax Search Lite \u003c= 4.11.4 - Reflected Cross-Site Scripting",
    "slug": "ajax-search-lite",
    "type": "plugin",
    "affected_version": "* - 4.11.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.11.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-21752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-21752",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Preloader \u003c= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "easy-preloader",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24344",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Revolution \u003c 6.6.19 - Authenticated (Author+) PHP Object Injection",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "[*, 6.6.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.19",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-6528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6528",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 5.5 - SQL Injection",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "[*, 5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0410",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart App Banner \u003c= 1.1.2 - Cross-Site Request Forgery via wsl_smart_app_banner_options",
    "slug": "smart-app-banner",
    "type": "plugin",
    "affected_version": "[*, 1.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-33315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33315",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Relogo \u003c= 0.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "relogo",
    "type": "plugin",
    "affected_version": "* - 0.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9269",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard \u003c= 5.0.6.3 and \u003c= 2.11.0 - Reflected Cross-Site Scripting",
    "slug": "drag-n-drop-upload-cf7-pro",
    "type": "plugin",
    "affected_version": "2.0 - 2.11.0",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1282",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard \u003c= 5.0.6.3 and \u003c= 2.11.0 - Reflected Cross-Site Scripting",
    "slug": "drag-n-drop-upload-cf7-pro",
    "type": "plugin",
    "affected_version": "5.0 - 5.0.6.3",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1282",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cobwebo URL Plugin \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "cobwebo-url",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23688",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Divi – Divi Preloader, Modules for Divi \u0026 Extra Theme \u003c= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "exclusive-divi",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9386",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRUDLab Scroll to Top \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "crudlab-scroll-to-top",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22774",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nexa Blocks \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nexa-blocks",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30952",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.260 - Missing Authorization",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.260",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.260",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1870",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.12 - Authenticated (Admin+) SQL Injection",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "* - 4.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43969",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.15",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.31",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.25",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.19",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.3",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.29",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.28",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.16",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.11",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.7",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.21",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.4",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.12",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.31",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.28",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Stored Cross-Site Scripting via Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.20",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16780",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WHMpress \u003c= 6.2-revision-5 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "whmpress",
    "type": "plugin",
    "affected_version": "[*, 6.2-revision-5]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2-revision-5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43247",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Doppler Forms \u003c= 2.4.6 - Missing Authorization",
    "slug": "doppler-form",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32620",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mixtape \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mixtape",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9860",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.3.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-1304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-1304",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSV Me \u003c= 2.0 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "csv-me",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6086",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy WP SMTP by SendLayer \u003c= 2.3.0 - Exposure of Sensitive Information via the UI",
    "slug": "easy-wp-smtp",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-3073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3073",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Change Table Prefix \u003c= 2.0 - Cross-Site Request Forgery via change_prefix_form",
    "slug": "change-table-prefix",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-25932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25932",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"
  },
  {
    "title": "MetForm \u003c= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5684",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Services Section block \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "services-section",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26947",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) \u003c= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widget",
    "slug": "ultimate-post-kit",
    "type": "plugin",
    "affected_version": "* - 3.11.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5662",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Engine \u003c= 2.6.3 - Authenticated (Admin+) SQL Injection",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10499",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced Custom Fields: Link Picker Field \u003c= 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "acf-link-picker-field",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26746",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Academy LMS \u003c= 1.9.16 - Missing Authorization",
    "slug": "academy",
    "type": "plugin",
    "affected_version": "* - 1.9.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33912",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Hive Support – WordPress Help Desk \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "hive-support",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54321",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Leadster \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "leadster-marketing-conversacional",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41668",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Duplicator \u003c= 2.16 - Reflected Cross-Site Scripting",
    "slug": "post-duplicator",
    "type": "plugin",
    "affected_version": "* - 2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-15027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-15027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Side Menu Lite - add sticky fixed buttons \u003c 2.2.6 - SQL Injection",
    "slug": "side-menu-lite",
    "type": "plugin",
    "affected_version": "[*, 2.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24580",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OnePress \u003c= 2.3.11 - Missing Authorization",
    "slug": "onepress",
    "type": "theme",
    "affected_version": "* - 2.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22643",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 3.9.7 - Unauthenticated SQL Injection",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-47614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47614",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "QR code MeCard/vCard generator \u003c= 1.6.0 - Missing Authorization via wqm_make_url_permanent",
    "slug": "wp-qrcode-me-v-card",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38477",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Button \u003c= 1.1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "button",
    "type": "plugin",
    "affected_version": "* - 1.1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23871",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fancy Roller Scroller \u003c= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "fancy-roller-scroller",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54351",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DN Shipping by Weight for WooCommerce \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "dn-shipping-by-weight",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32535",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mesmerize \u003c= 1.6.89 \u0026 Materialis \u003c= 1.0.172 - Authenticated Arbitrary Options Update",
    "slug": "mesmerize",
    "type": "theme",
    "affected_version": "* - 1.6.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-25142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25142",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mesmerize \u003c= 1.6.89 \u0026 Materialis \u003c= 1.0.172 - Authenticated Arbitrary Options Update",
    "slug": "materialis",
    "type": "theme",
    "affected_version": "* - 1.0.172",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.172",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-25142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25142",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Black Widgets For Elementor \u003c= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "black-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39644",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tourfic \u003c= 2.15.3 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "tourfic",
    "type": "plugin",
    "affected_version": "* - 2.15.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24650",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "W3 Total Cache \u003c= 0.9.2.4 - Password Hash Extraction",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "* - 0.9.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-6077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6077",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Radcliffe 2 \u003c= 2.0.17 - Missing Authorization",
    "slug": "radcliffe-2",
    "type": "theme",
    "affected_version": "* - 2.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35685",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Beds24 Online Booking \u003c= 2.0.23 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "beds24-online-booking",
    "type": "plugin",
    "affected_version": "* - 2.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24717",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Archive Page \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "archive-page",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27280",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP125 \u003c= 1.5.4 -  Cross-Site Request Forgery to Arbitrary Ad Deletion",
    "slug": "wp125",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25073",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Abstracts \u003c= 2.7.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "wp-abstracts-manuscripts-manager",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12385",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WEN Responsive Columns \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wen-responsive-columns",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27988",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hide It \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hide-it",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5565",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Ads Manager \u003c 2.7.97 - Multiple SQL Injections",
    "slug": "simple-ads-manager",
    "type": "plugin",
    "affected_version": "[*, 2.7.97)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.97",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-2824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2824",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Videojs HTML5 Player \u003c= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via videojs_video Shortcode",
    "slug": "videojs-html5-player",
    "type": "plugin",
    "affected_version": "* - 1.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5205",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Feed \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ht-instagram",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35699",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobify - Job Board WordPress Theme \u003c= 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jobify",
    "type": "theme",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52478",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Analytics Cat – Google Analytics Made Easy \u003c= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "analytics-cat",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40311",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReviewX \u003c= 1.6.17 - Missing Authorization in rx_coupon_from_submit",
    "slug": "reviewx",
    "type": "plugin",
    "affected_version": "* - 1.6.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40670",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EasyCart \u003c= 2.0.5 - Sensitive Information Disclosure",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4942",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPForms Lite \u003c= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter",
    "slug": "wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 1.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3794",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Categories Selection Widget \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-product-category-selection-widget",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33925",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon Page \u0026 Maintenance Mode \u003c= 1.8.1 - Unauthenticated Settings Reset",
    "slug": "responsive-coming-soon",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-25139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25139",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Otter Blocks \u003c= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2729",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Slider \u003c= 3.7.0 - Cross-Site Request Forgery",
    "slug": "gs-logo-slider",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9233",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Directorist \u003c= 7.8.4 - Missing Authorization to Unauthenticated Settings Change",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1322",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hebrew Date \u003c= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "hebrewdates",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52388",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BadgeOS \u003c= 3.7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "badgeos",
    "type": "plugin",
    "affected_version": "* - 3.7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2171",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Notice \u003c= 1.2.0 - Missing Authorization",
    "slug": "gdpr-cookie-notice",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31765",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Generate Child Theme \u003c= 2.0 - Cross-Site Request Forgery via process_create_form()",
    "slug": "generate-child-theme",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31279",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AR For WordPress \u003c= 7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ar-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26913",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution \u003c= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site Scripting",
    "slug": "marketking-multivendor-marketplace-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.80",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13519",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LatePoint \u003c= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 5.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8911",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AIomatic - Automatic AI Content Writer \u003c= 2.0.5 - Unauthenticated Arbitrary Email Sending",
    "slug": "aiomatic-automatic-ai-content-writer",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5969",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – Freightview Edition \u003c= 1.0.11, LTL Freight Quotes – Daylight Edition \u003c=2.2.6 and LTL Freight Quotes – Day \u0026 Ross Edition \u003c= 2.1.10 - Unauthenticated Stored Cross-Site Scripting via `expiry_date` Parameter",
    "slug": "ltl-freight-quotes-freightview-edition",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5303",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – Freightview Edition \u003c= 1.0.11, LTL Freight Quotes – Daylight Edition \u003c=2.2.6 and LTL Freight Quotes – Day \u0026 Ross Edition \u003c= 2.1.10 - Unauthenticated Stored Cross-Site Scripting via `expiry_date` Parameter",
    "slug": "ltl-freight-quotes-day-ross-edition",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5303",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – Freightview Edition \u003c= 1.0.11, LTL Freight Quotes – Daylight Edition \u003c=2.2.6 and LTL Freight Quotes – Day \u0026 Ross Edition \u003c= 2.1.10 - Unauthenticated Stored Cross-Site Scripting via `expiry_date` Parameter",
    "slug": "ltl-freight-quotes-daylight-edition",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5303",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IQ Testimonials \u003c= 2.2.7 - Unauthenticated Arbitrary File Upload",
    "slug": "iq-testimonials",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6314",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Avada \u003c= 7.11.6 - Authenticated (Admin+) SQL Injection via entry",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2344",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CRM and Lead Management by vcita \u003c= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "crm-customer-relationship-management-by-vcita",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2404",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Olive One Click Demo Import \u003c= 1.1.1 - Missing Authorization",
    "slug": "olive-one-click-demo-import",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2702",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Remove Add to Cart WooCommerce \u003c= 1.4.4 - Cross-Site Request Forgery to Settings Modification",
    "slug": "remove-add-to-cart-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46629",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pojo Forms \u003c= 1.4.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode",
    "slug": "pojo-forms",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10909",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Schema \u0026 Structured Data for WP \u0026 AMP \u003c= 1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via How To and FAQ Blocks",
    "slug": "schema-and-structured-data-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3491",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1571",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant Reservations \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nd-restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37223",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.46.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.46.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3869",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 4.1.9 - Reflected Cross-Site Scripting",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 4.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10866",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Headers And Footers \u003c= 3.1.1 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "wp-headers-and-footers",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2111",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dynamic Widgets \u003c= 1.6.4 - Cross-Site Request Forgery",
    "slug": "dynamic-widgets",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51669",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Contact Form7 Email Spam Blocker \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-contact-form7-email-spam-blocker",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13467",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Audio Dock \u003c= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themify-audio-dock",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56239",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Elementor Addon \u003c= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-grid-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 2.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56268",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DSGVO All in one for WP \u003c= 4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dsgvo-all-in-one-for-wp",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2628",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.6 - Multiple Cross-Site Request Forgery Issues",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-10233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10233",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Calendar Events \u003c= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "google-calendar-events",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49151",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Verification SMS with TargetSMS \u003c= 1.5 - Unauthenticated Limited Remote Code Execution",
    "slug": "verification-sms-targetsms",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3776",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Next Event Calendar \u003c= 1.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "next-event-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26001",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On Hover",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.5.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2517",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCS – WordPress Currency Switcher Professional \u003c= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Deletion",
    "slug": "currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2556",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.6 - Insecure Direct Object Reference",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36906",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PostX Gutenberg Blocks Saved Templates Addon \u003c= 2.4.9 - Private Content Disclosure",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24661",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form by BestWebSoft \u003c= 3.51 - Cross-Site Scripting",
    "slug": "contact-form-plugin",
    "type": "plugin",
    "affected_version": "* - 3.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-7475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7475",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Laika Pedigree Tree \u003c= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "laika-pedigree-tree",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22593",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Delivery Date for WP e-Commerce \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "order-delivery-date",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41858",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TransFinanz \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "transfinanz",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13332",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup by Supsystic \u003c= 1.10.29 - Authenticated (Admin+) Remote Code Execution",
    "slug": "popup-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.10.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.29",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52434",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Realty Workstation \u003c= 1.0.45 - Missing Authorization",
    "slug": "realty-workstation",
    "type": "plugin",
    "affected_version": "* - 1.0.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23477",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Company Directory \u003c= 4.3 - Reflected Cross-Site Scripting via add_query_arg Function",
    "slug": "staff-directory-pro",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13839",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TI WooCommerce Wishlist \u003c= 1.21.11 and TI WooCommerce Wishlist Pro \u003c= 1.21.4 - Arbitrary Options Update",
    "slug": "ti-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 1.21.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36725",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TI WooCommerce Wishlist \u003c= 1.21.11 and TI WooCommerce Wishlist Pro \u003c= 1.21.4 - Arbitrary Options Update",
    "slug": "ti-woocommerce-wishlist-premium",
    "type": "plugin",
    "affected_version": "* - 1.21.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36725",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Live Flight Radar \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "live-flight-radar",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22824",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Reviews \u003c= 6.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "* - 6.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1525",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forty Four – 404 Plugin for WordPress \u003c= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "forty-four",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34423",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.0.9 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-0192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0192",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Image Popup Shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-image-popup-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5342",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goya \u003c= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters",
    "slug": "goya",
    "type": "theme",
    "affected_version": "* - 1.0.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4017",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Table Builder \u003c= 2.0.5 - Reflected Cross-Site Scripting",
    "slug": "wp-table-builder",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32598",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meta Box – WordPress Custom Fields Framework \u003c= 5.9.10 - Missing Authorization to Information Exposure",
    "slug": "meta-box",
    "type": "plugin",
    "affected_version": "* - 5.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43235",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SoundCloud Is Gold \u003c= 2.3.1 - Reflected Cross-Site Scripting",
    "slug": "soundcloud-is-gold",
    "type": "plugin",
    "affected_version": "[*, 2.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9420",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Docs \u003c= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-docs",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35695",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBookit \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wpbookit",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26910",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins \u003c= 2.0.58 - Sensitive Information Exposure",
    "slug": "related-post",
    "type": "plugin",
    "affected_version": "* - 2.0.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10937",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Depicter Slider \u003c= 1.9.0 - Missing Authorization on 'make' function",
    "slug": "depicter",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47176",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-26019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-26019",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 2.7.11 - Authenticated (Administrator+) SQL Injection",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 2.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-34179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34179",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pods - Custom Content Types and Fields - Missing Authorization",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "[*, 2.7.31)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.31",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6965",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pods - Custom Content Types and Fields - Missing Authorization",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "[2.8, 2.8.23.2)",
    "from_version": "2.8",
    "from_inclusive": true,
    "to_version": "2.8.23.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6965",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pods - Custom Content Types and Fields - Missing Authorization",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "[3, 3.0.10.2)",
    "from_version": "3",
    "from_inclusive": true,
    "to_version": "3.0.10.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6965",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PayPlus Payment Gateway \u003c= 6.6.8 - Unauthenticated SQL Injection",
    "slug": "payplus-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 6.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6205",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP-Optimize \u003c= 4.1.1 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-optimize",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3951",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MakeStories (for Google Web Stories) \u003c= 3.0.2 - Cross-Site Request Forgery via 'ms_set_options'",
    "slug": "makestories-helper",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27448",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack CRM \u003c= 5.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "zero-bs-crm",
    "type": "plugin",
    "affected_version": "* - 5.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27429",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP EXtra \u003c= 6.2 - Missing Authorization to Arbitrary Email Sending",
    "slug": "wp-extra",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5314",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Web3 Cryptocurrency Payments by DePay for WooCommerce \u003c= 2.12.17 - Missing Authorization to Information Exposure",
    "slug": "depay-payments-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.12.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12265",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload – Contact Form 7 \u003c= 1.3.6.5 - Cross-Site Request Forgery in dnd_upload_cf7_upload and dnd_codedropz_upload_delete",
    "slug": "drag-and-drop-multiple-file-upload-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45364",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "KiviCare – Clinic \u0026 Patient Management System (EHR) \u003c= 3.6.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "kivicare-clinic-management-system",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11729",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Monkee-Boy Essentials \u003c= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "monkee-boy-wp-essentials",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9116",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login Manager – Design Login Page, View Login Activity, Limit Login Attempts \u003c= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom URL",
    "slug": "customized-login",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2613",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Math Comment Spam Protection \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "math-comment-spam-protection",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-0204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0204",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Attachments \u003c= 5.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-attachments",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3469",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Book a Place \u003c= 0.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "book-a-place",
    "type": "plugin",
    "affected_version": "* - 0.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23690",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress - 1.5-1.5.4 - SQL Injection",
    "slug": "buddypress",
    "type": "plugin",
    "affected_version": "1.5 - 1.5.4",
    "from_version": "1.5",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-2109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2109",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25027",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Automator \u003c= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "uncanny-automator",
    "type": "plugin",
    "affected_version": "* - 6.3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2075",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP VR \u003c= 8.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.5.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24730",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPJAM Basic \u003c= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wpjam-basic",
    "type": "plugin",
    "affected_version": "* - 6.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23709",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lana Downloads Manager \u003c= 1.9.0 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "lana-downloads-manager",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2048",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Adning Advertising \u003c= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal",
    "slug": "angwp",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36728",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Yandex Site search pinger \u003c= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "yandex-pinger",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48352",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GPX Viewer \u003c= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation",
    "slug": "gpx-viewer",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10629",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LadiApp \u003c= 4.4 - Cross-Site Request Forgery via ladiflow_save_hook()",
    "slug": "ladipage",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4628",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-T-Wap \u003c= 1.13.2 - Reflected Cross-Site Scripting",
    "slug": "wp-t-wap",
    "type": "plugin",
    "affected_version": "* - 1.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38331",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PixelYourSite \u003c= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification",
    "slug": "pixelyoursite",
    "type": "plugin",
    "affected_version": "* - 11.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10588",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Broadcast Live Video – Live Streaming \u003c 4.29.5 - Full Path Disclosure",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "[*, 4.29.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.29.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-1908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-1908",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Oceanpayment CreditCard Gateway \u003c= 6.0 - Missing Authentication to Unauthenticated Order Status Update",
    "slug": "oceanpayment-creditcard-gateway",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11728",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Magazine Modules Lite \u003c= 1.1.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-magazine-modules-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5574",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Moka Get Posts Shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "moka-get-posts",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51804",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DSGVO All in one for WP \u003c= 4.6 - Cross-Site Request Forgery to Account Deletion",
    "slug": "dsgvo-all-in-one-for-wp",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13356",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 3.0.4 - Unauthenticated Insecure Direct Object Reference to Order Status Update",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37277",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Social Pixel \u003c= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ns-facebook-pixel-for-wp",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24381",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ServerBuddy by PluginBuddy.com \u003c= 1.0.5 - Cross-Site Request Forgery to PHP Object Injection",
    "slug": "serverbuddy-by-pluginbuddy",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49895",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Include Me \u003c= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "include-me",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58983",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Activity Log Premium \u003c= 4.5.0 - Missing Authorization via ajax_switch_db",
    "slug": "wp-security-audit-log-premium",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2284",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FAQs \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "faqs",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56033",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woostify Sites Library \u003c= 1.4.7 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update",
    "slug": "woostify-sites-library",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6279",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Autoptimize \u003c= 2.7.7 - Race Condition leading to Remote Code Execution",
    "slug": "autoptimize",
    "type": "plugin",
    "affected_version": "[*, 2.7.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24377",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NMR Strava activities \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nmr-strava-activities",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51603",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DS Site Message \u003c= 1.14.4 - Cross-Site Request Forgery",
    "slug": "ds-site-message",
    "type": "plugin",
    "affected_version": "* - 1.14.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34439",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GS Testimonial Slider \u003c= 1.9.6 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "gs-testimonial",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-35882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-35882",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 4.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2736",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega \u003c= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1397",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "How to Create an App for Android iPhone Easytouch \u003c= 3.0 - Missing Authorization",
    "slug": "mobile-friendly-app-builder-by-easytouch",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-1002000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002000",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newpost Catch \u003c= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via npc Shortcode",
    "slug": "newpost-catch",
    "type": "plugin",
    "affected_version": "* - 1.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1406",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointify \u003c= 1.0.8 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "appointify",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31577",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Affiliate Links \u003c= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset",
    "slug": "easy-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5864",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "URL Shortener \u003c= 3.0.7 - Unauthenticated PHP Object Injection",
    "slug": "exact-links",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28961",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email Subscription Popup \u003c= 1.2.19 - Reflected Cross-Site Scripting",
    "slug": "email-subscribe",
    "type": "plugin",
    "affected_version": "* - 1.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6555",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customizable WordPress Gallery Plugin – Modula Image Gallery \u003c= 2.6.9 - Missing Authorization to Plugin Settings Change",
    "slug": "modula-best-grid-gallery",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41135",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Stylish Price List \u003c= 6.9.0 - Missing Authorization",
    "slug": "stylish-price-list",
    "type": "plugin",
    "affected_version": "* - 6.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24770",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "quote-posttype-plugin \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quote-post-type-plugin",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13386",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Headway \u003c 3.8.9 - Cross-Site Scripting",
    "slug": "headway",
    "type": "theme",
    "affected_version": "[*, 3.8.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10953",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HeartThis \u003c= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "heart-this",
    "type": "plugin",
    "affected_version": "* - 0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31121",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WZ Followed Posts – Display what visitors are reading \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "where-did-they-go-from-here",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4171",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 6.1.0 - Reflected Cross-Site Scripting via current_month_divider parameter",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 6.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24925",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetWidgets for Elementor and WooCommerce \u003c= 1.1.7 - Authenticated (Contributor+) Limited Local File Inclusion",
    "slug": "jetwoo-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-38772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38772",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Events Manager \u003c= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cost of Goods Sold (COGS): Cost \u0026 Profit Calculator for WooCommerce \u003c= 3.2.8 - Reflected Cross-Site Scripting",
    "slug": "cost-of-goods-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0821",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Team Member \u003c= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ht-team-member",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49309",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom post types, Custom Fields \u0026 more \u003c= 5.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-post-types",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6993",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RapidLoad – Optimize Web Vitals Automatically \u003c= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Limited Setting Reset",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13651",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0169",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Addons for Contact Form 7 \u003c= 3.2.0 - Reflected Cross-Site Scripting",
    "slug": "ultimate-addons-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49766",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 1.6.5 - Cross-Site Request Forgery",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-19109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19109",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery Factory Lite \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gallery-factory-lite",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0148",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Labels For Woocommerce (Sale Badges) \u003c= 1.5.8 - Authenticated (Admin+) SQL Injection",
    "slug": "aco-product-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12109",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "FileBird – WordPress Media Library Folders \u0026 File Manager \u003c= 6.4.8 - Authenticated (Author+) SQL Injection",
    "slug": "filebird",
    "type": "plugin",
    "affected_version": "* - 6.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6986",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 3.8.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25046",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backwp \u003c= 2.0.2 - Cross-Site Request Forgery",
    "slug": "backwp",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28954",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BM Content Builder \u003c 3.16.3.3 - Authenticated (Contributor+) Arbitrary File Deletion",
    "slug": "bm-builder",
    "type": "plugin",
    "affected_version": "[*, 3.16.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.3.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-59002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59002",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Analytify \u003c= 4.2.3 - Missing Authorization \u0026 Cross-Site Request Forgery",
    "slug": "wp-analytify",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45830",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more \u003c= 2.21.0 - Reflected Cross-Site Scripting",
    "slug": "rabbit-loader",
    "type": "plugin",
    "affected_version": "* - 2.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.21.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8800",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chamber Dashboard Business Directory \u003c= 3.3.10 - Missing Authorization",
    "slug": "chamber-dashboard-business-directory",
    "type": "plugin",
    "affected_version": "* - 3.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23917",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Note Press \u003c 0.1.2 - SQL Injection",
    "slug": "note-press",
    "type": "plugin",
    "affected_version": "[*, 0.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-18548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18548",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blossom Shop \u003c= 1.1.7 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "blossom-shop",
    "type": "theme",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37412",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Constant Contact Forms \u003c= 1.14.0 - Missing Authorization via constant_contact_optin_ajax_handler",
    "slug": "constant-contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34387",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Affiliate Disclosure \u003c= 1.2.6 - Cross-Site Request Forgery via check_capability",
    "slug": "wp-affiliate-disclosure",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47232",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Login Attempt Log \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "wp-login-attempt-log",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23568",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carts Guru \u003c= 1.4.5 - PHP Object Injection",
    "slug": "carts-guru",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-12241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12241",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.36 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Animated Text Widget",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6495",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "012 PS Multi Languages \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "012-ps-multi-languages",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8723",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.11.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "[*, 2.12.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24524",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.1.10 - Authenticated (Tutor Instructor+) SQL Injection",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25990",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Clock In Portal \u003c= 2.1 - Cross-Site Request Forgery To Staff Deletion",
    "slug": "clock-in-portal",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0761",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Landing Page Cat – Coming Soon Page, Maintenance Page \u0026 Squeeze Pages \u003c= 1.7.7 - Reflected Cross-Site Scripting",
    "slug": "landing-page-cat",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24576",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteOrigin Widgets Bundle \u003c= 1.58.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "so-widgets-bundle",
    "type": "plugin",
    "affected_version": "* - 1.58.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.58.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0961",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.0.7 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "6.0.0 - 6.0.7",
    "from_version": "6.0.0",
    "from_inclusive": true,
    "to_version": "6.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1196",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.0.7 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 5.12.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1196",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Database Backup and check Tables Automated With Scheduler 2024 \u003c= 2.36 - Authenticated (Administrator+) Arbitrary File Deletion",
    "slug": "database-backup",
    "type": "plugin",
    "affected_version": "* - 2.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.36",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13910",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tax Rate Upload \u003c= 2.4.5 - Reflected Cross-Site Scripting",
    "slug": "tax-rate-upload",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32546",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Replace \u003c= 1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "easy-replace",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54244",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_size Parameter",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "[*, 3.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24205",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cardoza AJAX Search \u003c 1.3 - Unauthenticated SQL Injection",
    "slug": "cardoza-ajax-search",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-5853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5853",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Theme Demo Import \u003c= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "theme-demo-import",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1538",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Repute ARForms \u003c= 3.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "[*, 3.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-15818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-15818",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Forminator Plugin \u003c= 1.5.4 - Cross-Site Scripting",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-9567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9567",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSV to html \u003c= 3.26 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "csv-to-html",
    "type": "plugin",
    "affected_version": "* - 3.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52406",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Bitly's WordPress Plugin \u003c= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "wp-bitly",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12616",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image and Video Lightbox, Image Popup \u003c= 2.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "lightbox-popup",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24004",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ScanCircle \u003c= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "scancircle",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11439",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPForms Google Sheet Connector \u003c= 3.4.5 - Reflected Cross-Site Scripting",
    "slug": "gsheetconnector-wpforms-pro",
    "type": "plugin",
    "affected_version": "[*, 2.5.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2321",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPForms Google Sheet Connector \u003c= 3.4.5 - Reflected Cross-Site Scripting",
    "slug": "gsheetconnector-wpforms",
    "type": "plugin",
    "affected_version": "* - 3.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2321",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Read and Understood \u003c= 2.1 - Stored Cross-Site Scripting",
    "slug": "read-and-understood",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5667",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Butcher \u003c= 2.40 - Unauthenticated Local File Inclusion",
    "slug": "butcher",
    "type": "theme",
    "affected_version": "* - 2.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.40",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32286",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lead Generated \u003c= 1.23 - Unauthenticated PHP Object Injection",
    "slug": "lead-generated",
    "type": "plugin",
    "affected_version": "* - 1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-28667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28667",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bulk Term Editor \u003c= 1.1.4 - Cross-Site Request Forgery",
    "slug": "bulk-term-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39512",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "azurecurve Toggle Show/Hide \u003c= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "azurecurve-toggle-showhide",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43961",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 5.2.3.0 - Missing Authorization",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49831",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "hostel \u003c= 1.1.5.3 - Cross-Site Request Forgery",
    "slug": "hostel",
    "type": "plugin",
    "affected_version": "* - 1.1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4314",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.2.8 - Information Disclosure",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "[*, 6.2.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6203",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1238",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 4.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30184",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Typography \u003c= 1.1.2 - Missing Authorization",
    "slug": "google-typography",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33942",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Protect Your Content \u003c= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "protect-your-content",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53728",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cookies Alert \u003c= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-cookies-alert",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23821",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fancy Comments WordPress \u003c= 1.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "fancy-facebook-comments",
    "type": "plugin",
    "affected_version": "* - 1.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29804",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gravitate QA Tracker \u003c= 1.2.1 - Object Injection",
    "slug": "gravitate-qa-tracker",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-18605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18605",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Magazine Saga \u003c= 1.2.7 - Unauthenticated Local File Inclusion",
    "slug": "magazine-saga",
    "type": "theme",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53227",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PNG to JPG \u003c= 5.8 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting",
    "slug": "png-to-jpg",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29430",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Drop Shadow Boxes \u003c= 1.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "drop-shadow-boxes",
    "type": "plugin",
    "affected_version": "* - 1.7.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23833",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Product Sync \u003c= 8.6 - Cross-Site Request Forgery",
    "slug": "sync-wc-google",
    "type": "plugin",
    "affected_version": "* - 8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31852",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newspaper - News \u0026 WooCommerce WordPress Theme \u003c= 6.7 - Arbitrary Options Update",
    "slug": "Newspaper",
    "type": "theme",
    "affected_version": "* - 6.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-10972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10972",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Inline SVG \u003c= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "inline-svg-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9064",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Safety Exit \u003c= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "safety-exit",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57980",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Mailer \u003c= 1.2.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "site-mailer",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1319",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blocksy \u003c= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blocksy",
    "type": "theme",
    "affected_version": "* - 2.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1767",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Affiliate Platform \u003c 6.5.1 - Reflected Cross-Site Scripting via Registration Form",
    "slug": "wp-affiliate-platform",
    "type": "plugin",
    "affected_version": "[*, 6.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-5282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5282",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Tables For WPBakery Page Builder (formerly Visual Composer) \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "pricing-tables-for-wpbakery-page-builder",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TCD Google Maps \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "tcd-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5128",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fastly \u003c= 1.2.25 - Missing Authorization",
    "slug": "fastly",
    "type": "plugin",
    "affected_version": "* - 1.2.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34803",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Optimizer, Resizer and CDN – Sirv \u003c= 6.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "* - 6.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4119",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Double the Donation \u003c= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "double-the-donation",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57929",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Gallery with Slideshow \u003c= 1.5.2 - SQL Injection via gallery_name",
    "slug": "image-gallery-with-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002014",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Product Catalog – WordPress Catalog Plugin \u003c= 5.0.25 - Cross-Site Request Forgery",
    "slug": "ultimate-product-catalogue",
    "type": "plugin",
    "affected_version": "[*, 5.0.26)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.26",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24993",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WooCommerce - Social Login \u003c= 2.7.3 - Unauthenticated Authentication Bypass",
    "slug": "woo-social-login",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6635",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Vulnerability: eCommerce Product Catalog plugin for WordPress \u003c= 3.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25049",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enable SVG, WebP \u0026 ICO Upload \u003c= 1.0.2 - Authenticated  (Author+) Stored Cross-Site Scripting",
    "slug": "enable-svg-webp-ico-upload",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-36343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36343",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Product Import Export for WooCommerce \u003c= 1.7.4 - Missing Authorization to CSV Import",
    "slug": "product-import-export-for-woo",
    "type": "plugin",
    "affected_version": "[*, 1.7.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-12074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12074",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Sermons \u003c= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-sermons",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49863",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ClickCease Click Fraud Protection \u003c= 3.2.4 - Improper Authorization to sensitive information exposure via get_settings",
    "slug": "clickcease-click-fraud-protection",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6810",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Complianz - GDPR/CCPA Cookie Consent \u003c= 6.4.4 - Cross-Site Request Forgery via run_sync",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33333",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ai Image Alt Text Generator for WP \u003c= 1.1.1 - Missing Authorization",
    "slug": "ai-image-alt-text-generator-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32217",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation \u003c= 3.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gs-logo-slider",
    "type": "plugin",
    "affected_version": "* - 3.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7716",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Optin Forms \u003c= 1.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "optin-forms",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49841",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Mega Menu Plugin for WordPress – ThemeHunk \u003c= 1.0.9 -  Missing Authorization to Authenticated (Subscriber+) Settings Updates",
    "slug": "themehunk-megamenu-plus",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8434",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Interactive Page Hierarchy \u003c= 1.0.1 - Missing Authorization",
    "slug": "interactive-page-hierarchy",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23615",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Mark Posts \u003c= 2.2.4 - Missing Authorization",
    "slug": "mark-posts",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23963",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AdRotate – Ad manager \u0026 AdSense Ads \u003c= 5.8.22 - Authenticated Stored Cross-Site Scripting via Advert Names",
    "slug": "adrotate",
    "type": "plugin",
    "affected_version": "[*, 5.8.23)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.23",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0662",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.6.25 - Reflected Cross-Site Scripting via 'data'",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37979",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Away \u003c= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read",
    "slug": "file-away",
    "type": "plugin",
    "affected_version": "* - 3.9.9.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2539",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce PDF Invoice Builder \u003c= 1.2.90 - Authenticated (Administrator+) Cross-Site Scripting",
    "slug": "woo-pdf-invoice-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.90",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.90",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4160",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Razorpay Payment Button for Elementor \u003c= 1.2.5 - Reflected Cross-Site Scripting",
    "slug": "razorpay-payment-button-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10850",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maintenance Redirect \u003c= 2.0.1 - IP Spoofing to Maintenance Mode Bypass",
    "slug": "jf3-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45453",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Block IPs for Gravity Forms \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "gf-block-ips",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51358",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JobSearch \u003c= 2.5.4 - Missing Authorization",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43929",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Testimonials Showcase \u003c= 1.1.6 - Cross-Site Request Forgery",
    "slug": "simple-testimonials-showcase",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48283",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Retina 2x \u003c= 5.2.0 - Cross-Site Scripting",
    "slug": "wp-retina-2x",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-0511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0511",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import Social Events \u003c= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "import-facebook-events",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48256",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kognetiks Chatbot for WordPress \u003c= 2.0.0 - Unauthenticated Arbitrary File Upload",
    "slug": "chatbot-chatgpt",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32700",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Pricing Tables For WPBakery Page Builder (formerly Visual Composer) \u003c= 2.0 - Authenticated (Subscriber+) Local File Inclusion via Shortcode",
    "slug": "pricing-tables-for-wpbakery-page-builder",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1274",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Post Layouts for Gutenberg \u003c= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-layouts",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38682",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reveal Listing \u003c= 3.3 - Unauthenticated Privilege Escalation",
    "slug": "reveal-listing",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6994",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Marmoset Viewer \u003c= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "marmoset-viewer",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23767",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBookit \u003c= 1.6.9 - Unauthenticated Arbitrary File Upload",
    "slug": "wpbookit",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-0357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0357",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Feed \u003c= 2.2.1 - Reflected Cross-Site Scripting via pf-gid",
    "slug": "photo-feed",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Delete Post Revision \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "delete-post-revision",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31454",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YouTube Embed \u003c= 10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via instance Parameter",
    "slug": "youram-youtube-embed",
    "type": "plugin",
    "affected_version": "* - 10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6692",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TablePress – Tables in WordPress made easy \u003c= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "tablepress",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2685",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Before After Image Slider WP \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "before-after-image-slider",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24931",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Form Builder \u003c= 5.0.06 - Admin+ Stored Cross-Site Scripting",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "[*, 5.0.07)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.07",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24608",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backuply – Backup, Restore, Migrate and Clone \u003c= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion",
    "slug": "backuply",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10307",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "VG WooCarousel \u003c= 1.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "vg-woocarousel",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32153",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.8.21 - Reflected Cross-Site Scripting via 'image_url'",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29809",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Melhor Envio \u003c= 2.15.11 - Unauthenticated Sensitive Information Exposure via Hardcoded Hash",
    "slug": "melhor-envio-cotacao",
    "type": "plugin",
    "affected_version": "* - 2.15.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13820",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Quick Page/Post Redirect Plugin \u003c= 5.1.9 - Redirect Security Bypass",
    "slug": "quick-pagepost-redirect-plugin",
    "type": "plugin",
    "affected_version": "* - 5.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36699",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EazyDocs \u003c= 2.5.0 - Missing Authorization",
    "slug": "eazydocs",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38721",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Custom Settings \u003c= 1.0 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "custom-settings",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23806",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ECT Product Carousel \u003c= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ect-product-carousel",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54412",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newspaper \u003c= 11.5.1 - Reflected Cross-Site Scripting",
    "slug": "Newspaper",
    "type": "theme",
    "affected_version": "* - 11.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2627",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stratus \u003c= 4.2.5 - Missing Authorization",
    "slug": "stratus",
    "type": "theme",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53341",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Related Videos for JW Player \u003c= 1.2.0 - Reflected Cross-Site Scripting",
    "slug": "related-videos-for-jw-player",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32516",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myCred \u003c= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10187",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Notification \u003c= 1.3 - Missing Authorization",
    "slug": "simple-notification",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54242",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Perfmatters \u003c= 2.1.6 - Cross-Site Request Forgery",
    "slug": "perfmatters",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47875",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PDPA Consent for Thailand \u003c= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pdpa-consent",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50014",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Code Snippets Extension \u003c= 4.0.2 - Missing Authorization to Plugin Settings Change",
    "slug": "mainwp-code-snippets-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23655",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking.com Product Helper \u003c= 1.0.1 - Cross-Site Scripting",
    "slug": "bookingcom-product-helper",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24645",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.1 - Missing Authorization via add_row_actions",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24833",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HTML5 Responsive FAQ \u003c= 2.8.5 - Authenticated Stored Cross-Site Scripting",
    "slug": "html5-responsive-faq",
    "type": "plugin",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24995",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lazy Load for Videos \u003c= 2.18.2 - Cross-Site Request Forgery",
    "slug": "lazy-load-for-videos",
    "type": "plugin",
    "affected_version": "* - 2.18.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45656",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Calendar \u003c= 1.4.6 - Missing Authorization to Event Modification",
    "slug": "calendar-event",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38067",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Squaretype - Modern Blog WordPress Theme \u003c 3.0.4 - Authorization Bypass",
    "slug": "squaretype",
    "type": "theme",
    "affected_version": "[*, 3.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24840",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4001",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Follow Us Badges \u003c= 3.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpsite-follow-us-badges",
    "type": "plugin",
    "affected_version": "* - 3.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31804",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAF \u003c= 4.5.4 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "beaf-before-and-after-gallery",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32433",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FAT Event Lite \u003c= 1.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "fat-event-lite",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23915",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Exchange Addon Membership \u003c 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "exchange-addon-membership",
    "type": "plugin",
    "affected_version": "[*, 1.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9372",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Filr – Secure document library \u003c= 1.2.3.5 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "filr-protection",
    "type": "plugin",
    "affected_version": "[*, 1.2.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-5762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5762",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Unlimited Elements for Elementor \u003c= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6743",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form Manager \u003c= 1.4.3 - Cross-Site Scripting",
    "slug": "contact-form-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-20054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20054",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support \u003c= 6.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5352",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Contact Form Lite \u003c= 1.1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "contact-form-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5730",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Color Your Bar \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "color-your-bar",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47595",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Support Ticket System \u003c= 17.7 - Unauthenticated Arbitrary File Deletion",
    "slug": "woocommerce-support-ticket-system",
    "type": "plugin",
    "affected_version": "* - 17.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10625",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' Shortcode",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.272",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.272",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3340",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Element",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 4.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2733",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Soledad \u003c= 8.4.5 - Missing Authorization",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31368",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wordfence Security – Firewall \u0026 Malware Scan \u003c= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wordfence",
    "type": "plugin",
    "affected_version": "* - 7.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3144",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ketchup Restaurant Reservations \u003c= 1.0.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "ketchup-restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2753",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShiftController Employee Shift Scheduling \u003c= 4.9.23 - Unauthenticated Stored Cross-Site Scripting via 'hc-title'",
    "slug": "shiftcontroller",
    "type": "plugin",
    "affected_version": "* - 4.9.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-29424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29424",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ColorWay \u003c= 4.2.3 - Cross Site Request Forgery",
    "slug": "colorway",
    "type": "theme",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25447",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Carousel-of-post-images \u003c= 1.07 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "carousel-of-post-images",
    "type": "plugin",
    "affected_version": "* - 1.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.07",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46536",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wux Blog Editor \u003c= 3.0.0 - Authentication Bypass to Administrator",
    "slug": "wux-blog-editor",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9931",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 2.0.3 - Denial of Service",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-0194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0194",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Fattura24 \u003c= 6.2.7 - Reflected Cross-Site Scripting via 'id'",
    "slug": "fattura24",
    "type": "plugin",
    "affected_version": "* - 6.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5211",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better WordPress Google XML Sitemaps \u003c= 1.4.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "bwp-google-xml-sitemaps",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0230",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recipe Card Blocks by WPZOOM \u003c= 2.8.0 - Reflected Cross-Site Scripting",
    "slug": "recipe-card-blocks-by-wpzoom",
    "type": "plugin",
    "affected_version": "[*, 2.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24632",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share, Social Login and Social Comments Plugin – Super Socializer \u003c= 7.13.63 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "super-socializer",
    "type": "plugin",
    "affected_version": "* - 7.13.63",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.13.63",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2836",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ketchup Shortcodes \u003c= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ketchup-shortcodes-pack",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13590",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Giveaways and Contests by RafflePress \u003c= 1.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "rafflepress",
    "type": "plugin",
    "affected_version": "* - 1.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0176",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Duplicator \u003c= 1.2.41 - Sensitive Information Disclosure leading to Remote Code Execution",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "* - 1.2.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.40",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-17207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17207",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz Cat \u003c= 3.0.8 - Missing Authorization",
    "slug": "quiz-cat",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30877",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpShopGermany - Protected Shops \u003c= 2.0 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "wpshopgermany-protectedshops",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-39919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39919",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Symbiostock Lite \u003c= 6.0.0 - Authenticated (Shop Manager+) Arbitrary File Upload",
    "slug": "symbiostock",
    "type": "plugin",
    "affected_version": "* - 6.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-49814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49814",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS Pro \u003c= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "tutor-pro",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5784",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
  },
  {
    "title": "LTL Freight Quotes – SAIA Edition \u003c= 2.2.10 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-saia-edition",
    "type": "plugin",
    "affected_version": "* - 2.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13483",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "多说社会化评论框 \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "duoshuo",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49056",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM and Lead Management by vcita \u003c= 2.7.5 - Missing Authorization to Authenticated (Susbcriber+) Widget Toggle",
    "slug": "crm-customer-relationship-management-by-vcita",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13703",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AppExperts \u003c= 1.4.5 - Unauthenticated Sensitive Information Exposure",
    "slug": "appexperts",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53218",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP-BusinessDirectory \u003c= 3.1.2 - Reflected Cross-Site Scripting",
    "slug": "wp-businessdirectory",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32630",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Flashcards \u003c= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "easy-flashcards",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6040",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The7 \u003c= 11.6.0 - Reflected Cross-Site Scripting",
    "slug": "dt-the7",
    "type": "theme",
    "affected_version": "* - 11.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29100",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MDTF – Meta Data and Taxonomies Filter \u003c= 1.3.3.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8624",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Firework Shoppable Live Video \u003c= 6.3 - Reflected Cross-Site Scripting",
    "slug": "firework-videos",
    "type": "plugin",
    "affected_version": "* - 6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51781",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TI WooCommerce Wishlist / TI WooCommerce Wishlist Pro \u003c 1.40.1 - Unauthenticated SQL Injection",
    "slug": "ti-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "[*, 1.40.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.40.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0412",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TI WooCommerce Wishlist / TI WooCommerce Wishlist Pro \u003c 1.40.1 - Unauthenticated SQL Injection",
    "slug": "ti-woocommerce-wishlist-premium",
    "type": "plugin",
    "affected_version": "[*, 1.40.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.40.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0412",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "iThemes Security \u003c= 8.1.4 - Open Redirection via redirect_to_https",
    "slug": "better-wp-security",
    "type": "plugin",
    "affected_version": "* - 8.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28786",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Fast Velocity Minify \u003c= 2.7.6 - Full Path Disclosure",
    "slug": "fast-velocity-minify",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19983",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Snap Pixel \u003c= 1.5.8 - Cross-Site Request Forgery",
    "slug": "snap-pixel",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45642",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BuddyPress Docs \u003c= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Document Read/Update",
    "slug": "buddypress-docs",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5526",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Search by Google \u003c= 1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "search-google",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58832",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Art Theme \u003c= 3.12.2.3 - Missing Authorization to Authenticated (Subscriber+) Theme Option Delete",
    "slug": "art-theme",
    "type": "theme",
    "affected_version": "* - 3.12.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1778",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Plugin Notes Plus \u003c= 1.2.7 - Authenticated (Subscriber+) Arbitrary Note Deletion",
    "slug": "plugin-notes-plus",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43326",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paytium: Mollie payment forms \u0026 donations \u003c= 4.3.7 - Missing Authorization in 'paytium_notice_dismiss'",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7292",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) \u003c= 2.7.13 - Cross-Site Request Forgery",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6984",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking \u0026 Appointment Plugin for WooCommerce \u003c= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option Update",
    "slug": "woocommerce-booking",
    "type": "plugin",
    "affected_version": "* - 6.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10729",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Indeed Job Importer  \u003c= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "indeed-job-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39355",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print, PDF, Email by PrintFriendly \u003c= 5.2.2 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "printfriendly",
    "type": "plugin",
    "affected_version": "[*, 5.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0663",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "140+ Widgets | Best Addons For Elementor – FREE \u003c= 1.4.3 - Authenticated (Admin+) Cross Site Scripting",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34570",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Trinity Audio \u003c= 5.21.0 - Unauthenticated Information Exposure",
    "slug": "trinity-audio",
    "type": "plugin",
    "affected_version": "* - 5.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.21.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9196",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Smart Recent Posts Widget \u003c= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "smart-recent-posts-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33692",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapSVG \u003c= 6.2.19 - SQL Injection",
    "slug": "mapsvg",
    "type": "plugin",
    "affected_version": "[*, 6.2.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.20",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0592",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "SMS Abandoned Cart Recovery ✦ CartBoss \u003c= 4.1.2 - Missing Authorization",
    "slug": "cartboss",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31865",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Salient Core \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "salient-core",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48749",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 4.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3226",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Manager For Enamad \u003c= 0.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "logo-manager-for-enamad",
    "type": "plugin",
    "affected_version": "* - 0.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4757",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quicksand Post Filter jQuery Plugin \u003c= 3.1.1 - Missing Authorization via quicksand_admin_ajax",
    "slug": "quicksand-jquery-post-filter",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-24850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24850",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP eCommerce \u003c 3.8.7.2 - Stored Cross-Site Scripting",
    "slug": "wp-e-commerce",
    "type": "plugin",
    "affected_version": "[*, 3.8.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-5104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5104",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Duplicator \u003c= 1.5.7 - Cross-Site Request Forgery via views/tools/diagnostics/information.php",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51681",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "video carousel slider with lightbox 1.0 - Cross-Site Request Forgery",
    "slug": "wp-responsive-video-gallery-with-lightbox",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5945",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gwolle Guestbook \u003c= 1.5.3 - Remote File Inclusion",
    "slug": "gwolle-gb",
    "type": "plugin",
    "affected_version": "[*, 1.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-8351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-8351",
    "auth_type": "Unauth",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c= 3.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47438",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "postTabs \u003c= 2.10.6 - Cross-Site Request Forgery",
    "slug": "posttabs",
    "type": "plugin",
    "affected_version": "* - 2.10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1781",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40002",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Widget Logic \u003c 5.10.2 - Cross-Site Request Forgery",
    "slug": "widget-logic",
    "type": "plugin",
    "affected_version": "[*, 5.10.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-12826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12826",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1239",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebLibrarian \u003c 3.4.8.5 - Cross-Site Scripting",
    "slug": "weblibrarian",
    "type": "plugin",
    "affected_version": "[*, 3.4.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18538",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Form Builder \u003c 2.05.03 - Unauthenticated Information Disclosure",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "[*, 2.05.03)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.05.03",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-20194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20194",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Fluid Responsive Slideshow \u003c 2.2.7 - Cross-Site Request Forgery",
    "slug": "fluid-responsive-slideshow",
    "type": "plugin",
    "affected_version": "[*, 2.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10974",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Video Gallery \u0026 Management \u003c= 3.3.5 - Cross-Site Request Forgery",
    "slug": "youtube-showcase",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40558",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popping Sidebars and Widgets Light \u003c= 1.27 - Cross-Site Request Forgery",
    "slug": "popping-sidebars-and-widgets-light",
    "type": "plugin",
    "affected_version": "* - 1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58853",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MF Gig Calendar  \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via event_title and event_time",
    "slug": "mf-gig-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37970",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 3.15.1 - Cross-Site Request Forgery",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.15.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47315",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Duplicate Page and Post \u003c= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameter",
    "slug": "duplicate-wp-page-post",
    "type": "plugin",
    "affected_version": "* - 2.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6189",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordSurvey \u003c= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via sounding_title Parameter",
    "slug": "wordsurvey",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6767",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMTP2GO \u003c= 1.12.1 - Missing Authorization",
    "slug": "smtp2go",
    "type": "plugin",
    "affected_version": "* - 1.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54011",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Landing Page Builder \u003c= 1.5.1.8 - Reflected Cross-Site Scripting via pageType",
    "slug": "page-builder-add",
    "type": "plugin",
    "affected_version": "* - 1.5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34752",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks for Gutenberg \u003c= 4.2.0 - Missing Authorization via AJAX actions",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47760",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Quotation \u003c= 1.3.2 - Cross-Site Request Forgery",
    "slug": "simple-quotation",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-22734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-22734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Page Sidebars \u003c= 0.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "unlimited-page-sidebars",
    "type": "plugin",
    "affected_version": "* - 0.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22688",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": ".htaccess Redirect \u003c= 0.3.1 Reflected Cross-Site Scripting",
    "slug": "htaccess-redirect",
    "type": "plugin",
    "affected_version": "* - 0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38361",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Google Sheet Connector \u003c= 1.3.11 - Missing Authorization",
    "slug": "wc-gsheetconnector",
    "type": "plugin",
    "affected_version": "* - 1.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1562",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Highlight \u003c 0.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "highlight",
    "type": "plugin",
    "affected_version": "[*, 0.9.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24591",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ad Inserter \u003c= 2.7.37 - Reflected Cross-Site Scripting",
    "slug": "ad-inserter",
    "type": "plugin",
    "affected_version": "* - 2.7.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49248",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Open RDW kenteken voertuiginformatie \u003c= 2.0.14 - Reflected Cross-Site Scripting via open_data_rdw_kenteken",
    "slug": "open-rdw-kenteken-voertuiginformatie",
    "type": "plugin",
    "affected_version": "* - 2.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47431",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Training – Courses \u003c= 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "training",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50529",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Membership After Login Redirection \u003c= 1.6 - Open Redirect",
    "slug": "simple-membership-after-login-redirection",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47354",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmbedPress \u003c= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1565",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ovic Responsive WPBakery \u003c= 1.2.8 - Authenticated (Subscriber+) Arbitrary Option Update",
    "slug": "ovic-vc-addon",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5235",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NewStatPress \u003c= 0.9.8 - Authenticated SQL Injection",
    "slug": "newstatpress",
    "type": "plugin",
    "affected_version": "* - 0.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-4062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4062",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Attesa Extra \u003c= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "attesa-extra",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32594",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Digital Marketing and Agency Templates Addons for Elementor \u003c= 1.1.1 - Cross-Site Request Forgery to Import",
    "slug": "digital-marketing-agency-templates-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5938",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventPrime \u003c= 3.3.4 - Missing Authorization to Booking Price Maniputlation",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31275",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ApplyOnline \u003c= 2.6.2 - Unauthenticated Application Disclosure",
    "slug": "apply-online",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10098",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "LazyLoad Background Images \u003c= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update",
    "slug": "lazyload-background-images",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12327",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JS Help Desk \u003c= 2.9.2 - Missing Authorization",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30880",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CBX Map for Google Map \u0026 OpenStreetMap \u003c= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cbxgooglemap",
    "type": "plugin",
    "affected_version": "* - 1.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22297",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twitter Card Generator \u003c= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "twitter-card-generator",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46516",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Read More \u0026 Accordion \u003c= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion",
    "slug": "expand-maker",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13639",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wp auto top \u003c= 2.9.3 - Cross-Site Request Forgery",
    "slug": "wp-auto-top",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53716",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hot Random Image \u003c= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter",
    "slug": "hot-random-image",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4405",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Memberful – Membership Plugin \u003c= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting",
    "slug": "memberful-wp",
    "type": "plugin",
    "affected_version": "* - 1.73.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.73.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9242",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Browser Theme Color \u003c= 1.3 - Cross-Site Request Forgery via btc_settings_page",
    "slug": "browser-theme-color",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22291",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Easy Digital Downloads (EDD) Twenty-Twelve \u003c 1.1.1 - Cross-Site Scripting",
    "slug": "twenty-twelve-edd",
    "type": "theme",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9536",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP OAuth Server (OAuth Authentication) \u003c 3.1.5 - Pseudorandom Number Generation",
    "slug": "oauth2-provider",
    "type": "plugin",
    "affected_version": "[*, 3.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9435",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ebook Store \u003c= 5.8014 - Reflected Cross-Site Scripting",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.8014",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8014",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8113",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swape - App Showcase \u0026 App Store WordPress Theme \u003c 1.2.1 - Missing Authorization to Arbitrary Options Update",
    "slug": "swape",
    "type": "theme",
    "affected_version": "[*, 1.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-21013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-21013",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "REAL WordPress Sidebar \u003c= 0.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "drag-and-drop-custom-sidebar",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23535",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Maps by Supsystic \u003c= 1.2.16 - Cross-Site Request Forgery",
    "slug": "ultimate-maps-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31271",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CE21 Suite \u003c= 2.2.0 - Authentication Bypass",
    "slug": "ce21-suite",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10284",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Giveaways \u003c= 2.46.0 - Missing Authorization via AJAX actions",
    "slug": "giveasap",
    "type": "plugin",
    "affected_version": "* - 2.46.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.46.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23893",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.19.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.19.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1784",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Service Payment Form With Authorize.net \u003c= 2.6.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "wp-service-payment-form-with-authorizenet",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23804",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Skaut bazar \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "skaut-bazar",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34643",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cryptocurrency Donation Box – Bitcoin \u0026 Crypto Donations \u003c= 2.2.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "cryptocurrency-donation-box",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32128",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS \u003c 1.5.3 - Cross-Site Request Forgery",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "[*, 1.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-8615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8615",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI Engine \u003c= 2.4.7 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38791",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ultimate CSV Importer \u003c= 6.5.2 - Server-Side Request Forgery",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 6.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1977",
    "auth_type": "Privileged",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "Display Remote Posts Block \u003c= 1.1.0 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "display-remote-posts-block",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47484",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Url \u003c= 1.0.0.3 - Reflected Cross-Site Scripting",
    "slug": "video-sidebar-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3098",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lexicata \u003c= 1.0.16 - Reflected Cross-Site Scripting",
    "slug": "lexicata",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31900",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Applink \u003c= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter",
    "slug": "wp-applink",
    "type": "plugin",
    "affected_version": "* - 0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6385",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SH Email Alert \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "sh-email-alert",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2165",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Designer \u003c= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion",
    "slug": "product-designer",
    "type": "plugin",
    "affected_version": "* - 1.0.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3608",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Phee's LinkPreview \u003c= 1.6.7 - Cross-Site Request Forgery",
    "slug": "linkpreview",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27344",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Geo Mashup - \u003c 1.10.4 - Cross-Site Scripting",
    "slug": "geo-mashup",
    "type": "plugin",
    "affected_version": "[*, 1.10.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-14071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14071",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "core plugin for kitestudio themes \u003c= 2.2.1 - Reflected Cross-Site Scripting",
    "slug": "kitestudio-core",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1951",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AppPresser \u003c= 4.3.0 - Missing Authorization",
    "slug": "apppresser",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32776",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by tychesoftwares \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "arconix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4233",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by tychesoftwares \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "arconix-faq",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4233",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by tychesoftwares \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "woocommerce-delivery-notes",
    "type": "plugin",
    "affected_version": "* - 4.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4233",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Scroll Triggered Box \u003c= 2.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "dreamgrow-scroll-triggered-box",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24865",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bidorbuy Store Integrator \u003c= 2.12.0 - Authenticated (Admin+) Remote Code Execution",
    "slug": "bidorbuystoreintegrator",
    "type": "plugin",
    "affected_version": "* - 2.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48100",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OpenCart Product Display \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "opencart-product-display",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51835",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.59 - Insufficient Access Control to Plugin Activation",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4701",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flixita \u003c= 1.0.82 - Reflected Cross-Site Scripting via id Parameter",
    "slug": "flixita",
    "type": "theme",
    "affected_version": "* - 1.0.82",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.82",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10836",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MAZ Loader – Preloader Builder for WordPress \u003c= 1.4.0 - Cross-Site Request Forgery",
    "slug": "maz-loader",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24668",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Invoice Payment for WooCommerce \u003c= 1.7.2 - Reflected Cross-Site Scripting",
    "slug": "invoice-payment-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54328",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more \u003c= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gs-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11765",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Post Widget \u003c= 1.9.1 - Multiple Cross-Site Scripting",
    "slug": "quick-post-widget",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-4226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4226",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Data Tables Generator by Supsystic \u003c= 1.10.25 - Missing Authorization",
    "slug": "data-tables-generator-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.10.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25043",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Piotnet Forms \u003c= 1.0.30 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "piotnetforms",
    "type": "plugin",
    "affected_version": "* - 1.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31793",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Review Plugin: The Ultimate Solution for Building a Review Website \u003c= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom Fields",
    "slug": "wp-review",
    "type": "plugin",
    "affected_version": "* - 5.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2158",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JivoChat Live Chat – WP live chat plugin for WordPress \u003c= 1.3.5.3 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "jivochat",
    "type": "plugin",
    "affected_version": "* - 1.3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0642",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Query Creator \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-query-creator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22264",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Serious Slider \u003c= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "cryout-serious-slider",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35762",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter \u003c= 6.8.1 - Authenticated PHP Object Injection",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "[*, 6.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-35932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35932",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All Bootstrap Blocks \u003c= 1.3.19 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "all-bootstrap-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-53824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53824",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spreadr Woocommerce \u003c= 1.0.4 - Missing Authorization",
    "slug": "spreadr-for-woocomerce",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56009",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Essay Wizard (wpCRES) \u003c= 1.0.6.4 - Reflected Cross-Site Scripting",
    "slug": "essay-wizard-wpcres",
    "type": "plugin",
    "affected_version": "* - 1.0.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23468",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.6.0 - Cross-Site Request Forgery to Form Duplication",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31216",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RealtyCandy IDX Broker Extended \u003c= 1.5.1 - Cross-Site Request Forgery",
    "slug": "realtycandy-idx-broker-extended",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53726",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Profile Builder \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-8492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8492",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YOP Poll \u003c= 6.2.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "yop-poll",
    "type": "plugin",
    "affected_version": "* - 6.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24454",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar \u003c= 5.9.4 - Missing Authorization",
    "slug": "mp3-music-player-by-sonaar",
    "type": "plugin",
    "affected_version": "* - 5.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32235",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Youtube SpeedLoad \u003c= 0.6.3 - Cross-Site Request Forgery",
    "slug": "youtube-speedload",
    "type": "plugin",
    "affected_version": "* - 0.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47688",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps \u0026 Any Documents in Gutenberg \u0026 Elementor \u003c= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "[*, 3.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6986",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Plus \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "google-plus-google",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23964",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export Users With Meta \u003c 0.6.5 - Authenticated (Admin+) SQL Injection",
    "slug": "user-export-with-their-meta-data",
    "type": "plugin",
    "affected_version": "[*, 0.6.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24451",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stacks Mobile App Builder \u003c= 5.2.3 - Unauthenticated Sensitive Information Disclosure",
    "slug": "stacks-mobile-app-builder",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50528",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Newsletter \u003c= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "* - 8.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5317",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.1.5 - Reflected Cross-Site Scripting",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "[*, 4.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0271",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clearbit Reveal \u003c= 1.0.6 - Cross-Site Request Forgery",
    "slug": "clearbit",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31785",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "uTubeVideo Gallery \u003c= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "utubevideo-gallery",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0151",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nextend Twitter Connect \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "nextend-twitter-connect",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-4557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4557",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapPress Maps for WordPress \u003c= 2.92.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.92.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.92.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8620",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Simple eCommerce for Selling Digital Files \u003c= 3.3.3 - Authenticated (Admin+) PHAR Deserialization",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2439",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Classic Addons – WPBakery Page Builder \u003c= 3.0 - Authenticated (Contributor+) Limited Local PHP File Inclusion",
    "slug": "classic-addons-wpbakery-page-builder-addons",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11952",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Click Info \u003c= 2.7.4 - Reflected Cross-Site Scripting",
    "slug": "wp-click-info",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1401",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2009",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google for WooCommerce \u003c= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File",
    "slug": "google-listings-and-ads",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10486",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8289",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Calendarista Basic Edition \u003c= 3.0.2 - Unauthenticated Cross-Site Scripting",
    "slug": "calendarista-basic-edition",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27993",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Maintenance Mode \u0026 Site Under Construction \u003c= 4.3 - Cross-Site Request Forgery",
    "slug": "wp-maintenance-mode-site-under-construction",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49284",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "News Ticker for Elementor \u003c= 2.1.3 - Missing Authorization",
    "slug": "news-ticker-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54278",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Rocket – Social Sharing Plugin \u003c 1.2.10 - Cross-Site Request Forgery",
    "slug": "social-rocket",
    "type": "plugin",
    "affected_version": "[*, 1.2.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5611",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.319 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.319",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.319",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32185",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Consulting Elementor Widgets \u003c= 1.3.0 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "consulting-elementor-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37091",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SurveyJS \u003c= 1.12.20 - Missing Authorization",
    "slug": "surveyjs",
    "type": "plugin",
    "affected_version": "* - 1.12.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32256",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OSM – OpenStreetMap \u003c= 6.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "osm",
    "type": "plugin",
    "affected_version": "* - 6.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52355",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MelaPress Login Security \u003c= 2.1.0 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "melapress-login-security",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39565",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Chat by Chatwee \u003c= 2.1.3 - Missing Authorization",
    "slug": "chatwee",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31596",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lightweight and Responsive Youtube Embed \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lightweight-and-responsive-youtube-embed",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31743",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Listings \u003c= 2.6.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "auto-listings",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24713",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vchasno Kasa \u003c= 1.0.3 - Missing Authorization to Unauthenticated Invoice Generation",
    "slug": "mrkv-vchasno-kasa",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6721",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.1 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2440",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gianism \u003c= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gianism",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3921",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks – Page Builder Gutenberg Blocks, Patterns \u0026 Templates \u003c= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2255",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StreamCast – Radio Player for WordPress \u003c= 2.1.0 - Cross-Site Scripting",
    "slug": "streamcast",
    "type": "plugin",
    "affected_version": "[*, 2.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24416",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ovatheme Events Manager \u003c= 1.8.5 - Unauthenticated Arbitrary File Upload",
    "slug": "ova-events-manager",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6553",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contextual Related Posts \u003c 1.8.10.2 - SQL Injection",
    "slug": "contextual-related-posts",
    "type": "plugin",
    "affected_version": "[*, 1.8.10.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.10.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-3937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3937",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IDer Login for WordPress \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ider-login",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11888",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CareerUp \u003c 2.3.1 - Reflected Cross-Site Scripting",
    "slug": "careerup",
    "type": "theme",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1167",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Funnelforms Free \u003c= 3.4 - Missing Authorization to Category Deletion",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5416",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ORDER POST \u003c= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "order-post",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2805",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Accordions – Multiple Accordions or FAQs Builder \u003c= 2.0.3 - Authenticated Arbitrary Options Update",
    "slug": "accordions-or-faqs",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38104",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Solidres \u003c= 0.9.4 - Reflected Cross-Site Scripting",
    "slug": "solidres",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13329",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.253",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.253",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1362",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress InviteBox Plugin \u003c= 1.4.1 - Reflected Cross-Site Scripting",
    "slug": "refer-a-friend-widget-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38359",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sermon Browser \u003c= 0.45.22 - Cross-Site Request Forgery",
    "slug": "sermon-browser",
    "type": "plugin",
    "affected_version": "* - 0.45.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.45.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0499",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PublishPress Authors \u003c= 4.7.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "publishpress-authors",
    "type": "plugin",
    "affected_version": "* - 4.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26886",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Product Table For WooCommerce \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "product-table-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22638",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 2.8.3 - Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-7109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7109",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Poll Maker – Best WordPress Poll Plugin \u003c= 5.1.8 -  Missing Authorization to Unauthenticated Email Enumeration",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3601",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CodeablePress \u003c= 1.0.0 - Missing Authorization",
    "slug": "codeablepress-simple-frontend-profile-picture-upload",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53221",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zielke Design Project Gallery \u003c= 2.5.0 - Reflected Cross-Site Scripting",
    "slug": "zielke-design-project-gallery",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23705",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thumbnail carousel slider \u003c= 1.1.9 - Reflected Cross-Site Scripting",
    "slug": "wp-responsive-thumbnail-slider",
    "type": "plugin",
    "affected_version": "[*, 1.1.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-1915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1915",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.14 - Cross-Site Request in Several AJAX Actions",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8120",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Shield Security – Smart Bot Blocking \u0026 Intrusion Prevention Security \u003c= 18.5.9 - Unauthenticated Local File Inclusion",
    "slug": "wp-simple-firewall",
    "type": "plugin",
    "affected_version": "* - 18.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.5.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6989",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FunnelCockpit \u003c= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "funnelcockpit",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32132",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Urvanov Syntax Highlighter \u003c= 2.8.33 - Cross-Site Request Forgery via init_ajax",
    "slug": "urvanov-syntax-highlighter",
    "type": "plugin",
    "affected_version": "* - 2.8.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45106",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Multiple Page Generator Plugin – MPG \u003c= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-10672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10672",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Category Specific RSS feed Subscription \u003c= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "category-specific-rss-feed-menu",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22685",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GC Social wall \u003c= 1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gc-social-wall",
    "type": "plugin",
    "affected_version": "* - 1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5564",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-ShowHide \u003c= 1.04 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-showhide",
    "type": "plugin",
    "affected_version": "* - 1.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4825",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "planetcalc \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via language Parameter",
    "slug": "planetcalc",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKT Skill Bar \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-skill-bar",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47482",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fast Video and Image Display \u003c= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fast-video-and-image-display",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51935",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "random-image-gallery-with-pretty-photo-zoom",
    "type": "plugin",
    "affected_version": "[*, 7.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "mytreasures",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "wp-business-directory",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "[*, 1.4.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "s2member-secure-file-browser",
    "type": "plugin",
    "affected_version": "[*, 0.4.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "tallykit",
    "type": "plugin",
    "affected_version": "[*, 5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "wp-video-lightbox",
    "type": "plugin",
    "affected_version": "[*, 1.7.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "alpine-photo-tile-for-instagram",
    "type": "plugin",
    "affected_version": "[*, 1.2.7.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "ehive-account-details",
    "type": "plugin",
    "affected_version": "[*, 2.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "wp-easy-gallery",
    "type": "plugin",
    "affected_version": "[*, 4.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "fancyflickr",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "gallery-bank",
    "type": "plugin",
    "affected_version": "[*, 3.0.229)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.229",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "reflex-gallery",
    "type": "plugin",
    "affected_version": "[*, 3.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "matrix-image-gallery",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "izeechat",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "dp-maintenance-mode-lite",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "wp-portfolio-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "ticket-manager",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "lb-tube-video",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "ehive-object-details",
    "type": "plugin",
    "affected_version": "[*, 2.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "onclick-show-popup",
    "type": "plugin",
    "affected_version": "[*, 6.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "jcwp-youtube-channel-embed",
    "type": "plugin",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "foxyshop",
    "type": "plugin",
    "affected_version": "[*, 4.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "contact-bank",
    "type": "plugin",
    "affected_version": "[*, 2.0.227)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.227",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "image-slider-widget",
    "type": "plugin",
    "affected_version": "[*, 1.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "images-lazyload-and-slideshow",
    "type": "plugin",
    "affected_version": "[*, 3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "wppizza",
    "type": "plugin",
    "affected_version": "[*, 2.11.8.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.8.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "responsive-category-slider",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "myblogu",
    "type": "plugin",
    "affected_version": "[*, 0.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "trexanh-property",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "embedplus-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "webrotate-360-product-viewer",
    "type": "plugin",
    "affected_version": "[*, 2.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "wp-instagram-bank",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PrettyPhoto Library (Multiple Plugins and Themes) \u003c= 3.1.4 - DOM Cross-Site Scripting",
    "slug": "mklasens-photobox",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager Pro – extended \u003c= 0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "events-manager-pro-extended",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50532",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced AJAX Product Filters \u003c= 1.6.8.1 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-ajax-filters",
    "type": "plugin",
    "affected_version": "* - 1.6.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Matomo Extension \u003c= 4.0.4 - Cross-Site Request Forgery",
    "slug": "mainwp-piwik-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23659",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Google Doc Embedder \u003c= 2.5.18 - Cross-Site Scripting",
    "slug": "google-document-embedder",
    "type": "plugin",
    "affected_version": "[*, 2.5.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-1879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1879",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EU Cookie Law \u003c= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "eu-cookie-law",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3811",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ledenbeheer \u003c= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ledenbeheer-external-connection",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56224",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FileBird Document Library \u003c= 2.0.6 - Unauthenticated Sensitive Information Exposure",
    "slug": "filebird-document-library",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FoxyPress \u003c= 0.4.2.1 - Arbitrary File Upload",
    "slug": "foxypress",
    "type": "plugin",
    "affected_version": "[*, 0.4.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.2.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-10020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10020",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Espresso 4 Decaf \u003c= 4.10.44.decaf - Feature Bypass",
    "slug": "event-espresso-decaf",
    "type": "plugin",
    "affected_version": "* - 4.10.44.decaf",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.44.decaf",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27437",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Buy one click WooCommerce \u003c= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Export",
    "slug": "buy-one-click-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10852",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce PDF Invoice Builder \u003c= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation",
    "slug": "woo-pdf-invoice-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.90",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.90",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4161",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hide My WP Ghost – Security Plugin \u003c= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass",
    "slug": "hide-my-wp",
    "type": "plugin",
    "affected_version": "* - 5.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4537",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Popup Maker \u003c= 1.17.1 - Sensitive Data Exposure via debug log file",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.17.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47597",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Magic Edge – Lite \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter",
    "slug": "magic-edge-lite-image-background-remover",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8391",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Greenshift \u003c= 12.1.1 - Missing Authorization",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 12.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57884",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ARPrice \u003c= 4.0.3 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "arprice",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49699",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WatchTowerHQ \u003c= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check",
    "slug": "watchtowerhq",
    "type": "plugin",
    "affected_version": "* - 3.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9933",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Educare – Students \u0026 Result Management System \u003c= 1.4.3 - Cross-Site Request Forgery",
    "slug": "educare",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25971",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Buk for WordPress \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "buk-appointments",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11869",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radius Blocks \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via subHeadingTagName Parameter",
    "slug": "radius-blocks",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5844",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Admin Search \u003c= 1.1.2 - Cross-Site Scripting",
    "slug": "advanced-admin-search",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0626",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Media \u003c= 1.4.2 - Missing Authorization via generate_link_for_media",
    "slug": "download-media",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27190",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Authentication and xmlrpc log writer \u003c= 1.2.2 - Reflected Cross-Site Scripting",
    "slug": "authentication-and-xmlrpc-log-writer",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49037",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sayfa Sayaç \u003c= 2.6 - Unauthenticated PHP Object Injection",
    "slug": "sayfa-sayac",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-49778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49778",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Page Builder \u003c= 1.2.6 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wp-pagebuilder",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40963",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Featured Entries \u003c= 1.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-featured-entries",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30569",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Years Since – Timeless \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "years-since",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12460",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "mLanguage \u003c= 1.6.1 - Cross-Site Request Forgery",
    "slug": "mlanguage",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39430",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Listing, Classified Ads \u0026 Business Directory – uListing \u003c= 2.0.5 - Cross-Site Request Forgery",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36877",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms \u003c= 1.1.6 - Reflected Cross-Site Scripting",
    "slug": "cf7-dynamics-crm",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24708",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IMS Countdown \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ims-countdown",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11755",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.4.2 - Authenticated (GiveWP Manager+) PHP Object Injection",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-30229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30229",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Feed Comments Number \u003c= 0.2.1 - Unauthenticated Arbitrary File Upload",
    "slug": "feed-comments-number",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49216",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.13 - Missing Authorization to Settings Update in optimizeAllOn",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1089",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Feed for Google, Facebook, eBay and Many More \u003c= 3.1.14 - Reflected Cross-Site Scripting",
    "slug": "webappick-product-feed-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-1010124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1010124",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BBS e-Popup \u003c= 2.4.5 - Reflected Cross-Site Scripting",
    "slug": "bbs-e-popup",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34174",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MAS Elementor \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mas-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49233",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infusionsoft Gravity Forms Add-on 1.5.3 - 1.5.10 - Arbitrary File Upload",
    "slug": "infusionsoft",
    "type": "plugin",
    "affected_version": "1.5.3 - 1.5.10",
    "from_version": "1.5.3",
    "from_inclusive": true,
    "to_version": "1.5.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-6446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6446",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPS Hide Login \u003c= 1.9.0 - Hidden Login Page Location Disclosure",
    "slug": "wps-hide-login",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24917",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 2.3.3 - Unauthenticated Arbitrary Nonce Generation",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "[*, 2.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24278",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.24.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2847",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple Galleries \u003c= 1.34 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "wp-simple-galleries",
    "type": "plugin",
    "affected_version": "* - 1.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5583",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Revive Old Posts \u003c= 9.0.10 - Authenticated (Admin+) PHP Object Injection",
    "slug": "tweet-old-post",
    "type": "plugin",
    "affected_version": "* - 9.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4680",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP 404 Auto Redirect to Similar Post \u003c= 1.0.3 - Reflected Cross-Site Scripting via request",
    "slug": "wp-404-auto-redirect-to-similar-post",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0509",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Backup \u0026 Migration \u003c= 1.4.3 - Missing Authorization to Settings Update",
    "slug": "wp-migration-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5737",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Neuvoo Jobroll \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "neuvoo-jobroll",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9403",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cloudy \u003c= 4.4.9 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-cloudy",
    "type": "plugin",
    "affected_version": "* - 4.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24864",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfileGrid  \u003c= 5.7.1 - Cross-Site Request Forgery",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47644",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ovatheme Events \u003c= 1.2.8 - Unauthenticated Local File Inclusion",
    "slug": "ova-events",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53576",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Attributes for Blocks \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributesForBlocks Parameter",
    "slug": "attributes-for-blocks",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8318",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder – User Profile \u0026 User Registration Forms \u003c= 3.9.0 - Sensitive Information Disclosure via Shortcode",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0814",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Novelist \u003c= 1.2.2 - Cross-Site Request Forgery",
    "slug": "novelist",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32093",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Youzify – BuddyPress Community, User Profile, Social Network \u0026 Membership Plugin for WordPress By KaineLabs \u003c= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12113",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy restaurant menu manager \u003c= 2.0.2 - Cross-Site Request Forgery to Menu Upload",
    "slug": "easy-pdf-restaurant-menu-upload",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8491",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Everest Forms \u003c= 3.1.1 - Reflected Cross-Site Scripting",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3421",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Testimonials \u003c= 4.0.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "super-testimonial",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13704",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification \u003c= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8658",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Breezing Forms \u003c= 1.2.8.11 - Reflected Cross-Site Scripting",
    "slug": "breezing-forms",
    "type": "plugin",
    "affected_version": "* - 1.2.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30520",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.92",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5266",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infugrator \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "infugrator",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23735",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez Login Register \u003c= 2.6.3 - Privilege Escalation",
    "slug": "houzez-login-register",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-26009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26009",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Print \u003c= 2.51 - Cross-Site Request Forgery",
    "slug": "wp-print",
    "type": "plugin",
    "affected_version": "[*, 2.52)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.52",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-2693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2693",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Slicko \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slicko-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51591",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Skype Legacy Buttons \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "skype-online-status",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5615",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Job Board \u003c= 2.9.4 Authenticated Stored Cross-Site Scripting",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39328",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EnvíaloSimple: Email Marketing y Newsletters \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "envialosimple-email-marketing-y-newsletters-gratis",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32587",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Last Modified Info \u003c= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info Shortcode",
    "slug": "wp-last-modified-info",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6864",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Organic Beauty \u003c= 1.4.6 - Unauthenticated PHP Object Injection",
    "slug": "organic-beauty",
    "type": "theme",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49890",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder \u0026 More \u003c= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "popup-maker-wp",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34770",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Review Slider \u003c= 13.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-google-places-review-slider",
    "type": "plugin",
    "affected_version": "* - 13.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2310",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 4.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1160",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Caxton – Create Pro page layouts in Gutenberg \u003c= 1.30.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "caxton",
    "type": "plugin",
    "affected_version": "* - 1.30.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37948",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Info \u003c= 1.1 - Authenticated (Editor+) Information Exposure",
    "slug": "site-info-dashboard-widget",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-58866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58866",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ShopLentor \u003c= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58990",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dragfy Addons for Elementor \u003c= 1.0.2 - Missing Authorization via save_settings",
    "slug": "dragfy-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47661",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Infinite \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via project_url Parameter",
    "slug": "infinite",
    "type": "theme",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5796",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Events \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "ultimate-events",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23610",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Causes – Donation Plugin \u003c= 1.0.01 - Reflected Cross-Site Scripting",
    "slug": "causes",
    "type": "plugin",
    "affected_version": "* - 1.0.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23621",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Launcher \u003c= 0.9.4 - Reflected Cross-Site Scripting",
    "slug": "site-launcher",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23847",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster (\u003c= 5.6.6) and Booster Plus (\u003c= 5.6.4) for WooCommerce - Authenticated (Shop Manager+) Information Exposure via Arbitrary File Download",
    "slug": "booster-plus-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3762",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Booster (\u003c= 5.6.6) and Booster Plus (\u003c= 5.6.4) for WooCommerce - Authenticated (Shop Manager+) Information Exposure via Arbitrary File Download",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 5.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3762",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Deny All Firewall \u003c= 1.1.6 - Cross-Site Request Forgery",
    "slug": "deny-all-firewall",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-14681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14681",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TK Google Fonts GDPR Compliant \u003c= 2.2.11 - Missing Authorization to Font Deletion",
    "slug": "tk-google-fonts",
    "type": "plugin",
    "affected_version": "* - 2.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5823",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Post Search \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "advanced-post-search",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30548",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WappPress \u003c= 6.0.4 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "wapppress-builds-android-app-for-website",
    "type": "plugin",
    "affected_version": "* - 6.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38758",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 21.3.5 - Reflected Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 21.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30428",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon Countdown \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "coming-soon-countdown",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32578",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Markdown on Save Improved \u003c= 2.5 - Stored Cross-Site Scripting",
    "slug": "markdown-on-save-improved",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9337",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Big Boom Directory \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "big-boom-directory",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13673",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Docs \u003c= 1.9.8 - Cross-Site Request Forgery to folder management",
    "slug": "wp-docs",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30873",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Posts Order \u003c= 4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "custom-posts-order",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32645",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Comment \u003c= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "customcomment",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48365",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Folders \u003c= 8.2.3 - Missing Authorization on Various Functions",
    "slug": "media-library-plus",
    "type": "plugin",
    "affected_version": "* - 8.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7858",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Social Login and Register \u003c=7.5.12 - Missing Authorization to Plugin Settings Update",
    "slug": "miniorange-login-openid",
    "type": "plugin",
    "affected_version": "7.5.12",
    "from_version": "7.5.12",
    "from_inclusive": true,
    "to_version": "7.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24375",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "ImagePress – Image Gallery \u003c= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "image-gallery",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9778",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Share VOD \u003c= 2.7.9 - Reflected Cross-Site Scripting",
    "slug": "video-share-vod",
    "type": "plugin",
    "affected_version": "* - 2.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26583",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tydskrif \u003c= 1.1.3 - Reflected Cross-Site Scripting",
    "slug": "tydskrif",
    "type": "theme",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54257",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Loginizer 1.3.8-1.3.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "loginizer",
    "type": "plugin",
    "affected_version": "1.3.8 - 1.3.9",
    "from_version": "1.3.8",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-11366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11366",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Membership \u003c= 1.2.3 - Cross-Site Scripting",
    "slug": "wp-membership",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-4039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Doc Embedder \u003c= 2.6.1 - Cross-Site Scripting",
    "slug": "google-document-embedder",
    "type": "plugin",
    "affected_version": "[*, 2.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10881",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SMS \u003c= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting",
    "slug": "wp-sms",
    "type": "plugin",
    "affected_version": "* - 6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6981",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Registrations for The Events Calendar \u003c= 2.7.4 - Reflected Cross-Site Scripting",
    "slug": "registrations-for-the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24876",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Verge3D \u003c= 4.9.0 - Cross-Site Request Forgery",
    "slug": "verge3d",
    "type": "plugin",
    "affected_version": "* - 4.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39443",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Popular Elementor Templates and Widgets \u003c= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8451",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Streams \u003c= 1.2.1 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "social-streams",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7722",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JetTabs \u003c= 2.2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-tabs",
    "type": "plugin",
    "affected_version": "* - 2.2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54687",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ELEX WooCommerce Google Shopping (Google Product Feed) \u003c= 1.4.3 - Authenticated (Admin+) SQL Inejction",
    "slug": "elex-woocommerce-google-product-feed-plugin-basic",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10046",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "RSS Aggregator by Feedzy \u003c= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication",
    "slug": "feedzy-rss-feeds",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1318",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Gutenverse \u003c= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutenverse",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38785",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.18",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.8",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.7",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.6",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.3",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.18",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.16",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.15",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.15",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.12",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Request Forgery via Press This",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.2",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6819",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BlogBuzzTime-for-wp \u003c= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "blogbuzztime-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2078",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Youzify \u003c= 1.2.2 - Insecure Direct Object Reference",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47191",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "MainWP Dashboard \u003c= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk",
    "slug": "mainwp",
    "type": "plugin",
    "affected_version": "* - 4.6.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1642",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Brozzme Scroll Top \u003c= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "brozzme-scroll-top",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34426",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ultimate Exporter \u003c= 2.9 - Authenticated (Admin+) Arbitrary File Read",
    "slug": "wp-ultimate-exporter",
    "type": "plugin",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24611",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Pz-LinkCard \u003c= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pz-linkcard",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0673",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Menu \u003c= 4.0.3 - Cross-Site Request Forgery to Setting Modification",
    "slug": "responsive-menu",
    "type": "plugin",
    "affected_version": "[*, 4.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24162",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Counter Box \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "counter-box",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2245",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Anthologize \u003c= 0.8.3 - Cross-Site Request Forgery",
    "slug": "anthologize",
    "type": "plugin",
    "affected_version": "* - 0.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39437",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.7.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10587",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ReCaptcha Integration for WordPress \u003c= 1.2.5 - Reflected Cross-Site Scripting",
    "slug": "wp-recaptcha-integration",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8739",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.3.4 - Unauthenticated Sensitive Information Exposure",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43289",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce Follow-Up Emails \u003c= 4.9.40 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-follow-up-emails",
    "type": "plugin",
    "affected_version": "* - 4.9.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33319",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Egg \u003c= 7.0.0 - Authenticated (Editor+) PHP Object Injection",
    "slug": "content-egg",
    "type": "plugin",
    "affected_version": "* - 7.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47536",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) \u003c= 1.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "azon-addon-js-composer",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30628",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Customers Manager \u003c= 29.7 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-customers-manager",
    "type": "plugin",
    "affected_version": "* - 29.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "29.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1743",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Slider \u003c= 3.10.7 - Missing Authorization",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.10.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39412",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "E2Pdf \u003c= 1.20.23 - Authenticated(Administrator+) SQL Injection",
    "slug": "e2pdf",
    "type": "plugin",
    "affected_version": "[*, 1.20.24)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.24",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50849",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CAMOO SMS \u003c= 3.0.1 - Reflected Cross-Site Scripting",
    "slug": "camoo-sms",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23607",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS Aggregator by Feedzy \u003c= 3.4.2 - Cross-Site Request Forgery Bypass",
    "slug": "feedzy-rss-feeds",
    "type": "plugin",
    "affected_version": "[*, 3.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36758",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rearrange Woocommerce Products \u003c= 3.0.7 - Subscriber+ SQL Injection",
    "slug": "rearrange-woocommerce-products",
    "type": "plugin",
    "affected_version": "[*, 3.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24928",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Find Me On \u003c= 2.0.9.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "find-me-on",
    "type": "plugin",
    "affected_version": "* - 2.0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10635",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JetEngine \u003c= 3.2.4 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "jet-engine",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48757",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Accordions – Multiple Accordions or FAQs Builder \u003c= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'layouts' parameter",
    "slug": "accordions-or-faqs",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45082",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Display Widgets \u003c= 2.03 - Authenticated Cross-Site Scripting",
    "slug": "display-widgets",
    "type": "plugin",
    "affected_version": "* - 2.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9438",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Countdown Timer for Elementor \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "countdown-timer-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53743",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Post Hide \u003c= 1.0.9 - Cross-Site Request Forgery",
    "slug": "wp-post-hide",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54042",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PowerPress \u003c= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1917",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Super Testimonials \u003c= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "super-testimonial",
    "type": "plugin",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5613",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metricool \u003c= 1.17 - Authenticated (Administrator+) Stored Stored Cross-Site Scripting",
    "slug": "metricool",
    "type": "plugin",
    "affected_version": "* - 1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4299",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exchange Addon Invoices \u003c 1.4.0 - Reflected Cross-Site Scripting",
    "slug": "exchange-addon-invoices",
    "type": "plugin",
    "affected_version": "[*, 1.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9370",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "beyot-framework",
    "type": "plugin",
    "affected_version": "* - 6.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13418",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "benaa-framework",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13418",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "g5plus-auteur",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13418",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "april-framework",
    "type": "plugin",
    "affected_version": "* - 5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13418",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider \u003c= 1.6.4 - Unauthenticated PHP Object Injection",
    "slug": "ultimate-store-kit",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5335",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "File Manager \u003c= 2.9 - Reflected Cross-Site Scripting",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-16363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16363",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PixelBeds Channel Manager and Hotel Booking Engine \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "pixelbeds-channel-manager-booking-engine",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49965",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Interactive Medical Drawing of Human Body \u003c 2.4 - Admin+ Stored Cross-Site Scripting",
    "slug": "interactive-medical-drawing-of-human-body",
    "type": "plugin",
    "affected_version": "[*, 2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0388",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FileBird \u003c= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder Import",
    "slug": "filebird",
    "type": "plugin",
    "affected_version": "* - 5.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0691",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.21",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.8",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.24",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.17",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.16",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.11",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.7",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.27",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.25",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.24",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.27",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.15",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.12",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 -  Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20147",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "GD Rating System \u003c= 2.3 - Cross-Site Scripting",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5286",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kintpv Wooconnect \u003c= 8.129 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "kintpv-connect",
    "type": "plugin",
    "affected_version": "* - 8.129",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.129",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56233",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishlist \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "wishlist",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31061",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CK and SyntaxHighlighter \u003c= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ck-and-syntaxhighlighter",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54407",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Plugins and Themes from Dashboard \u003c= 1.5.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "download-plugins-dashboard",
    "type": "plugin",
    "affected_version": "[*, 1.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17239",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HelpGent \u003c= 2.2.4 - Unauthenticated PHP Object Injection",
    "slug": "helpgent",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32658",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Online Booking and Scheduling Plugin – Bookly \u003c= 14.5 - Cross-Site Scripting",
    "slug": "bookly-responsive-appointment-booking-tool",
    "type": "plugin",
    "affected_version": "* - 14.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-6891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6891",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SchedulePress \u003c= 5.0.8 - Missing Authorization",
    "slug": "wp-scheduled-posts",
    "type": "plugin",
    "affected_version": "* - 5.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32717",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Apply with LinkedIn buttons \u003c= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "apply-with-linkedin-buttons",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23898",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobWP \u003c= 2.3.9 - Cross-Site Request Forgery",
    "slug": "jobwp",
    "type": "plugin",
    "affected_version": "* - 2.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32265",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Conversational Forms for ChatBot \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "conversational-forms",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22813",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Buying Buddy IDX CRM \u003c= 1.2.8 - Cross-Site Request Forgery to PHP Object Injection",
    "slug": "buying-buddy-idx-crm",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52446",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ShortPixel Adaptive Images \u003c= 3.6.1 - Reflected Cross-Site Scripting",
    "slug": "shortpixel-adaptive-images",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega \u003c= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12597",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Entries \u003c= 1.1.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contact-form-entries",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25080",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Maker \u003c= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.20.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4205",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Verbosa \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "verbosa",
    "type": "theme",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44050",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP PT-Viewer \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "wp-ptviewer",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23438",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Blog Post Block \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-blog-post-block",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54287",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arconix FAQ \u003c= 1.9.6 - Missing Authorization",
    "slug": "arconix-faq",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49874",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Social Feed \u003c= 6.2.6 - Reflected Cross-Site Scripting",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 6.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25120",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Feed \u003c= 6.2.6 - Reflected Cross-Site Scripting",
    "slug": "easy-facebook-likebox-premium",
    "type": "plugin",
    "affected_version": "* - 6.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25120",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widgetize Pages Light \u003c= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "widgetize-pages-light",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58805",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cities Shipping Zones for WooCommerce \u003c= 1.2.7 - Authenticated (Shop Manager+) Local File Inclusion",
    "slug": "cities-shipping-zones-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-47309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47309",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Travel Management \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nd-travel",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27859",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.3.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6633",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Zoho CRM Lead Magnet \u003c= 1.7.9.7 - Authenticated (Contributor+) SQL Injection",
    "slug": "zoho-crm-forms",
    "type": "plugin",
    "affected_version": "* - 1.7.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49297",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.1.3 - Authenticated SQL Injection",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "[*, 4.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24951",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post \u0026 Page Notes \u003c= 0.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "post-page-notes",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23715",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.1.5 - Missing Authorization",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40005",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jobs for WordPress \u003c= 2.7.5 - Reflected Cross-Site Scripting",
    "slug": "job-postings",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32149",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Custom Body Class \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "add-custom-body-class",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5205",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WCFM Frontend Manager \u003c= 6.6.0 - Missing Authorization",
    "slug": "wc-frontend-manager",
    "type": "plugin",
    "affected_version": "6.6.0",
    "from_version": "6.6.0",
    "from_inclusive": true,
    "to_version": "6.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4937",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Be POPIA Compliant \u003c= 1.2.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "be-popia-compliant",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47445",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ElementsKit Lite \u003c= 3.0.3 - Unauthenticated Sensitive Information Exposure",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6582",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WS Form LITE \u003c= 1.9.238 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "ws-form",
    "type": "plugin",
    "affected_version": "* - 1.9.238",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.238",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login With Ajax \u003c= 3.0.4 - Cross-Site Scripting",
    "slug": "login-with-ajax",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-2759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2759",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fat Rat Collect \u003c= 2.7.3 - Reflected Cross-Site Scripting",
    "slug": "fat-rat-collect",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10577",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking and Rental Manager \u003c= 2.3.6 - Missing Authorization",
    "slug": "booking-and-rental-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39390",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Editorial Assistant by Sovrn \u003c= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Attachment Upload and Set Post Featured Image",
    "slug": "zemanta",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9626",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0764",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Spell Check \u003c= 9.21 - Cross-Site Request Forgery",
    "slug": "wp-spell-check",
    "type": "plugin",
    "affected_version": "* - 9.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25111",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rencontre – Dating Site \u003c= 3.1.2 - Cross-Site Scripting",
    "slug": "rencontre",
    "type": "plugin",
    "affected_version": "[*, 3.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-13414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13414",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Blocks – Gutenberg Blocks for WordPress \u003c= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-blocks-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37519",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Locations \u003c= 3.2.1 - Cross-Site Request Forgery Bypass",
    "slug": "locations",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4394",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WoWPth \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "wowpth",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1487",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opti Marketing \u003c= 2.0.9 - Unauthenticated SQL Injection",
    "slug": "opti-marketing",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6928",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "ImageLinks Interactive Image Builder for WordPress \u003c= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "imagelinks-interactive-image-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4393",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SpeakOut! Email Petitions \u003c= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "speakout",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22309",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Webriti Custom Login \u003c= 0.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "webriti-custom-login-page",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51634",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GamiPress \u003c= 7.3.7 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 7.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47508",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Buddypress Moderation \u003c= 1.2.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "youzify-moderation",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2864",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact form Form For All \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "formforall",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5337",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feed Statistics \u003c= 4.1 - Cross-Site Request Forgery via init",
    "slug": "wordpress-feed-statistics",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45605",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Sell Digital Files \u0026 Subscriptions (eCommerce Store + Payments Made Easy) \u003c= 3.2.9 - Sensitive Information Exposure",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2302",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Social Sharing (by Danny) \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "dvk-social-sharing",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9704",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clients \u003c= 1.1.4 - Missing Authorization",
    "slug": "clients",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31746",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Order Export For WooCommerce \u003c= 3.4.4 - Authenticated (Shop Manager+) Remote Code Execution",
    "slug": "woo-order-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31266",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Team Members for Elementor Page Builder \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "team-members-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31771",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments Ratings \u003c= 1.1.6 - Cross-Site Request Forgery",
    "slug": "comments-ratings",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23704",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SimaCookie \u003c= 1.3.2 - Cross-Site Request Forgery",
    "slug": "simasicher-dsgvo-cookie",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58869",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Duplicator \u003c= 1.2.32 - Cross-Site Scripting",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "* - 1.2.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-7543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-7543",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.12",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.7",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.4",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.28",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.21",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.20",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.16",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.3",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.31",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.29",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.28",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.19",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.15",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.31",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.25",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.11",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20043",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "eewee admin custom \u003c= 1.8.2.4 - Reflected Cross-Site Scripting",
    "slug": "eewee-admincustom",
    "type": "plugin",
    "affected_version": "* - 1.8.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complete Gallery Manager \u003c= 3.3.3 - Arbitrary File Upload",
    "slug": "complete-gallery-manager",
    "type": "plugin",
    "affected_version": "[*, 3.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-5962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5962",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.3.2 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2007-6318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-6318",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Conversios.io \u003c= 6.5.0 - Missing Authorization",
    "slug": "enhanced-e-commerce-for-woocommerce-store",
    "type": "plugin",
    "affected_version": "* - 6.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51357",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Under Construction / Maintenance Mode from Acurax \u003c= 2.6 - Unauthenticated IP Spoofing",
    "slug": "coming-soon-maintenance-mode-from-acurax",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35749",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Send Emails with Mandrill \u003c= 1.4.1 - Missing Authorization",
    "slug": "send-emails-with-mandrill",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43208",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Contact Forms \u003c= 1.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "simple-contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31615",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Scripts n Styles \u003c= 3.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "scripts-n-styles",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31236",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BookingPress \u003c= 1.0.74 - Booking Price Manipulation via bookingpress_confirm_booking",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.74",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.74",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51405",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c 1.8.3 - Reflected Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 1.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-4826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4826",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freshmail for WordPress \u003c= 1.5.8 - SQL Injection",
    "slug": "freshmail-newsletter",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9496",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI Power: Complete AI Pack \u003c= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_forms",
    "slug": "gpt3-ai-content-generator",
    "type": "plugin",
    "affected_version": "* - 1.8.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.96",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0429",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.10 - Missing Authorization",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41652",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPB Elementor Addons \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpb-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58793",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mark Posts \u003c= 2.0.0 - Admin+ Stored Cross-Site Scripting",
    "slug": "mark-posts",
    "type": "plugin",
    "affected_version": "[*, 2.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0958",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Word Count \u003c= 3.2.4 - Missing Authorization via calculate_statistics",
    "slug": "wp-word-count",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46628",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPGlobus – Multilingual Everything! \u003c= 1.9.6 - Cross-Site Scripting via wpglobus_option[enabled_languages]",
    "slug": "wpglobus",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5363",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nested Pages \u003c= 3.2.7 - Cross-Site Request Forgery to Local File Inclusion",
    "slug": "wp-nested-pages",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5943",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wp-mpdf \u003c= 3.7.1 - Reflected Cross-Site Scripting",
    "slug": "wp-mpdf",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27962",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chatbot with ChatGPT  \u003c= 2.4.4 - Missing Authorization",
    "slug": "smartsearchwp",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6846",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PayPlus Payment Gateway \u003c= 6.6.8 - Reflected Cross-Site Scripting",
    "slug": "payplus-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 6.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37459",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export All Posts, Products, Orders, Refunds \u0026 Users \u003c= 2.13 - Unauthenticated PHP Object Injection",
    "slug": "wp-ultimate-exporter",
    "type": "plugin",
    "affected_version": "* - 2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2332",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ListingPro - WordPress Directory \u0026 Listing Theme \u003c 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation",
    "slug": "listingpro",
    "type": "theme",
    "affected_version": "[*, 2.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-36719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36719",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wp-publications \u003c 1.1 - Local File Inclusion",
    "slug": "wp-publications",
    "type": "plugin",
    "affected_version": "* - 0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-38360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38360",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13430",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multi Step Form \u003c= 1.7.18 - Cross-Site Request Forgery",
    "slug": "multi-step-form",
    "type": "plugin",
    "affected_version": "* - 1.7.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25905",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Database Backup \u003c= 4.3.2 - Cross-Site Scripting",
    "slug": "wp-database-backup",
    "type": "plugin",
    "affected_version": "[*, 4.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10873",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobs for WordPress \u003c= 2.5.10.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "job-postings",
    "type": "plugin",
    "affected_version": "* - 2.5.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26017",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixelating image slideshow gallery \u003c= 8.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "pixelating-image-slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30979",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BNS Twitter Follow Button \u003c= 0.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bns-twitter-follow-button",
    "type": "plugin",
    "affected_version": "* - 0.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47578",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pingmeter Uptime Monitoring \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "pingmeter-uptime-monitoring",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11808",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Currency Switcher \u003c= 1.3.7 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24938",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \u003c= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2417",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Return and Warranty Management System for WooCommerce \u003c= 1.2.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wc-return-warrranty",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-22710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22710",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventer \u003c= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read",
    "slug": "eventer",
    "type": "plugin",
    "affected_version": "* - 3.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10799",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "All Video Gallery  \u003c= 1.1 - SQL Injection",
    "slug": "all-video-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-6653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6653",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "CMP – Coming Soon \u0026 Maintenance Plugin by NiteoThemes \u003c= 4.1.6 - Information Exposure",
    "slug": "cmp-coming-soon-maintenance",
    "type": "plugin",
    "affected_version": "* - 4.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1263",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress \u003c= 2.8.8 - Reflected Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 2.8.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9688",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GutSlider – All in One Block Slider \u003c= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slider-blocks",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37955",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Altos Connect \u003c= 1.3.0 - Cross-Site Scripting",
    "slug": "altos-connect",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9444",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewsPlugin \u003c= 1.0.18 – Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "newsplugin",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-34631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34631",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Fundraising Donation and Crowdfunding Platform \u003c= 1.7.3 - Cross-Site Request Forgery",
    "slug": "wp-fundraising-donation",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47459",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP htpasswd \u003c= 1.7 - Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "wp-htpasswd",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25064",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ActivityPub \u003c= 1.0.5 - Missing Authorization",
    "slug": "activitypub",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52199",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Guestmap \u003c= 1.8 - Multiple Cross-Site Scripting",
    "slug": "wp-guestmap",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4587",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 4.1.7 - SQL Injection",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 4.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-13569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13569",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Perfect Portfolio \u003c= 1.2.0 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "perfect-portfolio",
    "type": "theme",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37435",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hide My WP Ghost – Security \u0026 Firewall \u003c= 5.3.02 - Unauthenticated Login Page Disclosure",
    "slug": "hide-my-wp",
    "type": "plugin",
    "affected_version": "* - 5.3.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13794",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YOP Poll \u003c= 6.3.4 - Author+ Stored Cross-Site Scripting",
    "slug": "yop-poll",
    "type": "plugin",
    "affected_version": "* - 6.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0205",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DM Albums \u003c= 1.9.2 - Remote File Inclusion",
    "slug": "dm-albums",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2009-2396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2396",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Erima Zarinpal Donate \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "erima-zarinpal-donate",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27290",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Forms – when you need more than just a contact form \u003c= 2.9.95 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "smart-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.95",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.95",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1905",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Date and Time Shortcode \u003c= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-date-and-time-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31590",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Deserialization via Widgets",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.1",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5203",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Deserialization via Widgets",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-5203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5203",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Deserialization via Widgets",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.3",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5203",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Deserialization via Widgets",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.3",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5203",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Cloud \u003c= 1.4.3 - Unauthenticated Arbitrary File Read",
    "slug": "cloud",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23819",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AnnounceKit \u003c= 2.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "announcekit",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3023",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10558",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Knowledgebase \u003c= 1.3.4 - Cross-Site Request Forgery",
    "slug": "wp-knowledgebase",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5802",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spotlight Social Media Feeds \u003c= 1.7.1 - Unauthenticated Sensitive Information Disclosure",
    "slug": "spotlight-social-photo-feeds",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26758",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Credova_Financial \u003c= 1.4.8 - Sensitive Information Disclosure",
    "slug": "credova-financial",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39342",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SKT Donation – Charity and Fundraising Plugin \u003c= 1.9 - Reflected Cross-Site Scripting",
    "slug": "skt-donation",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24535",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widgets Reset \u003c= 0.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "widgets-reset",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8082",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Pricing Tables \u003c= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4654",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TablePress \u003c= 2.2.4 - Authenticated(Author+) Server Side Request Forgery(SSRF) via _get_import_files",
    "slug": "tablepress",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-23825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23825",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "ARMember Lite - Membership Plugin \u003c= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3996",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print Invoice \u0026 Delivery Notes for WooCommerce \u003c= 5.5.0 - Cross-Site Request Forgery",
    "slug": "woocommerce-delivery-notes",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49239",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Leyka \u003c= 3.29.2 - Cross-Site Request Forgery",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "* - 3.29.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.29.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27442",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Ads.txt \u0026 App-ads.txt Manager for WordPress \u003c= 1.1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "app-ads-txt",
    "type": "plugin",
    "affected_version": "* - 1.1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50415",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flag Icons \u003c= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "language-icons-flags-switcher",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31575",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Supermalink \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "supermalink",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49433",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ANAC XML Viewer \u003c= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "anac-xml-viewer",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47245",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aeroscroll Gallery – Infinite Scroll Image Gallery \u0026 Post Grid with Photo Gallery \u003c= 1.0.12 - Unauthenticated Directory Traversal",
    "slug": "aeroscroll-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49451",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Outdooractive Embed \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "outdooractive-embed",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11774",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CUBE SLIDER \u003c= 1.2 - Authenticated (Admin+) SQL Injection",
    "slug": "cube-slider",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1684",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Recently viewed and most viewed products \u003c= 1.1.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting",
    "slug": "recently-viewed-and-most-viewed-products",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47646",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \u003c= 2.8.7 - Missing Authorization to Unauthenticated Media Upload",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1169",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Smart Slider 3 \u003c= 3.5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-slider-3",
    "type": "plugin",
    "affected_version": "* - 3.5.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45843",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal \u003c= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wp-malware-removal",
    "type": "plugin",
    "affected_version": "* - 17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6043",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Shuffle \u003c= 0.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "shuffle",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28873",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Responsive Pricing Table \u003c= 5.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "dk-pricr-responsive-pricing-table",
    "type": "plugin",
    "affected_version": "* - 5.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4810",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Backup \u0026 Migration \u003c= 1.4.8 - Missing Authorization to Directory Traversal",
    "slug": "wp-migration-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3546",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CURCY \u003c= 2.2.3 - Reflected Cross-Site Scripting",
    "slug": "woo-multi-currency",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49283",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OSM – OpenStreetMap \u003c= 6.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "osm",
    "type": "plugin",
    "affected_version": "* - 6.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31557",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paytm Payment Gateway \u003c= 2.7.3 - Authenticated (Editor+) SQL Injection via 'post'",
    "slug": "paytm-payments",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45805",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "vcOS \u003c= 1.4.0 - Reflected Cross-Site Scripting",
    "slug": "vcos",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23433",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Event Manager, Event Calendar and Booking Plugin \u003c= 4.0.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "eventin-pro",
    "type": "plugin",
    "affected_version": "* - 4.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52731",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin \u003c= 3.3.50 - Missing Authorization to Unauthenticated Events Export",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 3.3.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1122",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "VK All in One Expansion Unit \u003c= 9.99.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "vk-all-in-one-expansion-unit",
    "type": "plugin",
    "affected_version": "* - 9.99.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.99.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37956",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Add to Cart Button Label and Link \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woo-custom-cart-button",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49296",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Betheme \u003c= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 27.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "27.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0450",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Responsive Menu \u003c= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "simple-responsive-menu",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26543",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "5sterrenspecialist \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "5-sterrenspecialist",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32114",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flatty \u003c= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "flatty-flat-admin-theme",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31472",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Builder \u003c= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5286",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery \u003c= 3.59.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.59.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.59.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10545",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Banner Cycler \u003c= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "banner-cycler",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2233",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Per Page Add to Head \u003c= 1.4.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "per-page-add-to",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24619",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Image Gallery \u003c= 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "simple-responsive-image-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39313",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Buffer Button \u003c= 1.0 - Cross-Site Scripting",
    "slug": "the-buffer-button",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25058",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shamsi \u003c= 4.1.1 - Missing Authorization to Plugin Settings Update",
    "slug": "wp-shamsi",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38058",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP2LEADS \u003c= 3.4.2 - Reflected Cross-Site Scripting",
    "slug": "wp2leads",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56065",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Dynamic Keywords Injector \u003c= 2.3.15 - Cross-Site Request Forgery",
    "slug": "wp-dynamic-keywords-injector",
    "type": "plugin",
    "affected_version": "* - 2.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47141",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Bold Page Builder \u003c= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 4.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3266",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 3.2.1 - Missing Authorization",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43136",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AW WooCommerce Kode Pembayaran \u003c= 1.1.4 - Reflected Cross-Site Scripting",
    "slug": "aw-woocommerce-kode-pembayaran",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23450",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carousel Anything For WPBakery Page Builder \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "carousel-anything",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30520",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Back Link Tracker \u003c= 1.0.0 - Cross-Site Request Forgery to SQL Injection",
    "slug": "back-link-tracker",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49617",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Winters \u003c= 1.4.3 - Prototype Pollution to Reflected Cross-Site Scripting",
    "slug": "winters",
    "type": "theme",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3962",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redux Framework 4.4.12 -  4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting",
    "slug": "redux-framework",
    "type": "plugin",
    "affected_version": "4.4.12 - 4.4.17",
    "from_version": "4.4.12",
    "from_inclusive": true,
    "to_version": "4.4.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6828",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.9.1 - XML External Entity (XXE) Weakness",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-2053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2053",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Fluent CRM \u003c= 2.8.44 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "fluent-crm",
    "type": "plugin",
    "affected_version": "* - 2.8.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30430",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visitors Online by BestWebSoft \u003c= 0.3 - SQL Injection",
    "slug": "visitors-online",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9325",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Getwid – Gutenberg Blocks \u003c= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown'",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3588",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LoginWP - Pro \u003c= 4.0.8.5 - Missing Authorization",
    "slug": "loginwp-pro",
    "type": "plugin",
    "affected_version": "* - 4.0.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Insert Headers and Footers Code – HT Script \u003c= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update",
    "slug": "insert-headers-and-footers-script",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2779",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Flog \u003c= 0.1 - Cross-Site Scripting",
    "slug": "flog",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4530",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.0, 5.0.15)",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.15",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.3, 5.3.11)",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.3, 4.3.27)",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.27",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.5, 4.5.25)",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.25",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.2, 5.2.14)",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.14",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.8, 3.8.37)",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.37",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.2, 4.2.31)",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.31",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.4, 4.4.26)",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.26",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.6, 4.6.22)",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.22",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.8, 4.8.18)",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.18",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.9, 4.9.19)",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.19",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.4, 5.4.9)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.5, 5.5.8)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.7, 3.7.37)",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.37",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.0, 4.0.34)",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.34",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.7, 4.7.22)",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.22",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.1, 5.1.12)",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.12",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.6, 5.6.7)",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.7, 5.7.5)",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.8, 5.8.3)",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.9, 3.9.35)",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.35",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.1, 4.1.34)",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.34",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21662",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Testimonial Carousel For Elementor \u003c= 10.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "testimonials-carousel-elementor",
    "type": "plugin",
    "affected_version": "* - 10.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2253",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email posts to subscribers \u003c= 6.2 - Unauthenticated SQL Injection",
    "slug": "email-posts-to-subscribers",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-46818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46818",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Tickets and Registration  \u003c= 5.8.0  Events Tickets Plus \u003c= 5.9.0 - Authenticated (Contributor+) Information Exposure",
    "slug": "event-tickets-plus",
    "type": "plugin",
    "affected_version": "* - 5.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1316",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Event Tickets and Registration  \u003c= 5.8.0  Events Tickets Plus \u003c= 5.9.0 - Authenticated (Contributor+) Information Exposure",
    "slug": "event-tickets",
    "type": "plugin",
    "affected_version": "* - 5.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1316",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Waymark \u003c= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "waymark",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32495",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Find and Replace \u003c= 1.6.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "real-time-auto-find-and-replace",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24734",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Humans.txt \u003c= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-humanstxt",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3392",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "One Page Express Companion \u003c= 1.6.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via one_page_express_contact_form Shortcode",
    "slug": "one-page-express-companion",
    "type": "plugin",
    "affected_version": "* - 1.6.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BeeTeam368 Extensions \u003c= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion",
    "slug": "beeteam368-extensions",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6381",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fluent Support \u003c= 1.5.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "fluent-support",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2559",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JS Archive List \u003c= 6.1.5 - Unauthenticated SQL Injection",
    "slug": "jquery-archive-list-widget",
    "type": "plugin",
    "affected_version": "* - 6.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54726",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Icegram \u003c= 3.1.24 - Missing Authorization to Unauthenticated Message Duplication",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 3.1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39625",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SendPress Newsletters \u003c= 1.23.11.6 - Missing Authorization",
    "slug": "sendpress",
    "type": "plugin",
    "affected_version": "* - 1.23.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35040",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "qTranslate X \u003c 3.4.4 - Reflected Cross-Site Scripting",
    "slug": "qtranslate-x",
    "type": "plugin",
    "affected_version": "[*, 3.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9431",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mailchimp For WP \u003c= 4.1.7 - Cross-Site Scripting",
    "slug": "mailchimp-for-wp",
    "type": "plugin",
    "affected_version": "* - 4.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18577",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Comments Import \u0026 Export \u003c= 2.3.5 - Cross-Site Request Forgery",
    "slug": "comments-import-export-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31235",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Frames \u003c= 1.5.7 - Missing Authorization",
    "slug": "frames",
    "type": "theme",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60165",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ocean Extra \u003c= 2.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49164",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SW Plus \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "shalom-world-media-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25108",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4940",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wu-Rating \u003c= 1.0 12319 - Cross-Site Scripting",
    "slug": "wu-rating",
    "type": "plugin",
    "affected_version": "* - 1.0 12319",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0 12319",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4601",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EUCookieLaw \u003c= 2.7.2 - Unauthenticated Arbitrary File Read",
    "slug": "eucookielaw",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3897",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "3D Tag Cloud \u003c= 3.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cardoza-3d-tag-cloud",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41990",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "To Lead For Salesforce \u003c= 2.7.3.9 - Cross-Site Request Forgery",
    "slug": "salesforce-wordpress-to-lead",
    "type": "plugin",
    "affected_version": "* - 2.7.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58809",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Database Reset \u003c= 3.1 - Unauthenticated Database Reset",
    "slug": "wordpress-database-reset",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-7048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7048",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP Reroute Email \u003c= 1.4.6 - Cross-Site Request Forgery",
    "slug": "wp-reroute-email",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27606",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nafeza Prayer Time \u003c= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "nafeza-prayer-time",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4462",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.102 - Reflected Cross-Site Scripting",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.102",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.102",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relevanssi \u003c= 4.24.4 (Free) and \u003c= 2.27.5 (Premium) - Unauthenticated SQL Injection",
    "slug": "relevanssi-premium",
    "type": "plugin",
    "affected_version": "* - 2.27.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.27.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4396",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Relevanssi \u003c= 4.24.4 (Free) and \u003c= 2.27.5 (Premium) - Unauthenticated SQL Injection",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "* - 4.24.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4396",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Address Book \u003c 1.6.0 - Cross-Site Request Forgery",
    "slug": "woo-address-book",
    "type": "plugin",
    "affected_version": "[*, 1.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15770",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Brandfolder \u003c= 5.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "brandfolder",
    "type": "plugin",
    "affected_version": "* - 5.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5843",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ScrollTo Top \u003c= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "scrollto-top",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6320",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AP Background \u003c= 3.8.2 - Cross-Site Request Forgery",
    "slug": "ap-background",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9897",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.17",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.15",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.7",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.8",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.27",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.24",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.24",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.21",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.16",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.25",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.12",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.11",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHP Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.27",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20148",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modal Window \u003c= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "modal-window",
    "type": "plugin",
    "affected_version": "* - 5.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5161",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVP and Event Management Plugin \u003c= 2.3.7 - Cross-Site Scripting",
    "slug": "rsvp",
    "type": "plugin",
    "affected_version": "[*, 2.3.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18563",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Email Subscriber \u003c= 2.3 - Reflected Cross-Site Scripting",
    "slug": "simple-email-subscriber",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27354",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Cross-Site Request Forgery via ajax_delete_folder",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0727",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3639",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Packages – Sell Digital Products Securely \u003c= 5.9.3 - Reflected Cross-Site Scripting via add_query_arg",
    "slug": "wpdm-premium-packages",
    "type": "plugin",
    "affected_version": "* - 5.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11225",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscribe to Category \u003c= 2.7.3 - Missing Authorization",
    "slug": "subscribe-to-category",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43476",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Echo RSS Feed Post Generator \u003c= 5.4.8.1 - Unauthenticated Arbitrary File Upload",
    "slug": "rss-feed-post-generator-echo",
    "type": "plugin",
    "affected_version": "* - 5.4.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4391",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zara 4 Image Compression \u003c= 1.2.17.2 - Missing Authorization",
    "slug": "zara-4",
    "type": "plugin",
    "affected_version": "* - 1.2.17.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.17.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49969",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Payments 4.8.0 - 5.6.1 Authentication Bypass and Privilege Escalation",
    "slug": "woocommerce-payments",
    "type": "plugin",
    "affected_version": "4.8.0 - 5.6.1",
    "from_version": "4.8.0",
    "from_inclusive": true,
    "to_version": "5.6.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-28121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28121",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Comparison Slider \u003c= 1.0.5 - Missing Authorization",
    "slug": "comparison-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4427",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cookie-Script.com \u003c= 1.2.1 - Missing Authorization",
    "slug": "cookie-script-com",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49993",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Active Directory Integration / LDAP Integration \u003c= 4.1.9 - Sensitive Information Exposure",
    "slug": "ldap-login-for-intranet-sites",
    "type": "plugin",
    "affected_version": "* - 4.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4506",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Powerplay Gallery \u003c= 3.3 - Arbitrary File Upload",
    "slug": "wp-powerplaygallery",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-5681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5681",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Logo Carousel Gutenberg Block \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sliderId Parameter",
    "slug": "awesome-logo-carousel-block",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2083",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leyka \u003c= 3.31.6 - Missing Authorization",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "* - 3.31.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.31.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49252",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Asgaros Forum \u003c 2.0.0 - SQL Injection",
    "slug": "asgaros-forum",
    "type": "plugin",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0411",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Searchable Data Entry System \u003c= 1.7.1 - SQL Injection",
    "slug": "custom-searchable-data-entry-system",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-10817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10817",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wp-ImageZoom \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-imagezoom",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9934",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Job Manager by JobScore \u003c= 2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "job-manager-by-jobscore",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24550",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.11.0 - Unauthenticated PHP Object Injection",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9083",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Raptor Editor \u003c= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-raptor",
    "type": "plugin",
    "affected_version": "* - 1.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50468",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Provide Forex Signals \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "provide-forex-signals",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52344",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Greenshift  11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "11.4 - 11.4.5",
    "from_version": "11.4",
    "from_inclusive": true,
    "to_version": "11.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3616",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Total Upkeep – WordPress Backup Plugin plus Restore \u0026 Migrate by BoldGrid \u003c= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "boldgrid-backup",
    "type": "plugin",
    "affected_version": "* - 1.16.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13907",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ShopBuilder – Elementor WooCommerce Builder Addons \u003c= 2.1.12 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "shopbuilder",
    "type": "plugin",
    "affected_version": "* - 2.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37520",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Team Section Block \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "team-section",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26949",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Members \u003c= 3.5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.5.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57973",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Varnish/Nginx Proxy Caching \u003c= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "vcaching",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48360",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 2.4.0 - Missing Authorization",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36913",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unyson \u003c= 2.7.26 - Cross-Site Scripting",
    "slug": "unyson",
    "type": "plugin",
    "affected_version": "* - 2.7.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2219",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sharebar \u003c= 1.2.1 - Cross-Site Scripting",
    "slug": "sharebar",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-6718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6718",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booked \u003c= 2.4 - Unauthenticated Sensitive Information Exposure",
    "slug": "booked",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36399",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "efence \u003c= 1.3.2 - Multiple Cross-Site Scripting",
    "slug": "efence",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4526",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bridge Core \u003c 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bridge-core",
    "type": "plugin",
    "affected_version": "[*, 3.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-31409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31409",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rencontre – Dating Site \u003c= 3.10.1 - Unauthenticated Arbitrary File Upload",
    "slug": "rencontre",
    "type": "plugin",
    "affected_version": "* - 3.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51468",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Insert Code \u003c= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "insert-code",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28932",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 2.2.0 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32662",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Password Protect Plugin for WordPress \u003c= 0.8.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "password-protect-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 0.8.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login and Logout Redirect \u003c= 2.0.2 -  Open Redirect",
    "slug": "login-and-logout-redirect",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41648",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Optinly \u003c= 1.0.18 - Missing Authorization to Plugin Settings Change",
    "slug": "optinly",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41647",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Themify Event Post \u003c= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "themify-event-post",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30440",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stop Spammers \u003c= 2021.8 - Reflected Cross-Site Scripting",
    "slug": "stop-spammer-registrations-plugin",
    "type": "plugin",
    "affected_version": "[*, 2021.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2021.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24245",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flash \u0026 HTML5 Video \u003c= 2.5.31 - Authenticated (Subscriber+) Information Exposure",
    "slug": "html5-video-player",
    "type": "plugin",
    "affected_version": "* - 2.5.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43319",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "HTML2WP \u003c= 1.0.0 - Arbitrary File Deletion",
    "slug": "html2wp",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1572",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Timeline Widget \u003c= 2.2 - Missing Authorization to Notice Dismissal",
    "slug": "3r-elementor-timeline-widget",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49755",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bears Backup \u003c= 2.0.0 - Unauthenticated Remote Code Execution",
    "slug": "bears-backup",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5396",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mailgun SMTP \u003c= 1.0.7 - Missing Authorization",
    "slug": "wp-mailgun-smtp",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48327",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Fountain \u003c= 1.5.9 - Reflected Cross-Site Scripting",
    "slug": "wp-fountain",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34653",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 5.5.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "* - 5.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5455",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz Maker \u003c= 6.5.9.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.5.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8617",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Trendy Restaurant Menu \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "trendy-restaurant-menu",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51796",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Table of Contents \u003c= 2.0.45.2 - Missing Authorization via eztoc_reset_options_to_default",
    "slug": "easy-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 2.0.45.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.45.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25469",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WidgetPack Comment System \u003c= 1.6.1 - Cross-Site Request Forgery",
    "slug": "widgetpack-comment-system",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9621",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ViewMedica 9 \u003c= 1.4.15 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "viewmedica",
    "type": "plugin",
    "affected_version": "* - 1.4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12291",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contests by Rewards Fuel \u003c= 2.0.62 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "contests-from-rewards-fuel",
    "type": "plugin",
    "affected_version": "* - 2.0.62",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.62",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1785",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Widgets for Google Reviews \u003c= 10.9 - Cross-Site Request Forgery to Plugin Settings Reset",
    "slug": "wp-reviews-plugin-for-google",
    "type": "plugin",
    "affected_version": "* - 10.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3254",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress.com Editing Toolkit \u003c= 3.78784 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "full-site-editing",
    "type": "plugin",
    "affected_version": "* - 3.78784",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.78784",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50879",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wayne Audio Player \u003c= 1.0 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "wayne-audio-player",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56203",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response Deletion",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4219",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via wp_user_id",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4155",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via wp_user_id",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4155",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce OTP Login With Phone Number, OTP Verification \u003c= 1.8.47 - Authentication Bypass",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "* - 1.8.47",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.47",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8342",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-7169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7169",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.15",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7169",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.15",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7169",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.12",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7169",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.12",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7169",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.9",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7169",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.5",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7169",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.4",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7169",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.13",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7169",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.3",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7169",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7169",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WpEvently \u003c= 4.2.9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 4.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Embedded Video \u003c= 4.1 - Cross-Site Scripting",
    "slug": "embedded-video-with-link",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2010-4277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4277",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Slick Social Share Buttons \u003c= 2.4.11 - Authenticated (Subscriber+) Arbitrary Option Update",
    "slug": "slick-social-share-buttons",
    "type": "plugin",
    "affected_version": "* - 2.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6878",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Comments Ratings \u003c= 1.1.7 - Cross-Site Request Forgery",
    "slug": "comments-ratings",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45654",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47298",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adifier System \u003c= 3.1.7 - Unauthenticated Arbitrary Password Reset",
    "slug": "adifier-system",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13375",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Global Gateway e4 | Payeezy Gateway | \u003c= 2.0 - Unauthenticated Arbitrary File Deletion",
    "slug": "globe-gateway-e4",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52371",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WHA Puzzle \u003c= 1.0.9 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "wha-puzzle",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45839",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Insights from Google PageSpeed \u003c= 4.0.6 - Multiple Cross-Site Request Forgery",
    "slug": "google-pagespeed-insights",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1672",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Login Lite For WooCommerce \u003c= 1.6.0 - Authentication Bypass",
    "slug": "social-login-lite-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4552",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EZP Coming Soon Page \u003c= 1.0.7.3 - Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "easy-pie-coming-soon",
    "type": "plugin",
    "affected_version": "* - 1.0.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24398",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Lockdown \u003c= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Post Disclosure",
    "slug": "post-lockdown",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1504",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Folders \u003c= 3.0 and Folders Pro \u003c= 3.0.2 - Directory Traversal via handle_folders_file_upload",
    "slug": "folders",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2023",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Folders \u003c= 3.0 and Folders Pro \u003c= 3.0.2 - Directory Traversal via handle_folders_file_upload",
    "slug": "folders-pro",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2023",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LeagueManager \u003c= 3.7 - Multiple Cross-Site Scripting",
    "slug": "leaguemanager",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-2912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2912",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPIDE – File Manager \u0026 Code Editor \u003c= 2.6 - Authenticated (Admininstrator+) Local File Inclusion",
    "slug": "wpide",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2261",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Media File Renamer \u003c= 5.6.9 - Sensitive Information Exposure via Log File",
    "slug": "media-file-renamer",
    "type": "plugin",
    "affected_version": "* - 5.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44991",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Lara Google Analytics \u003c= 2.0.4 - Stored Cross-Site Scripting",
    "slug": "lara-google-analytics",
    "type": "plugin",
    "affected_version": "[*, 2.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-20626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-20626",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.32",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.26",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.20",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.13",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.8",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.5",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.2",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.22",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.17",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.16",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.32",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.30",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.29",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.29",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.21",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.12",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Private Post Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.4",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11028",
    "auth_type": "Auth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "1003 Mortgage Application \u003c= 1.75 - Unauthenticated CSV Injection",
    "slug": "1003-mortgage-application",
    "type": "plugin",
    "affected_version": "* - 1.75",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.75",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45357",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "SV Forms \u003c= 2.0.05 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sv-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51877",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tablesome \u003c= 1.0.8 - Reflected Cross-Site Scripting",
    "slug": "tablesome",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-1890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1890",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TableOn – WordPress Posts Table Filterable \u003c= 1.0.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "posts-table-filterable",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32592",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nexa Blocks \u003c= 1.1.0 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "nexa-blocks",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30976",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Loginizer \u003c= 1.3.5 - Cross-Site Request Forgery",
    "slug": "loginizer",
    "type": "plugin",
    "affected_version": "[*, 1.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-12651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-12651",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "No Update Nag \u003c= 1.4.12 - Unauthenticated Full Path Disclosure",
    "slug": "no-update-nag",
    "type": "plugin",
    "affected_version": "* - 1.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7412",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Popup4Phone \u003c= 1.3.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "popup4phone",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3231",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Table Manager \u003c= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure",
    "slug": "wp-table-manager",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13374",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Login with phone number \u003c= 1.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0598",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncode Core \u003c= 2.8.8 - Privilege Escalation",
    "slug": "uncode-core",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51515",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rate Star Review \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "rate-star-review",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52213",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Sentinel \u003c 1.0.1 - SQL Injection",
    "slug": "wordpress-sentinel",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2011-5224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5224",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PageLayer \u003c= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6738",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Product Filter by WooBeWoo \u003c= 1.4.9 - Missing Authorization",
    "slug": "woo-product-filter",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4444",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Contact Form By Mega Forms \u003c= 1.6.1 - Missing Authorization",
    "slug": "mega-forms",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58639",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 2.1.6 - Unauthenticated SQL Injection",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-25150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25150",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Solidres – Hotel booking plugin \u003c= 0.9.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "solidres",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23911",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CopySafe Web Protection \u003c= 3.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-copysafe-web",
    "type": "plugin",
    "affected_version": "* - 3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37514",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Student Results \u003c= 2.2.8 - Reflected Cross-Site Scripting",
    "slug": "easy-student-results",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2378",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Menu Edit \u003c= 1.3.0 - Missing Authorization",
    "slug": "bulk-menu-edit",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24692",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form \u0026 Content Restriction \u003c= 3.8.4 - Sensitive Information Exposure via Log Files",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "* - 3.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13818",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23668",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-in-one Floating Contact Form \u003c= 2.1.1 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "mystickyelements",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3248",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker – Best WordPress Survey Plugin \u003c= 3.1.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0038",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GymBase Theme Classes \u003c= 1.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "gymbase_classes",
    "type": "theme",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54026",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Brave Popup Builder \u003c= 0.7.0 - Cross-Site Request Forgery",
    "slug": "brave-popup-builder",
    "type": "plugin",
    "affected_version": "* - 0.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43337",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Recipes Writer \u003c= 1.0.4 - Cross-Site Scripting",
    "slug": "recipes-writer",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000147",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premmerce User Roles \u003c= 1.0.12 - Missing Authorization via role management functions",
    "slug": "premmerce-user-roles",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-41130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41130",
    "auth_type": "Auth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
  },
  {
    "title": "PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip \u003c= 2.3.32 - Reflected Cross-Site Scripting",
    "slug": "3d-flipbook-dflip-lite",
    "type": "plugin",
    "affected_version": "* - 2.3.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8717",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support \u003c= 6.1.4 - Authenticated (Submitter+) Arbitrary File Deletion",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5355",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Appointment Booking Calendar \u003c= 1.3.34 - Stored Cross-Site Scripting",
    "slug": "appointment-booking-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.3.35)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.35",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-9371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9371",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exit Intent Popup \u003c= 1.0.1 - Unauthenticated Server-Side Request Forgery",
    "slug": "exitintentpopup",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58641",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Plugin Info Card \u003c= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-plugin-info-card",
    "type": "plugin",
    "affected_version": "* - 5.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31835",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Membership \u003c= 1.6.2 - Unauthenticated Arbitrary File Upload",
    "slug": "wp-membership",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10547",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Top 10 \u003c= 3.3.2 - Cross-Site Request Forgery via edit_count_ajax",
    "slug": "top-10",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47238",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SMSmaster – Multipurpose SMS Gateway for Wordpress (All Versions) - Authenticated SQL Injection",
    "slug": "smsmaster",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-14842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14842",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Activity \u003c= 1.0.1 - IP Address Spoofing",
    "slug": "user-activity",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4550",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Code Insert Manager (Q2W3 Inc Manager) \u003c= 2.5.3 - Reflected Cross-Site Scripting",
    "slug": "q2w3-inc-manager",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blogger Buzz \u003c= 1.2.4 - Missing Authorization via activate_plugin",
    "slug": "blogger-buzz",
    "type": "theme",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30476",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Video Player \u003c= 1.2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-video-player",
    "type": "plugin",
    "affected_version": "* - 1.2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3937",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modula Image Gallery \u003c= 2.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "modula-best-grid-gallery",
    "type": "plugin",
    "affected_version": "[*, 2.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-9003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9003",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Connector for Gravity Forms and Google Sheets \u003c= 1.2.4 - Open Redirect",
    "slug": "wp-gravity-forms-spreadsheets",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54681",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Migration Plugin DB \u0026 Files – WP Synchro \u003c= 1.11.2 - Cross-Site Request Forgery",
    "slug": "wpsynchro",
    "type": "plugin",
    "affected_version": "* - 1.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32096",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WoodMart \u003c= 7.2.4 - Reflected Cross-Site Scripting",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 7.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41872",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Book appointment online \u003c= 1.38 - Cross-Site Scripting",
    "slug": "book-appointment-online",
    "type": "plugin",
    "affected_version": "* - 1.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24614",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishlist \u003c= 2.1.0 - Missing Authorization",
    "slug": "wishlist",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31063",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.2.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-3639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-3639",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobify - Job Board WordPress Theme \u003c= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image Generation",
    "slug": "jobify",
    "type": "theme",
    "affected_version": "* - 4.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13698",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "LMS by LifterLMS \u003c= 3.35.0 - Stored Cross-Site Scripting via Import",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "[*, 3.35.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.35.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-15896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15896",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.24 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2664",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixabay Images \u003c= 2.3 - Arbitrary File Upload",
    "slug": "pixabay-images",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-1376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1376",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Most Recent Posts Mod \u003c= 1.6.5.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "advanced-most-recent-posts-mod",
    "type": "plugin",
    "affected_version": "* - 1.6.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33643",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Export \u0026 Order Import for WooCommerce \u003c= 2.4.9 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "order-import-export-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-34751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34751",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Awesome Contact Form7 for Elementor \u003c= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "awesome-contact-form7-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49319",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Events Calendar Pro \u003c= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution",
    "slug": "events-calendar-pro",
    "type": "plugin",
    "affected_version": "* - 7.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8016",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "IP Blocker Lite \u003c= 11.1.1 - Cross-Site Request Forgery",
    "slug": "ip-address-blocker",
    "type": "plugin",
    "affected_version": "* - 11.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23993",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "SEO Backlink Monitor \u003c= 1.6.0 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "seo-backlink-monitor",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53457",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder – More than Just a Page Builder \u003c= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.21.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.21.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4619",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Googmonify \u003c= 0.5.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "googmonify",
    "type": "plugin",
    "affected_version": "* - 0.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9427",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wp custom countdown \u003c= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-custom-countdown",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22822",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Car Park Booking System for WordPress \u003c= 2.6 - Missing Authorization",
    "slug": "car-park-booking-system-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39376",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rotating Posts \u003c= 1.11 - Cross-Site Request Forgery to Settings Update",
    "slug": "rotating-posts",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1847",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Delhivery Logistics Courier \u003c= 1.0.107 - Authenticated (Subscriber+) SQL Injection",
    "slug": "delhivery-logistics-courier",
    "type": "plugin",
    "affected_version": "* - 1.0.107",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.107",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22283",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \u003c= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "revisionary",
    "type": "plugin",
    "affected_version": "* - 3.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11154",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Motors – Car Dealership \u0026 Classified Listings Plugin \u003c= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10494",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Translate WordPress with GTranslate \u003c= 2.9.8 \u0026 Translate WordPress – Google Language Translator \u003c= 6.0.13 - Missing Authorization to Sensitive Information Disclosure",
    "slug": "gtranslate",
    "type": "plugin",
    "affected_version": "[*, 2.9.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0770",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Translate WordPress with GTranslate \u003c= 2.9.8 \u0026 Translate WordPress – Google Language Translator \u003c= 6.0.13 - Missing Authorization to Sensitive Information Disclosure",
    "slug": "google-language-translator",
    "type": "plugin",
    "affected_version": "* - 6.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0770",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slideshow SE \u003c= 2.5.5 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "slideshow-se",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41554",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Sections Theme Builder - WPBakery Page Builder Addon \u003c= 1.7.8 - Unauthenticated PHP Object Injection",
    "slug": "visucom-smart-sections",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39410",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "aio-time-clock-lite",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6832",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mow \u003c= 4.10 - Cross-Site Request Forgery",
    "slug": "mow",
    "type": "theme",
    "affected_version": "* - 4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58997",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Comment Form \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "comment-form",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3220",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Adsense and Hotel Booking \u003c= 1.05 - Open Proxy",
    "slug": "google-adsense-and-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 1.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.05",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-1000009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000009",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Unlimited Elements For Elementor \u003c= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.96",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fatal Error Notify \u003c= 1.5.2 - Missing Authorization to Test Error Email Sending",
    "slug": "fatal-error-notify",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7202",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Greenmart \u003c= 4.2.3 - Unauthenticated Local File Inclusion",
    "slug": "greenmart",
    "type": "theme",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49883",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GSEOR – WordPress SEO Plugin \u003c= 1.3 - Authenticated (Admin+) SQL Injection",
    "slug": "gseor",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24396",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Addons PRO \u003c= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Premium Magic Scroll Module",
    "slug": "premium-addons-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2239",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rise Blocks – A Complete Gutenberg Page Builder \u003c= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleTag Parameter",
    "slug": "rise-blocks",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0506",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Customizer for WooCommerce | Drag and Drop Email Templates Builder \u003c= 2.6.0 - Information Exposure",
    "slug": "email-customizer-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32781",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CP Multi View Event Calendar  \u003c= 1.4.32 - Missing Authorization",
    "slug": "cp-multi-view-calendar",
    "type": "plugin",
    "affected_version": "* - 1.4.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.32",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-58009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58009",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Posts Slider Shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "posts-slider-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30943",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BannerMan \u003c= 0.2.4 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "bannerman",
    "type": "plugin",
    "affected_version": "* - 0.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1275",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EnvialoSimple: Email Marketing y Newsletters \u003c 1.98 - Cross-Site Scripting",
    "slug": "envialosimple-email-marketing-y-newsletters-gratis",
    "type": "plugin",
    "affected_version": "* - 1.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.97",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4527",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Views for WPForms \u003c= 3.2.2 - Cross-Site Request Forgery via create_view",
    "slug": "views-for-wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0374",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Co-marquage service-public.fr \u003c= 0.5.76 - Reflected Cross-Site Scripting via add_query_arg Parameter",
    "slug": "co-marquage-service-public",
    "type": "plugin",
    "affected_version": "* - 0.5.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.76",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.7.0.62 - Cross-Site Request Forgery",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.7.0.62",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.0.62",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58014",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Thank Me Later \u003c= 3.3.4 - Admin+ Stored Cross-Site Scripting",
    "slug": "thank-me-later",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Portfolio Features for Phlox theme \u003c= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "auxin-portfolio",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1384",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GB Forms DB \u003c= 1.0.2 - Unauthenticated Remote Code Execution",
    "slug": "gb-forms-db",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5392",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder \u003c= 3.6.4 - Missing Authorization to Rating Manipulation",
    "slug": "wp-post-author",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34387",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PowerPress Podcasting \u003c= 11.9.17 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 11.9.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.9.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9227",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fantastic Elasticsearch \u003c= 4.1.0 - Reflected Cross-Site Scripting",
    "slug": "fantastic-elasticsearch",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link Library \u003c= 7.2.8 - Reflected Cross-Site Scripting",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25091",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Design Comuni Italia \u003c= 1.1.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "design-comuni-wordpress-theme",
    "type": "theme",
    "affected_version": "1.1.1",
    "from_version": "1.1.1",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1798",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Admin Login Page | WPZest \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "custom-admin-login-styler-wpzest",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40329",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Mirror \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "content-mirror",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23769",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Member Subscriptions \u003c= 2.10.4 - Cross-Site Request Forgery via ajax_add_log_entry",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51522",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zota \u003c= 1.3.8 - Unauthenticated Local File Inclusion",
    "slug": "zota",
    "type": "theme",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.89 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.89",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5121",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Campress \u003c= 1.35 - Unauthenticated Local File Inclusion",
    "slug": "campress",
    "type": "theme",
    "affected_version": "* - 1.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.35",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10763",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Decorator - WooCommerce Email Customizer \u003c= 1.2.7 - Cross-Site Request Forgery",
    "slug": "decorator-woocommerce-email-customizer",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48284",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Language Switcher \u003c= 3.7.13 - Reflected Cross-Site Scripting",
    "slug": "language-switcher",
    "type": "plugin",
    "affected_version": "* - 3.7.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9610",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "aThemes Addons for Elementor \u003c= 1.1.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "athemes-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32158",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP jQuery Persian Datepicker \u003c= 0.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wpjqp-datepicker",
    "type": "plugin",
    "affected_version": "* - 0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28861",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARMember Premium \u003c= 5.9.2 - Missing Authorization",
    "slug": "armember",
    "type": "plugin",
    "affected_version": "* - 5.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39994",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.8.21 - Reflected Cross-Site Scripting via 'thumb_url'",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29810",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aramex Shipping WooCommerce \u003c= 1.1.21 - Unauthenticated Full Path Disclosure",
    "slug": "aramex-shipping-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6566",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BuddyPress Members Only \u003c= 3.4.8 - Improper Access Control to Sensitive Information Exposure via REST API",
    "slug": "buddypress-members-only",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0972",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Music Player for Elementor – Audio Player \u0026 Podcast Player \u003c= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import",
    "slug": "music-player-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10582",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Intercom Slack \u003c= 1.2.1 - Sensitive Information Disclosure",
    "slug": "wp-intercom-slack",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-14365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14365",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MediaView \u003c= 1.1.2 - Reflected Cross-Site Scripting via id Parameter",
    "slug": "mediaview",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2481",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rank Math SEO \u003c= 1.0.231 - .htaccess File Manipulation to Remote Code Execution",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.231",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.231",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11620",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email Encoder \u003c= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "email-encoder-bundle",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4599",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Judge.me Product Reviews for WooCommerce \u003c= 1.3.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "judgeme-product-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Acnoo Flutter API \u003c= 1.0.5 - Authentication Bypass via Account Takeover",
    "slug": "acnoo-flutter-api",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50486",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Church Admin \u003c= 4.1.18 - Missing Authorization",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30505",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Coming soon and Maintenance mode  \u003c= 3.6.6 - Missing Authorization to Arbitrary Email Send",
    "slug": "coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 3.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0164",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Coming Soon, Under Construction \u0026 Maintenance Mode By Dazzler \u003c= 1.6.3 - Admin+ Stored Cross-Site Scripting",
    "slug": "coming-soon-wp",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24539",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress CRM, Email \u0026 Marketing Automation for WordPress | Award Winner — Groundhogg \u003c 1.3.5 - Remote Code Execution",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "[*, 1.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15647",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Content Cards \u003c= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "content-cards",
    "type": "plugin",
    "affected_version": "* - 0.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24928",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.12.7 - Missing Authorization to Sensitive Information Exposure",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4723",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Goodlayers Blocks \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "goodlayers-blocks",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23521",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hustle \u003c= 6.0.7 - Unauthenticated CSV Injection",
    "slug": "wordpress-popup",
    "type": "plugin",
    "affected_version": "* - 6.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-11872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11872",
    "auth_type": "Unauth",
    "cvss_score": 7.8,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Skill Bar \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skillbars",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22805",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixel WordPress Form BuilderPlugin \u0026 Autoresponder \u003c= 1.0.2 - Cross-Site Request Forgery",
    "slug": "pixel-formbuilder",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31915",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "News Wall \u003c= 1.1.0 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "news-wall",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2970",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 3.2.3 - Authenticated PHP Object Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "[*, 3.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18356",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP TradingView \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-tradingview",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32536",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ultimate CSV Importer \u003c= 6.5.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 6.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3243",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All-in-One Video Gallery \u003c= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode",
    "slug": "all-in-one-video-gallery",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6629",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uploading SVG, WEBP and ICO files \u003c= 1.0.1 - Arbitrary File Upload",
    "slug": "uploading-svgwebp-and-ico-files",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36285",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Piotnet Addons For Elementor Pro \u003c= 7.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "piotnet-addons-for-elementor-pro",
    "type": "plugin",
    "affected_version": "* - 7.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33631",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qtranslate Slug \u003c= 1.1.18 - Cross-Site Request Forgery Bypass",
    "slug": "qtranslate-slug",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4410",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "KNR Author List Widget \u003c= 3.1.1 - Reflected Cross-Site Scripting",
    "slug": "knr-author-list-widget",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22514",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Platform.ly Official \u003c= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "platformly",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Compare Tables \u003c= 1.0.5 - Cross-Site Request Forgery",
    "slug": "wp-compare-tables",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28883",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Reviews \u003c= 6.11.8 - IP Address Spoofing to Blocking Bypass",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "* - 6.11.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.11.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3050",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "My Marginalia \u003c= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "my-marginalia",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-FB-AutoConnect \u003c= 4.6.1 - Cross-Site Request Forgery via jfb_admin_page",
    "slug": "wp-fb-autoconnect",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37974",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Defender Security \u003c= 4.0.2 - Hide Login Page Feature Protection Bypass",
    "slug": "defender-security",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5089",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Leadfox for WordPress \u003c= 2.1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "leadfox",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31585",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVS Pricing Tables \u003c= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "svs-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2958",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49823",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMS OVH \u003c= 0.1 - Reflected Cross-Site Scripting",
    "slug": "sms-ovh",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38357",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fotobook \u003c= 3.2.3 - Reflected Cross-Site Scripting",
    "slug": "fotobook",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0380",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Copy Media URL \u003c= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-copy-media-url",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31583",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Secure Invites \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress-mu-secure-invites",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Game Tabs \u003c= 0.4.0 - Cross-Site Scripting",
    "slug": "game-tabs",
    "type": "plugin",
    "affected_version": "* - 0.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4531",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Visual Footer Credit Remover \u003c= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "visual-footer-credit-remover",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2846",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Member Directory and Contact Form \u003c= 1.7.0 - Missing Authorization",
    "slug": "pta-member-directory",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56215",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sublanguage \u003c= 2.9 - Missing Authorization",
    "slug": "sublanguage",
    "type": "plugin",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36695",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Comparison Slider \u003c= 1.0.5 - Cross-Site Request Forgery",
    "slug": "comparison-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4426",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Avada \u003c= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2340",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce PDF Invoices \u0026 Packing Slips \u003c= 2.15.0 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-pdf-invoices-packing-slips",
    "type": "plugin",
    "affected_version": "* - 2.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2092",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EU/UK VAT Manager for WooCommerce \u003c= 2.12.12 - Missing Authorization",
    "slug": "eu-vat-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.12.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9189",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack CRM \u003c= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zero-bs-crm",
    "type": "plugin",
    "affected_version": "* - 5.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4497",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Bootstrap Elements for Elementor \u003c= 1.4.4 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "ultimate-bootstrap-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43140",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Distance Based Shipping Calculator \u003c= 2.0.22 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "distance-based-shipping-calculator",
    "type": "plugin",
    "affected_version": "* - 2.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26764",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Form by AYS \u003c= 2.6.9 - Reflected Cross-Site Scripting",
    "slug": "easy-form",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27285",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce – Store Exporter \u003c= 2.7 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-exporter",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0149",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Filter Pro \u003c 2.9.6 - Unauthenticated SQL Injection",
    "slug": "woofilter-pro",
    "type": "plugin",
    "affected_version": "[*, 2.9.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-39496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39496",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Rename Media Files \u003c= 1.0.1 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "rename-media-files",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32095",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UsersWP \u003c= 1.2.3.9 - Authenticated (Administrator+) CSV Injection",
    "slug": "userswp",
    "type": "plugin",
    "affected_version": "* - 1.2.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47442",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Page Manager for Elementor \u003c= 2.0.5 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "page-manager-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60167",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MailChimp Forms by MailMunch \u003c= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "mailchimp-forms-by-mailmunch",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29793",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Car Rental System \u003c= 1.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "car",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-15535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-15535",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.2.1 - Authenticated (Contributor+) Cross Site Scripting via shortcode",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4469",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Erident Custom Login and Dashboard \u003c= 3.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "erident-custom-login-and-dashboard",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9322",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "W4 Post List \u003c= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'w4pl[no_items_text]'",
    "slug": "w4-post-list",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27413",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Similarity \u003c= 3.0 - Cross-Site Request Forgery to Plugin Reset",
    "slug": "similarity",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3971",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto \u003c= 8.0.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "tripetto",
    "type": "plugin",
    "affected_version": "* - 8.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22295",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReviewX – Multi-criteria Rating \u0026 Reviews for WooCommerce \u003c= 1.6.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "reviewx",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-26325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26325",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Post Category Notifications \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-post-category-notifications",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23586",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Printcart Web to Print Product Designer for WooCommerce \u003c= 2.4.0 - Unauthenticated SQL Injection",
    "slug": "printcart-integration",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47640",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPAMS \u003c= 44.0 (17-08-2023) - Unauthenticated SQL Injection",
    "slug": "apartment-management",
    "type": "plugin",
    "affected_version": "[*, 44.0 (17-08-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "44.0 (17-08-2023)",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39395",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Flashfader \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "flashfader",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27279",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Shopify Product \u003c= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "smart-shopify-product",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56031",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Realia \u003c= 1.4.0 - Cross-Site Request Forgery to User Email Change",
    "slug": "realia",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4277",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PowerPack Addons for Elementor \u003c= 2.6.1 - Reflected Cross-Site Scripting",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25027",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Netgsm \u003c= 2.9.58 - Missing Authorization",
    "slug": "netgsm",
    "type": "plugin",
    "affected_version": "* - 2.9.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60143",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sirv \u003c= 7.1.2 - Missing Authorization via sirv_disconnect",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "* - 7.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50898",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6589",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HTTP Headers \u003c= 1.18.11 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "http-headers",
    "type": "plugin",
    "affected_version": "* - 1.18.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37874",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Blocks Builder \u003c= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "content-blocks-builder",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22810",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ListingPro - WordPress Directory \u0026 Listing Theme \u003c 2.0.14.5 - Stored Cross-Site Scripting",
    "slug": "listingpro",
    "type": "theme",
    "affected_version": "* - 2.0.14.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19542",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Comment \u003c= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "customcomment",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49889",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.2.2 - Unauthenticated SQL Injection",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6063",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Link View \u003c= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "link-view",
    "type": "plugin",
    "affected_version": "* - 0.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48110",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FULL \u003c= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameter",
    "slug": "full-customer",
    "type": "plugin",
    "affected_version": "* - 3.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6447",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chartify \u003c= 2.7.6 - Reflected Cross-Site Scripting",
    "slug": "chart-builder",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47347",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Athletics \u003c= 1.1.7 - Stored Cross-Site Scripting",
    "slug": "wp-athletics",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1549",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 3.4.0 - Arbitrary File Upload",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "[*, 3.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9341",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.33 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48341",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "新淘客WordPress插件 \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "wp-xintaoke",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23637",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookie Notification Plugin for WordPress \u003c 1.0.9 - SQL Injection",
    "slug": "wp-cookie-user-info",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24858",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation \u003c= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire_contact_form",
    "slug": "get-a-quote-button-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11034",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Host PHP Info \u003c= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure",
    "slug": "host-php-info",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12535",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Oceanic \u003c= 1.0.53 - Cross-Site Request Forgery",
    "slug": "oceanic",
    "type": "theme",
    "affected_version": "* - 1.0.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38765",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "View All Post's Pages \u003c= 0.9.0 - Reflected Cross-Site Scripting",
    "slug": "view-all-posts-pages",
    "type": "plugin",
    "affected_version": "* - 0.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10119",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Checkout Field Editor (Checkout Manager) for WooCommerce \u003c= 2.0.3 - Reflected Cross-Site Scripting via render_review_request_notice",
    "slug": "woo-checkout-field-editor-pro",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8499",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Blocks – Gutenberg Blocks for WordPress \u003c= 2.1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-blocks-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.1.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47368",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DTC Documents \u003c= 1.1.05 - Cross-Site Request Forgery",
    "slug": "dtc-documents",
    "type": "plugin",
    "affected_version": "* - 1.1.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54418",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Security Ninja – Secure Firewall \u0026 Secure Malware Scanner - 5.201 - 5.242 - Authenticated (Administrator+) Arbitrary File Read",
    "slug": "security-ninja",
    "type": "plugin",
    "affected_version": "5.201 - 5.242",
    "from_version": "5.201",
    "from_inclusive": true,
    "to_version": "5.242",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8009",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Social Auto Poster \u003c= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw_auto_poster_update_tweet_template",
    "slug": "social-auto-poster",
    "type": "plugin",
    "affected_version": "* - 5.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6754",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Everest News \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "everest-news",
    "type": "theme",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27421",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Super Cache \u003c= 1.7.1 - Authenticated (Admin+) Remote Code Execution",
    "slug": "wp-super-cache",
    "type": "plugin",
    "affected_version": "[*, 1.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24209",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.4.33 - Administrator Open Redirect",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.4.34)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.34",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24165",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Addons for Elementor \u003c= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 8.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11536",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "Nepali Post Date \u003c= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nepali-post-date",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46480",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BrainCert – HTML5 Virtual Classroom \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "html5-virtual-classroom",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49172",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CubeWP Forms – All-in-One Form Builder \u003c= 1.1.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "cubewp-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-47300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47300",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mapster WP Maps \u003c= 1.5.0 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Options Update",
    "slug": "mapster-wp-maps",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9235",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quick Favicon \u003c= 0.22.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "quick-favicon",
    "type": "plugin",
    "affected_version": "* - 0.22.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.22.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53287",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields: Image Crop Add-on \u003c= 1.4.12 - Improper Authorization",
    "slug": "acf-image-crop-add-on",
    "type": "plugin",
    "affected_version": "* - 1.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22676",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "bbp style pack \u003c= 5.5.5 - Reflected Cross-Site Scripting",
    "slug": "bbp-style-pack",
    "type": "plugin",
    "affected_version": "[*, 5.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-33997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33997",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HDW Player Plugin (Video Player \u0026 Video Gallery) \u003c= 5.0 - Cross-Site Scripting",
    "slug": "hdw-player-video-player-video-gallery",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49178",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "cTabs \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ctabs",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30586",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive 3D Slider \u003c= 1.2 - Authenticated (Admin+) SQL Injection",
    "slug": "morpheus-slider",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24398",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IgniteUp – Coming Soon and Maintenance Mode \u003c= 3.4.0 - Cross-Site Request Forgery",
    "slug": "igniteup",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17237",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Analytics \u003c= 1.7.0 -  Multiple Cross-Site Scripting",
    "slug": "bws-google-analytics",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18556",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Boombox Shortcode \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "boombox-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51827",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Optin Wheel \u003c= 1.4.7 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "wp-optin-wheel",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31824",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xllentech English Islamic Calendar \u003c= 2.6.7 - SQL Injection",
    "slug": "xllentech-english-islamic-calendar",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24341",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS – eLearning and online course solution \u003c= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3994",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Share This Image \u003c= 1.98 - Open Redirect",
    "slug": "share-this-image",
    "type": "plugin",
    "affected_version": "* - 1.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.98",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33930",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Finale Lite – Sales Countdown Timer \u0026 Discount for WooCommerce \u003c= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timer",
    "slug": "finale-woocommerce-sales-countdown-timer-discount",
    "type": "plugin",
    "affected_version": "* - 2.19.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.19.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12589",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by Ays - Responsive Image Gallery \u003c= 4.4.3 - Authenticated Blind SQL Injections",
    "slug": "gallery-photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 4.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24462",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Timetable and Event Schedule \u003c= 2.4.13 - Authenticated (Admin+) PHP Object Injection",
    "slug": "mp-timetable",
    "type": "plugin",
    "affected_version": "* - 2.4.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39630",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sayfa Sayaç \u003c= 2.6 - Unauthenticated SQL Injection",
    "slug": "sayfa-sayac",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-49776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49776",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Restaurant Menu – Food Ordering System – Table Reservation \u003c= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "menu-ordering-reservations",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32579",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-ContactForm \u003c= 1.5.1 - Cross-Site Request Forgery",
    "slug": "wp-contactform",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-0198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0198",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SpiderCalendar \u003c= 1.6.64 - Reflected Cross-Site Scripting",
    "slug": "spider-event-calendar",
    "type": "plugin",
    "affected_version": "* - 1.5.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.65",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0212",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DocsPress \u003c= 2.5.2 - Missing Authorization",
    "slug": "docspress",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49240",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Customers Manager \u003c= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "woocommerce-customers-manager",
    "type": "plugin",
    "affected_version": "* - 31.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "31.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13343",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Developer Tools Blocker \u003c= 3.2.1 - Cross-Site Request Forgery",
    "slug": "swiftninjapro-inspect-element-console-blocker",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58818",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Api2Cart Bridge Connector \u003c= 1.1.0 - Arbitrary File Upload",
    "slug": "api2cart-bridge-connector",
    "type": "plugin",
    "affected_version": "1.1.0",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-42698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42698",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multifox \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "multifox",
    "type": "theme",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22769",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Page Visit Counter \u003c= 6.1.5 - Subscriber+ Blind SQL injection",
    "slug": "advanced-page-visit-counter",
    "type": "plugin",
    "affected_version": "[*, 6.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24957",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Passster \u003c= 3.5.5.8 - Missing Authentication leading to Sensitive Information Disclosure (Private Post Leakage)",
    "slug": "content-protector",
    "type": "plugin",
    "affected_version": "* - 3.5.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24881",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NotifyVisitors \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "notifyvisitors-lead-form",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27426",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TimThumb \u003c= 1.33 - Remote File Download",
    "slug": "category-list-portfolio-page",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2011-4106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4106",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TimThumb \u003c= 1.33 - Remote File Download",
    "slug": "timthumb",
    "type": "plugin",
    "affected_version": "[*, 2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2011-4106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4106",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TimThumb \u003c= 1.33 - Remote File Download",
    "slug": "simple-post-thumbnails",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2011-4106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4106",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sparkle Demo Importer \u003c= 1.4.7 - Missing Authorization to Authorized(Subscriber+) Post/Pages/Attachements Deletion and Demo Data Import",
    "slug": "sparkle-demo-importer",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6120",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Image Slider by NextCode \u003c= 1.1.2 - Cross-Site Request Forgery to Slide Deletion",
    "slug": "baslider",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29439",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "oik \u003c= 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "oik",
    "type": "plugin",
    "affected_version": "* - 4.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2256",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KI Live Video Conferences \u003c= 5.5.15 - Missing Authorization",
    "slug": "ki-live-video-conferences",
    "type": "plugin",
    "affected_version": "* - 5.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23971",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor \u003c= 4.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "front-editor",
    "type": "plugin",
    "affected_version": "* - 4.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1982",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Private Site \u003c= 3.0.14 - Improper Access Control to Sensitive Information Exposure via REST API",
    "slug": "jonradio-private-site",
    "type": "plugin",
    "affected_version": "* - 3.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0978",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Timetable and Event Schedule by MotoPress \u003c= 2.3.18 - Author+ Stored Cross-Site Scripting",
    "slug": "mp-timetable",
    "type": "plugin",
    "affected_version": "* - 2.3.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24724",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Staff List \u003c= 2.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "simple-staff-list",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28790",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Penci Portfolio \u003c= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "penci-portfolio",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59586",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Assign Linked Products For WooCommerce \u003c= 2.1 - Missing Authorization",
    "slug": "wc-bulk-assign-linked-products",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46489",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hover Effects – easily create any hover effect \u003c= 2.1 - Authenticated Local File Inclusion",
    "slug": "hover-effects",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29447",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EmbedPress \u003c= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 4.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43936",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Apptivo Business Site CRM \u003c= 3.0.12 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "apptivo-business-site",
    "type": "plugin",
    "affected_version": "* - 3.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44582",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PressMart - Modern Elementor WooCommerce WordPress Theme \u003c= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "pressmart",
    "type": "theme",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13797",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "AtomChat \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "atomchat",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31532",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nokri – Job Board WordPress Theme \u003c= 1.6.2 - Unauthenticated Arbitrary Password Change",
    "slug": "nokri",
    "type": "theme",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12824",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Blocks \u003c= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-block-editor-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53202",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Atelier Create CV \u003c= 1.1.5 - Cross-Site Request Forgery to Settings Update",
    "slug": "atelier-create-cv",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49439",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Hover Effects Ultimate \u003c= 9.7.3 - Authenticated Stored Cross-Site Scripting via Video Link",
    "slug": "image-hover-effects-ultimate",
    "type": "plugin",
    "affected_version": "* - 9.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2936",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.8.32 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13124",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One \u003c= 2.1.2 - Missing Authorization",
    "slug": "ai-auto-tool",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52383",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1508",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Login by Auth0 Plugin \u003c= 3.11.3 - Stored Cross-Site Scripting",
    "slug": "auth0",
    "type": "plugin",
    "affected_version": "* - 3.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-5392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5392",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced iFrame \u003c= 2021.9 Reflected Cross-Site Scripting",
    "slug": "advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 2021.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2021.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24953",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "postMash – custom post order \u003c= 1.2.0 - Unauthenticated SQL Injection",
    "slug": "postmash",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-25927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25927",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mailster \u003c= 1.8.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53737",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magazine Edge \u003c= 1.13 - Authenticated (Subscriber+) Arbitrary Plugin Activation",
    "slug": "magazine-edge",
    "type": "theme",
    "affected_version": "* - 1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25068",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "IBPS Online Exam \u003c= 1.0 - Cross-Site Scripting",
    "slug": "examapp",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18601",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video \u0026 Photo Gallery for Ultimate Member \u003c= 1.1.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "gallery-for-ultimate-member",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32121",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Marmoset Viewer \u003c 1.9.3 - Reflected Cross-Site Scripting",
    "slug": "marmoset-viewer",
    "type": "plugin",
    "affected_version": "[*, 1.9.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24495",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Multistore Locator \u003c= 2.5.2 - Cross-Site Request Forgery",
    "slug": "wp-multi-store-locator",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31888",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lana Email Logger \u003c= 1.0.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject",
    "slug": "lana-email-logger",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3166",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conversational Forms for ChatBot \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "conversational-forms",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34380",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eRocket \u003c= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "erocket",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28174",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PayPal Payments \u003c= 2.0.4 - Cross-Site Request Forgery",
    "slug": "woocommerce-paypal-payments",
    "type": "plugin",
    "affected_version": "[*, 2.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-35917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35917",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CDI \u003c= 5.5.3 - Authenticated (Shop Manager+) Arbitrary File Upload",
    "slug": "collect-and-deliver-interface-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52398",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Coupon Affiliates – Affiliate Plugin for WooCommerce \u003c= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter",
    "slug": "woo-coupon-usage",
    "type": "plugin",
    "affected_version": "* - 6.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3598",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.986 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.986",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.986",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8482",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Accessibility Helper (WAH) \u003c= 0.6.2.4 - Missing Authorization via AJAX action",
    "slug": "wp-accessibility-helper",
    "type": "plugin",
    "affected_version": "* - 0.6.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41869",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "If-So Dynamic Content Personalization \u003c= 1.8.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "if-so",
    "type": "plugin",
    "affected_version": "* - 1.8.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5440",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.4 - Authenticated (Shop manager+) Stored Cross-Site Scripting via Plugin Options",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24834",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post SMTP \u003c= 3.0.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0521",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "10WebMapBuilder \u003c= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change",
    "slug": "wd-google-maps",
    "type": "plugin",
    "affected_version": "[*, 1.0.64)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.64",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36853",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support Board \u003c= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key",
    "slug": "supportboard",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4855",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themify Shortcodes \u003c= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode",
    "slug": "themify-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spreadsheet Integration \u003c= 3.8.2 - Cross-Site Request Forgery to Arbitrary Post Publish",
    "slug": "wpgsi",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1463",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Frontend File Manager Plugin \u003c 3.6 - Arbitrary File Upload",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "[*, 3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-5324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5324",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "qTranslate \u003c= 2.5.39 - Cross-Site Request Forgery",
    "slug": "qtranslate",
    "type": "plugin",
    "affected_version": "* - 2.5.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.39",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-3251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3251",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "iframe popup \u003c= 3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "iframe-popup",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24394",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.18",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.16",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.15",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.12",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.8",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.7",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.6",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.2",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.18",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.15",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Media Metadata",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.3",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Category Tree \u003c= 2.5 - Missing Authorization",
    "slug": "product-category-tree",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rescue Shortcodes \u003c= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar Shortcode",
    "slug": "rescue-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11199",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magic Fields 1 \u003c= 1.7.1 - Cross-Site Scripting via custom-write-panel-id Parameter",
    "slug": "magic-fields",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18609",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shopping Cart \u0026 eCommerce Store \u003c= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-34645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34645",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MJ Update History \u003c= 1.0.4 - Missing Authorization",
    "slug": "mj-update-history",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35671",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nest Addons \u003c= 1.6.3 - Unauthenticated SQL Injection",
    "slug": "nest-addons",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54720",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CM Tooltip Glossary \u003c= 3.9.20 - Authenticated Stored Cross-Site Scripting",
    "slug": "enhanced-tooltipglossary",
    "type": "plugin",
    "affected_version": "[*, 3.9.21)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.21",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24678",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP VR \u003c= 8.5.5 - Missing Authorization",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49680",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Profile Meta Manager \u003c= 1.02 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "user-profile-meta",
    "type": "plugin",
    "affected_version": "* - 1.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48340",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple File List \u003c= 4.2.7 - Arbitrary File Deletion",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "* - 4.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-12832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12832",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Ibtana – WordPress Website Builder \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ibtana-visual-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6684",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPLMS \u003c= 1.9.9 - Missing Authorization to Unauthenticated User Token Generation",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56044",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Page Duplicator \u003c= 0.1.1 - Missing Authorization to Unauthenticated Post/Page Duplication",
    "slug": "wp-page-duplicator",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1368",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DeBounce Email Validator \u003c= 5.6.5 - Reflected Cross-Site Scripting",
    "slug": "debounce-io-email-validator",
    "type": "plugin",
    "affected_version": "* - 5.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11463",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lazyest Gallery \u003c 1.1.21 - Stored Cross-Site Scripting",
    "slug": "lazyest-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.1.21)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.21",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-2333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2333",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Streamit \u003c= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "streamit",
    "type": "theme",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2525",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NewStatPress \u003c= 0.9.8 - Authenticated Cross-Site Scripting",
    "slug": "newstatpress",
    "type": "plugin",
    "affected_version": "* - 0.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-4063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4063",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration \u0026 Membership – Custom Registration Form, Login Form, and User Profile \u003c= 4.0.4 - Reflected Cross-Site Scripting",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1511",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HashThemes Demo Importer \u003c= 1.1.1 - Missing Authorization to Database Wipe",
    "slug": "hashthemes-demo-importer",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39333",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.17.4 - Missing Authorization",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.17.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50500",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "License Manager for WooCommerce \u003c= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure",
    "slug": "license-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1639",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Comment-Emailer \u003c= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "comment-emailer",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23627",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spark GF Failed Submissions \u003c= 1.3.5 - Reflected Cross-Site Scripting",
    "slug": "spark-gf-failed-submissions",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32670",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newspack Blocks \u003c= 3.0.8 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "newspack-blocks",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37424",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Media Library Assistant \u003c= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2475",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-in-One Video Gallery \u003c= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image",
    "slug": "all-in-one-video-gallery",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4033",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Sharing Plugin – Social Warfare \u003c= 4.4.5.1 - Cross-Site Request Forgery",
    "slug": "social-warfare",
    "type": "plugin",
    "affected_version": "* - 4.4.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34825",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Clasify Classified Listing \u003c= 1.0.7 - Reflected Cross-Site Scripting",
    "slug": "clasify-classified-listing",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12725",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadcast \u003c= 51.01 - Reflected Cross-Site Scripting",
    "slug": "threewp-broadcast",
    "type": "plugin",
    "affected_version": "* - 51.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "51.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11379",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 8.2.2 - Cross-Site Request Forgery",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "* - 8.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52222",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.24.7 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.24.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5852",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Andrea Pernici News Sitemap for Google \u003c= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-news-sitemap",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36912",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "hotel-listing",
    "type": "plugin",
    "affected_version": "[*, 1.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "directory-pro",
    "type": "plugin",
    "affected_version": "[*, 1.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "photographer-directory",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "lawyer-directory",
    "type": "plugin",
    "affected_version": "[*, 1.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "real-estate-pro",
    "type": "plugin",
    "affected_version": "[*, 1.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "institutions-directory",
    "type": "plugin",
    "affected_version": "[*, 1.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "fitness-trainer",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "doctor-listing",
    "type": "plugin",
    "affected_version": "[*, 1.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wp-membership",
    "type": "plugin",
    "affected_version": "[*, 1.5.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "producer-retailer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "final-user-wp-frontend-user-profiles",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Greenshift Query and Meta Addon \u003c 3.9.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "greenshiftquery",
    "type": "plugin",
    "affected_version": "[*, 3.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2024-43942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43942",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "RSS Manager \u003c= 0.06 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "rss-manager",
    "type": "plugin",
    "affected_version": "* - 0.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39418",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Featured Image (Auto Post Thumbnail) \u003c= 4.0.0 - Authenticated (Author+) Server-Side Request Forgery",
    "slug": "auto-post-thumbnail",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7073",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WCFM Membership \u003c= 2.9.10 - Cross-Site Request Forgery",
    "slug": "wc-multivendor-membership",
    "type": "plugin",
    "affected_version": "* - 2.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4941",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WPGraphQL \u003c= 1.14.5 - Authenticated (Editor+) Server-Side Request Forgery",
    "slug": "wp-graphql",
    "type": "plugin",
    "affected_version": "* - 1.14.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23684",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp Ultimate Review \u003c= 2.3.0 - Cross-Site Request Forgery via wur_settings_view",
    "slug": "wp-ultimate-review",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46085",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bulk Block Converter \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "bulk-block-converter",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32542",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Post Styling \u003c= 1.3.0 - Cross-Site Request Forgery",
    "slug": "wp-post-styling",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1845",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Viet Affiliate Link \u003c=1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "viet-affiliate-link",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34422",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aajoda Testimonials \u003c= 2.2.1 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "aajoda-testimonials",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2178",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "City Store \u003c= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "city-store",
    "type": "theme",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26737",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ERP \u003c= 1.12.9 - Authenticated (AccountingManager+) SQL Injection",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.12.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0956",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Live Chat Support \u003c= 7.0.06 - Cross-Site Scripting",
    "slug": "wp-live-chat-support",
    "type": "plugin",
    "affected_version": "* - 7.0.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-2187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2187",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Plus \u003c= 3.2.0 - Missing Authorization",
    "slug": "responsive-add-ons",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48335",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPML \u003c 4.3.7 - Cross-Site Request Forgery Bypass",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "[*, 4.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-10568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10568",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Visual Art | Gallery WordPress Theme \u003c= 2.4 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "visual-arts",
    "type": "theme",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31422",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sogrid \u003c= 1.5.2 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "sogrid",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54352",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS \u003c= 2.6.0 - Missing Authorization",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1133",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Coming Soon Chop Chop \u003c= 2.2.4 - Reflected Cross-Site Scripting",
    "slug": "cc-coming-soon",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37893",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Subscriptions \u003c= 5.1.2 - Missing Authorization to Insecure Direct Object Reference",
    "slug": "woocommerce-subscriptions",
    "type": "plugin",
    "affected_version": "* - 5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35914",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ToTop Link \u003c= 1.7.1 - Unauthenticated PHP Object Injection",
    "slug": "totop-link",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24857",
    "auth_type": "Unauth",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "HT Builder – WordPress Theme Builder for Elementor \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ht-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51682",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Feed Manager \u003c= 7.3.15 - Authenticated (Admin+) Directory Traversal",
    "slug": "best-woocommerce-feed",
    "type": "plugin",
    "affected_version": "* - 7.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.15",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-52144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52144",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Broadstreet \u003c= 1.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via zone Parameter",
    "slug": "broadstreet",
    "type": "plugin",
    "affected_version": "* - 1.51.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.51.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11825",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Open Redirect via wp_validate_redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.2",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2221",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Open Redirect via wp_validate_redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.1",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2221",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Open Redirect via wp_validate_redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-2221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2221",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Open Redirect via wp_validate_redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.12",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2221",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Open Redirect via wp_validate_redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.12",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2221",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Open Redirect via wp_validate_redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.9",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2221",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Open Redirect via wp_validate_redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.9",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2221",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Open Redirect via wp_validate_redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.6",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2221",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Open Redirect via wp_validate_redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.10",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2221",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Simple Like Page Plugin \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-facebook-plugin",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4888",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Christmas Greetings \u003c= 1.2.5 - Reflected Cross-Site Scripting",
    "slug": "christmas-greetings",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2116",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP REST Cache \u003c= 2025.1.0 - Unauthenticated Local File Inclusion",
    "slug": "wp-rest-cache",
    "type": "plugin",
    "affected_version": "* - 2025.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2025.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52716",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JS Job Manager \u003c= 2.0.0 - Cross-Site Request Forgery via multiple functions",
    "slug": "js-jobs",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31087",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Mail Bank - #1 Mail SMTP Plugin for WordPress \u003c= 4.0.14 - Missing Authorization",
    "slug": "wp-mail-bank",
    "type": "plugin",
    "affected_version": "* - 4.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48332",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Accio | Responsive Onepage Parallax Site Template \u003c 1.1.1 - Sensitive Information Disclosure",
    "slug": "accio-one-page",
    "type": "theme",
    "affected_version": "[*, 1.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9485",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "YITH WooCommerce Ajax Product Filter \u003c= 5.1.0 - Reflected Cross-Site Scripting",
    "slug": "yith-woocommerce-ajax-navigation",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37943",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WishSuite \u003c= 1.4.4 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wishsuite",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30820",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CubeWP Forms – All-in-One Form Builder \u003c= 1.1.5 - Missing Authorization",
    "slug": "cubewp-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51651",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoices \u003c= 4.2.1 - Authenticated(Shop Manager+) Arbitrary Options Update via JSON Import",
    "slug": "print-invoices-packing-slip-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51546",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "School Management \u003c= 93.0.0 - Authenticated (Student+) Local File Inclusion",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 93.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "93.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47572",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Hotjar \u003c= 0.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-hotjar",
    "type": "plugin",
    "affected_version": "* - 0.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30600",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SlickQuiz \u003c= 1.3.7.1 - Stored Cross-Site Scripting",
    "slug": "slickquiz",
    "type": "plugin",
    "affected_version": "* - 1.3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-12517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12517",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rescue Shortcodes \u003c= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rescue-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41728",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Menubar \u003c= 5.7.2 - Reflected Cross-Site Scripting",
    "slug": "menubar",
    "type": "plugin",
    "affected_version": "* - 5.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1152",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flatsome \u003c= 3.17.5 - Unauthenticated PHP Object Injection",
    "slug": "flatsome",
    "type": "theme",
    "affected_version": "* - 3.17.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.17.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-40555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40555",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VerticalResponse Newsletter Widget \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "vertical-response-newsletter-widget",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4172",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack - Addon for Elementor Page Builder WordPress Plugin \u003c= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL",
    "slug": "bdthemes-element-pack",
    "type": "plugin",
    "affected_version": "* - 7.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2455",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow \u003c= 2.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "slideshow-jquery-image-gallery",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1299",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Alobaidi Captcha \u003c= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings",
    "slug": "alobaidi-captcha",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8080",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Membership \u0026 Content Restriction – Paid Member Subscriptions \u003c= 2.4.1 - SQL Injection",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24728",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VikRentCar Car Rental Management System \u003c= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "vikrentcar",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5322",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CJ Change Howdy \u003c= 3.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cj-change-howdy",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49223",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Skins Contact Form 7 \u003c= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update and Skin Creation",
    "slug": "custom-skins-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12341",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PowerPack Pro for Elementor \u003c= 2.9.23 - Reflected Cross-Site Scripting",
    "slug": "powerpack-elements",
    "type": "plugin",
    "affected_version": "* - 2.9.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49739",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prime Slider – Addons For Elementor \u003c= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30186",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ELEX WordPress HelpDesk \u0026 Customer Ticketing System \u003c= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "elex-helpdesk-customer-support-ticket-system",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12171",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woostify \u003c= 2.4.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "woostify",
    "type": "theme",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60101",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteOrigin Widgets Bundle \u003c= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget",
    "slug": "so-widgets-bundle",
    "type": "plugin",
    "affected_version": "* - 1.62.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.62.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5901",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Hour Booking \u003c= 1.3.71 - Missing Authorization",
    "slug": "appointment-hour-booking",
    "type": "plugin",
    "affected_version": "* - 1.3.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41692",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dean's Permalinks Migration \u003c= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "permalinks-migration-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-0508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0508",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hover Effects Css3 \u003c= 4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "image-hover-effects-css3",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3601",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Debugging \u003c= 2.10.2 - Unauthenticated Plugin Settings Update",
    "slug": "wp-debugging",
    "type": "plugin",
    "affected_version": "* - 2.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24779",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin \u003c= 3.1.0 - Cross-Site Request Forgery",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "[*, 3.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-2340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2340",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Checker | Finder \u003c= 2.4.2 - Missing Authorization via moblc_auth_save_settings",
    "slug": "broken-link-finder",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46082",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery \u003c= 3.59.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Gallery",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.59.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.59.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5442",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blossom Recipe Maker \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blossom-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37338",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FluentBoards \u003c= 1.47 - Unauthenticated PHP Object Injection",
    "slug": "fluent-boards",
    "type": "plugin",
    "affected_version": "* - 1.47",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.47",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39551",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YOP Poll \u003c= 6.3.0 - Author+ Stored Cross-Site Scripting via Preview Module",
    "slug": "yop-poll",
    "type": "plugin",
    "affected_version": "* - 6.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24833",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Restaurant Listings \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-restaurant-listings",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11830",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend File Manager \u003c= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "* - 21.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7306",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Estatik \u003c= 4.1.9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "estatik",
    "type": "plugin",
    "affected_version": "* - 4.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26905",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ULTIMATE VIDEO GALLERY \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "ultimate-gallery",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SAML Single Sign On – SAML SSO Login \u003c= 4.8.83 - Cross-Site Scripting",
    "slug": "miniorange-saml-20-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 4.8.83",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.83",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-6850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-6850",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Coder – Code Snippets + HTML, CSS, JS and PHP Injection \u003c= 3.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-coder",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24699",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Matix Popup Builder \u003c= 1.0.0 - Unauthenticated Arbitrary Options Update",
    "slug": "medma-matix",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52382",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Private Content Plus \u003c= 1.31 - Unauthenticated Settings Change",
    "slug": "wp-private-content-plus",
    "type": "plugin",
    "affected_version": "* - 1.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15816",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Kish Guest Posting \u003c= 1.1 - Arbitrary File Upload",
    "slug": "kish-guest-posting",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-1125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-1125",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MStore API \u003c= 3.9.8 - Unauthenticated Privilege Escalation",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-3076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3076",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CPO Content Types \u003c= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cpo-content-types",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25451",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MooWoodle – WordPress \u0026 Moodle LMS Integration Bridge \u003c= 3.2.4 - Unauthenticated Sensitive Information Exposure",
    "slug": "moowoodle",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24556",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Visual Text Editor \u003c= 1.2.1 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "visual-text-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28893",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ReDi Restaurant Reservation \u003c= 24.0128 - Cross-Site Request Forgery via redi_restaurant_admin_options_page()",
    "slug": "redi-restaurant-reservation",
    "type": "plugin",
    "affected_version": "* - 24.0128",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.0128",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31385",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Testimonials \u003c= 3.0.4 - Cross-Site Scripting",
    "slug": "easy-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-12131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-12131",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.14.1.2 - Cross-Site Scripting",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.14.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15327",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks for Gutenberg \u003c= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31306",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "duoFAQ - Responsive, Flat, Simple FAQ  \u003c= 1.4.8 - Reflected Cross-Site Scripting",
    "slug": "duofaq-responsive-flat-simple-faq",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39319",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CampTix Event Ticketing \u003c 1.5 - Cross-Site Scripting",
    "slug": "camptix",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10763",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prisna GWT – Google Website Translator \u003c= 1.4.13 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "google-website-translator",
    "type": "plugin",
    "affected_version": "* - 1.4.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12680",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ACF Photo Gallery Field \u003c= 1.9 - Authenticated (Subscriber+) Arbitrary Usermeta Update",
    "slug": "navz-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3957",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Audio Player \u003c= 2.0.4.5 - Cross-Site Scripting via playerID Parameter",
    "slug": "audio-player",
    "type": "plugin",
    "affected_version": "[*, 2.0.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-1464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1464",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fancy Product Designer \u003c= 6.1.7 - Reflected Cross-Site Scripting",
    "slug": "fancy-product-designer",
    "type": "plugin",
    "affected_version": "* - 6.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0905",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Team Manager \u003c= 1.3.2 - SQL Injection",
    "slug": "easy-team-manager",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002023",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AnyComment \u003c= 0.0.32 - Cross-Site Scripting",
    "slug": "anycomment",
    "type": "plugin",
    "affected_version": "* - 0.0.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-21001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-21001",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDQ CSV \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "pdq-csv",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31221",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real3D Flipbook \u003c= 1.0.0 - Directory Traversal",
    "slug": "real3d-flipbook",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-10965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10965",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Live News \u003c= 1.06 - Cross-Site Request Forgery",
    "slug": "live-news-lite",
    "type": "plugin",
    "affected_version": "* - 1.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41669",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stockists Manager for Woocommerce \u003c= 1.0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "stockists-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2518",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "polka dots \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "polka-dots",
    "type": "theme",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22789",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "News Kit Elementor Addons \u003c= 1.3.4 - Missing Authorization",
    "slug": "news-kit-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54037",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.6.25 - Missing Authorization to Contributor+ Form Submission Export",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38386",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Slider by 10Web – Responsive Image Slider \u003c= 1.2.57 - Authenticated (Contributor+) SQL Injection via id Parameter",
    "slug": "slider-wd",
    "type": "plugin",
    "affected_version": "* - 1.2.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.57",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7150",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Image Sitemap \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "advanced-image-sitemap",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1216",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Tiles \u003c= 1.1.2 - Authenticated(Subscriber+) Sensitive Information Exposure",
    "slug": "wp-tiles",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1426",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4459",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eStore \u003c= 8.5.5 - Cross-Site Request Forgery to Settings Reset",
    "slug": "wp-cart-for-digital-products",
    "type": "plugin",
    "affected_version": "* - 8.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6136",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LeaderBoard Plugin \u003c= 1.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "leaderboard-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54426",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Multiple Marker \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "add-multiple-marker",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45080",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.6 - Cross-Site Request Forgery",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36855",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventON \u003c= 4.4.0 - Reflected Cross-Site Scripting",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7200",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Title Counter \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "post-title-counter",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38326",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Remove Schema \u003c= 1.5 - Cross-Site Request Forgery Bypass",
    "slug": "remove-schema",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4403",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "podPress \u003c= 8.8.10.17 - Cross-Site Scripting via playerID",
    "slug": "podpress",
    "type": "plugin",
    "affected_version": "* - 8.8.10.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.10.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2714",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cards for Beaver Builder \u003c= 1.1.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "bb-bootstrap-cards",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37278",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bSuite \u003c= 5 alpha 2 - Multiple Cross-Site Scripting",
    "slug": "bsuite",
    "type": "plugin",
    "affected_version": "* - 5 alpha 2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5 alpha 2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-4955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4955",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woo Custom Emails \u003c= 2.2 - Reflected Cross-Site Scripting via wcemails_edit",
    "slug": "woo-custom-emails",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4315",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Landing Page Cat \u003c= 1.7.4 - Missing Authorization",
    "slug": "landing-page-cat",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49686",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products \u0026 More \u003c= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "woolementor",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4564",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Access Manager \u003c= 6.9.20 - Reflected Cross-Site Scripting",
    "slug": "advanced-access-manager",
    "type": "plugin",
    "affected_version": "* - 6.9.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29127",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Contact Form Solution \u003c= 1.6 - Stored Cross-Site Scripting",
    "slug": "easy-contact-form-solution",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-7240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7240",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fusion Builder \u003c= 3.11.1 - Cross-Site Request Forgery",
    "slug": "fusion-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39311",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.5 - Unauthenticated SQL Injection via user_id",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4156",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.5 - Unauthenticated SQL Injection via user_id",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4156",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TinyCode \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tinycode",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51902",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Ads for Clickbank Products \u003c 1.7 - Stored Cross-Site Scripting",
    "slug": "affiliate-ads-builder-for-clickbank-products",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18011",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ClickFunnels \u003c= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "clickfunnels",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4782",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.6.8.2 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39642",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Digital Publications by Supsystic \u003c= 1.7.7 - Missing Authorization",
    "slug": "digital-publications-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33910",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.9.4 - Reflected Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5951",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Raygun4WP \u003c= 1.8.0 - Reflected Cross-Site Scripting",
    "slug": "raygun4wp",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9288",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zita \u003c= 1.6.5 - Unauthenticated Local File Inclusion",
    "slug": "zita",
    "type": "theme",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52816",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.22.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.22.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2331",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Sassy Social Share \u003c= 3.3.44 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sassy-social-share",
    "type": "plugin",
    "affected_version": "* - 3.3.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4451",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.23.2 - Unauthenticated SQL Injection",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.23.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.23.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-0224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0224",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Software License Manager \u003c= 4.4.7 - Reflected Cross-Site Scripting",
    "slug": "software-license-manager",
    "type": "plugin",
    "affected_version": "[*, 4.4.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24560",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Manager Pro \u003c= 8.3.7 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-file-manager-pro",
    "type": "plugin",
    "affected_version": "* - 8.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7559",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Enhanced Blocks \u0026#8211; Page Builder Blocks for Gutenberg \u003c= 1.4.1 - Missing Authorization",
    "slug": "enhanced-blocks",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50034",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP SoundSystem \u003c= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsstm-track Shortcode",
    "slug": "wp-soundsystem",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6258",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by Supsystic \u003c= 1.15.5 - Cross-Site Request Forgery to Plugin Settings Change",
    "slug": "gallery-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.15.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36891",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "AcyMailing SMTP Newsletter \u003c= 8.6.2 - Reflected Cross-Site Scripting",
    "slug": "acymailing",
    "type": "plugin",
    "affected_version": "* - 8.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41867",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SpamReferrerBlock \u003c= 2.22 - Cross-Site Request Forgery",
    "slug": "spamreferrerblock",
    "type": "plugin",
    "affected_version": "* - 2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34371",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Social Login and Register \u003c= 7.6.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion",
    "slug": "miniorange-login-openid",
    "type": "plugin",
    "affected_version": "* - 7.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25455",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Booking Calendar \u003c= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9306",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smartarget – Get 40% more sales, improve user engagement with 25+ free apps. \u003c= 1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "smartarget-contact-us",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22650",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cerber \u003c 8.9.3 - Access Bypass Control",
    "slug": "wp-cerber",
    "type": "plugin",
    "affected_version": "[*, 8.9.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.9.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-37598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-37598",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Tutor LMS – eLearning and online course solution \u003c= 2.7.1 -Authenticated (Administrator+) SQL Injection",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4902",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WSM Downloader \u003c- 1.4.0 - Domain Bypass",
    "slug": "wsm-downloader",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2367",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.2.8.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6557",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress GDPR \u0026 CCPA \u003c 1.9.26 - Reflected Cross-Site Scripting",
    "slug": "wordpress-gdpr",
    "type": "plugin",
    "affected_version": "* - 1.9.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24814",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flowerplayer Video Player \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "flowplayer6-video-player",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3984",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SureCart \u003c= 2.29.3 - Reflected Cross-Site Scripting",
    "slug": "surecart",
    "type": "plugin",
    "affected_version": "* - 2.29.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.29.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43970",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Syndication Toolkit Reader \u003c= 1.5 - Reflected Cross-Site Scripting",
    "slug": "content-syndication-toolkit-reader",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51696",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5757",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.12 - Cross-Site Request Forgery in save_admin_widgets function",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25707",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jupiterx Core \u003c= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 4.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3888",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Job Colors for WP Job Manager \u003c= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-job-manager-colors",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31031",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Keap Official Opt-in Forms \u003c= 2.0.1 - Unauthenticated Limited Local File Inclusion",
    "slug": "infusionsoft-official-opt-in-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13725",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core 5.8 beta - Block Editor Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 beta 1",
    "from_version": "5.8 beta 1",
    "from_inclusive": true,
    "to_version": "5.8 beta 1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39203",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "WP Live Chat Support Pro \u003c= 8.0.26 - Arbitrary File Upload",
    "slug": "wp-live-chat-support-pro",
    "type": "plugin",
    "affected_version": "* - 8.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-11185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11185",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Members \u003c= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4610",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.1.5 - Missing Authorization",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50884",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "wc-pre-order",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26553",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShowTime Slideshow \u003c= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "showtime-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31444",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ultimate CSV Importer \u003c= 7.9.8 - Authenticated (Author+) Remote Code Execution",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 7.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4142",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Download Plugins and Themes from Dashboard \u003c= 1.8.5 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "download-plugins-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35162",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Products \u0026 Order Export for WooCommerce \u003c= 2.0.7 - Missing Authorization",
    "slug": "export-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31276",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Signup Page \u003c= 1.0 - Unauthenticated Arbitrary Options Update",
    "slug": "signup-page",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50475",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ocean Extra \u003c= 1.9.4 - Reflected Cross-Site Scripting",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "[*, 1.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25104",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.1.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-1230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1230",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crossword Compiler Puzzles \u003c= 5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "crossword-compiler-puzzles",
    "type": "plugin",
    "affected_version": "* - 5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46493",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Delete User Accounts \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-delete-user-accounts",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26906",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rentsyst \u003c= 2.0.100 - Reflected Cross-Site Scripting",
    "slug": "rentsyst",
    "type": "plugin",
    "affected_version": "* - 2.0.100",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.100",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48152",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AMP for WP \u003c= 1.0.77.32 - Authenticated Stored Cross-Site Scripting",
    "slug": "accelerated-mobile-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.77.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.77.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-23209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-23209",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Lightbox \u0026 Gallery \u003c= 2.5.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9710",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Wall \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "image-wall",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48156",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeoDirectory \u003c= 2.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.2.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4775",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anber Elementor Addon \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel button link",
    "slug": "anber-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7440",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Copy Or Move Comments \u003c= 5.0.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "copy-or-move-comments",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28748",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DigiTimber cPanel Integration \u003c= 1.4.6 - Cross-Site Request Forgery to Stored Cross-site Scripting",
    "slug": "digitimber-cpanel-integration",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22690",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username'",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.112",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.112",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6169",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Login URL \u003c= 1.0.2 - Missing Authorization",
    "slug": "custom-login-url",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58969",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WS Form LITE and WS Form Pro \u003c 1.8.176 - Stored Cross-Site Scripting",
    "slug": "ws-form",
    "type": "plugin",
    "affected_version": "[*, 1.8.176)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.176",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-23988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23988",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WS Form LITE and WS Form Pro \u003c 1.8.176 - Stored Cross-Site Scripting",
    "slug": "ws-form-pro",
    "type": "plugin",
    "affected_version": "[*, 1.8.176)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.176",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-23988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23988",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ChaosTheory \u003c= 1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "chaostheory",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34766",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Motors – Car Dealer, Classifieds \u0026 Listing \u003c= 1.4.0 - Stored Cross-Site Scripting",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17229",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Media Follow Buttons Bar \u003c= 4.73 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "social-media-buttons-toolbar",
    "type": "plugin",
    "affected_version": "* - 4.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36839",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Place Order Without Payment \u003c= 2.6.7 - Unauthenticated Local File Inclusion",
    "slug": "wc-place-order-without-payment",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26933",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stock Message \u003c= 1.1.0 - Cross-Site Request Forgery",
    "slug": "stock-message",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58267",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "History Log by click5 \u003c= 1.0.12 - Authenticated(Administrator+) Time-Based Blind SQL Injection",
    "slug": "history-log-by-click5",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5082",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Missing Authorization via ajax_delete_folder",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0717",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress \u0026 WooCommerce \u003c= 5.7.43 - Authenticated (Admin+) SQL Injection",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12311",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Fast Image Adder \u003c 1.2 - Arbitrary File Upload",
    "slug": "fast-image-adder",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-1000001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000001",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \u003c= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution",
    "slug": "ap-plugin-scripteo",
    "type": "plugin",
    "affected_version": "* - 4.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.89",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4689",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Otter - Gutenberg Block \u003c= 3.1.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-55715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-55715",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ConvertCalculator for WordPress \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "convertcalculator",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56302",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MDTF – Meta Data and Taxonomies Filter \u003c= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8623",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "simpleSAMLphp Authentication \u003c= 0.7.0 - Reflected Cross-Site Scripting",
    "slug": "simplesamlphp-authentication",
    "type": "plugin",
    "affected_version": "* - 0.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XStore | Multipurpose WooCommerce Theme \u003c= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "xstore",
    "type": "theme",
    "affected_version": "* - 9.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-11746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11746",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Templately \u003c= 3.1.5 - Missing Authorization",
    "slug": "templately",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50423",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.3, 5.3.7)",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29447",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.4, 5.4.5)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29447",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.5, 5.5.4)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29447",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.6, 5.6.3)",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29447",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.9, 4.9.17)",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.17",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29447",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.2, 5.2.10)",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29447",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.7, 5.7.1)",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29447",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.7, 4.7.20)",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.20",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29447",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.8, 4.8.16)",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29447",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.0, 5.0.12)",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.12",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29447",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.7.1 - XXE Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.1, 5.1.9)",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-29447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29447",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin \u003c= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion",
    "slug": "timetics",
    "type": "plugin",
    "affected_version": "* - 1.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11275",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MoveTo \u003c= 6.2 - Unauthenticated Directory Traversal to Arbitrary File Deletion",
    "slug": "moveto",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-25911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25911",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gravel \u003c= 1.6 - Reflected Cross-Site Scripting",
    "slug": "gravel",
    "type": "theme",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31418",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments – wpDiscuz \u003c= 7.6.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35681",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CF7 Google Sheets Connector \u003c= 5.0.1 - Reflected Cross-Site Scripting via 'code'",
    "slug": "cf7-google-sheets-connector-pro",
    "type": "plugin",
    "affected_version": "[*, 2.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CF7 Google Sheets Connector \u003c= 5.0.1 - Reflected Cross-Site Scripting via 'code'",
    "slug": "cf7-google-sheets-connector",
    "type": "plugin",
    "affected_version": "* - 5.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crowdsignal Dashboard – Polls, Surveys \u0026 more \u003c= 3.1.3 - Cross-Site Request Forgery",
    "slug": "polldaddy",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43338",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Testimonial Slider And Showcase Pro \u003c= 2.1.7 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "testimonial-slider-showcase-pro",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32657",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Scroll Baner \u003c= 1.0 - Cross-Site Request Forgery to Remote Code Execution and/or Cross-Site Scripting",
    "slug": "scroll-baner",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24642",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple:Press Forum \u003c= 6.10.10 - Reflected Cross-Site Scripting via msearch",
    "slug": "simplepress",
    "type": "plugin",
    "affected_version": "* - 6.10.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10483",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 2.3.5 - Stored Cross-Site Scripting",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-2329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2329",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "10Web Map Builder for Google Maps \u003c= 1.0.73 - Missing Authorization to Notice Dismissal",
    "slug": "wd-google-maps",
    "type": "plugin",
    "affected_version": "[*, 1.0.74)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.74",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-45272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45272",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Qwizcards \u003c= 3.61 - Stored Cross-Site Scripting",
    "slug": "qwiz-online-quizzes-and-flashcards",
    "type": "plugin",
    "affected_version": "* - 3.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24706",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Apply with LinkedIn buttons \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "apply-with-linkedin-buttons",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23897",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Banner Effect Header \u003c= 1.2.7 - Cross-Site Request Forgery",
    "slug": "banner-effect-header",
    "type": "plugin",
    "affected_version": "[*, 1.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-0920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-0920",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "eVision Responsive Column Layout Shortcodes \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wens-responsive-column-layout-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0064",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Youzify \u003c= 1.2.5 - Authenticated (Contributor+) SQL Injection",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37494",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Sudan Payment Gateway for WooCommerce \u003c= 1.2.2 - Unauthenticated Arbitrary File Upload",
    "slug": "wc-sudan-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50494",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Landing Page Builder \u003c= 1.5.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "page-builder-add",
    "type": "plugin",
    "affected_version": "* - 1.5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40675",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4618",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Media Share Buttons \u0026 Social Sharing Icons \u003c= 2.8.1 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "ultimate-social-media-icons",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1166",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Email Template Designer \u003c 3.0.8 - Cross-Site Request Forgery",
    "slug": "wp-html-mail",
    "type": "plugin",
    "affected_version": "[*, 3.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-20779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20779",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WpStickyBar – Sticky Bar, Sticky Header \u003c= 2.1.0 - Unauthenticated SQL Injection",
    "slug": "wpstickybar-sticky-bar-sticky-header",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5765",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP Ultimate CSV Importer \u003c= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 7.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4140",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bei Fen – WordPress Backup Plugin \u003c= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "bei-fen",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9993",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SoftMe \u003c= 1.1.24 - Missing Authorization",
    "slug": "softme",
    "type": "theme",
    "affected_version": "* - 1.1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58817",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Order Tip for WooCommerce \u003c= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts",
    "slug": "order-tip-woo",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6025",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "YaySMTP – Simple WP SMTP Mail \u003c= 2.2 - Stored Cross-Site Scripting",
    "slug": "yaysmtp",
    "type": "plugin",
    "affected_version": "[*, 2.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2371",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social proof testimonials and reviews by Repuso \u003c= 5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "social-testimonials-and-reviews-widget",
    "type": "plugin",
    "affected_version": "* - 5.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13351",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.5.7 - Unauthenticated SQL Injection via order_by",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6567",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form Advanced Database \u003c= 1.0.8 - Missing Authorization",
    "slug": "contact-form-advanced-database",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24790",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "SendGrid for WordPress \u003c= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion",
    "slug": "wp-sendgrid-mailer",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9364",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Delicious \u003c= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "delicious-recipes",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58605",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IgniteUp – Coming Soon and Maintenance Mode \u003c= 3.4 - Stored Cross-Site Scripting",
    "slug": "igniteup",
    "type": "plugin",
    "affected_version": "[*, 3.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17236",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ChatBot \u003c= 6.3.5 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 6.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26932",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1276",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDiscuz \u003c= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47185",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nabz Image Gallery \u003c= v1.00 - Unauthenticated SQL Injection",
    "slug": "nabz-image-gallery",
    "type": "plugin",
    "affected_version": "* - v1.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "v1.00",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-55981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55981",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tiny Contact Form \u003c= 0.7 - Cross-Site Request Forgery",
    "slug": "tiny-contact-form",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1846",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery Metabox \u003c= 1.5 - Missing Authorization via gallery_remove",
    "slug": "gallery-metabox",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2561",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 5.12.6 - Authenticated (Subscriber+) Arbitrary File Read via Shortcode",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 5.12.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25050",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "DethemeKit for Elementor \u003c= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1526",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stars SMTP Mailer \u003c= 1.7 - Reflected Cross-Site Scripting",
    "slug": "stars-smtp-mailer",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23453",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.6.15 - Missing Authorization",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54744",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Watermark \u003c= 1.1 - Missing Authorization",
    "slug": "ultimate-watermark",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57985",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Financial Stocks \u0026 Crypto Market Data Plugin \u003c= 1.10.3 - Reflected Cross-Site Scripting",
    "slug": "live-stock-prices-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11690",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radio Buttons for Taxonomies \u003c= 2.0.5 - Cross-Site Request Forgery Bypass",
    "slug": "radio-buttons-for-taxonomies",
    "type": "plugin",
    "affected_version": "[*, 2.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36740",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Twitter @Anywhere Plus \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "twitter-anywhere-plus",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51659",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "sales-report-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "load-more-products-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "pagination-styler-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "product-of-the-day-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "splash-popup-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "terms-and-conditions-popup-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "force-sell-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "cart-products-suggestions-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "cart-notices-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "sequential-order-numbers-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "gridlist-view-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "currency-exchange-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "product-tabs-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "wish-wait-list-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "advanced-product-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "minmax-quantity-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "products-compare-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "product-watermark-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "brands-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.7.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BeRocket Plugins \u003c= (Various Versions) - Missing Authorization",
    "slug": "product-preview-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45813",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPMobile.App \u003c= 11.20 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpappninja",
    "type": "plugin",
    "affected_version": "* - 11.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28932",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Digital License Manager \u003c= 1.7.3 - Reflected Cross-Site Scripting via remove_query_arg Function",
    "slug": "digital-license-manager",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2635",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Local Pickup for WooCommerce \u003c= 1.5.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "advanced-local-pickup-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2841",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Disabler \u003c= 3.0.3 - Cross-Site Request Forgery",
    "slug": "disabler",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37998",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Blog Card \u003c= 1.31 - Sensitive Information Exposure",
    "slug": "simple-blog-card",
    "type": "plugin",
    "affected_version": "[*, 1.32)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.32",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4036",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Droit Dark Mode \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "droit-dark-mode",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47531",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Exit Popup Free \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "exit-popup-free",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31591",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Auto Poster \u003c= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "social-auto-poster",
    "type": "plugin",
    "affected_version": "* - 5.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6752",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "360 Javascript Viewer \u003c= 1.7.12 - Missing Authorization to Plugin Settings Update",
    "slug": "360deg-javascript-viewer",
    "type": "plugin",
    "affected_version": "* - 1.7.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1637",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Dashboard Chat \u003c= 1.0.3 - Authenticated (Contributor+) SQL Injection via id",
    "slug": "wp-dashboard-chat",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10660",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Coming Soon Landing Page and Maintenance Mode WordPress Plugin \u003c= 2.2.0 - Missing Authorization",
    "slug": "8-degree-coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47429",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BP Profile Search \u003c= 5.7.5 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "bp-profile-search",
    "type": "plugin",
    "affected_version": "* - 5.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7850",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetEngine \u003c= 3.7.0 - Authenticated (Subscriber+) Information Exposure",
    "slug": "jet-engine",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53196",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.38.1 - Missing Authorization via CR_Manual",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.38.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.38.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51692",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.6 - Missing Authorization to Unauthenticated Arbitrary Email Sending",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13371",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ai Engine \u003c= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 2.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8268",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "CTT Expresso para WooCommerce \u003c= 3.2.12 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ctt-expresso-para-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6478",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Booking System – Booking Calendar \u003c= 2.0.19.8 - Reflected Cross-Site Scripting",
    "slug": "wp-booking-system",
    "type": "plugin",
    "affected_version": "* - 2.0.19.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.19.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8797",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Cumulus \u003c= 1.20 - Sensitive Information Exposure",
    "slug": "wp-cumulus",
    "type": "plugin",
    "affected_version": "* - 1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-4170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-4170",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Listly: Listicles For WordPress \u003c= 2.7 - Unauthenticated Arbitrary Transient Deletion",
    "slug": "listly",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5811",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EmbedPress \u003c= 3.9.11 - Missing Authorization",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31274",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Genesis Club Lite \u003c= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "genesis-club-lite",
    "type": "plugin",
    "affected_version": "* - 1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58691",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.3.0 - Unauthenticated Local File Inclusion via modal",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-2411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2411",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Funnel Builder by CartFlows \u003c= 1.6.12 - Authenticated Stored Cross-Site scripting via FB Pixel ID and Google Analytics ID",
    "slug": "cartflows",
    "type": "plugin",
    "affected_version": "[*, 1.6.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24330",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "I Recommend This \u003c= 3.9.0 - Cross-Site Request Forgery",
    "slug": "i-recommend-this",
    "type": "plugin",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28696",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Salient Core \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "salient-core",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48748",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Point Of Sale (POS) \u003c= 1.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "woo-point-of-salepos",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52820",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Greg's High Performance SEO \u003c= 1.6.1 - Reflected Cross-Site Scripting",
    "slug": "gregs-high-performance-seo",
    "type": "plugin",
    "affected_version": "[*, 1.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9319",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Big File Uploads \u003c= 2.1.1 - Cross-Site Request Forgery via actions",
    "slug": "tuxedo-big-file-uploads",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47792",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Starter Templates \u003c= 4.4.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "astra-sites",
    "type": "plugin",
    "affected_version": "* - 4.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47345",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 1.3.12 - Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 1.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-10016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10016",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Barcode Generator for WooCommerce – Show barcodes on products, orders, invoices and other pages \u003c= 2.0.2 - Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "embedding-barcodes-into-product-pages-and-orders",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24597",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Void Elementor WHMCS Elements For Elementor Page Builder \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "void-elementor-whmcs-elements",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32592",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP FoodBakery \u003c= 3.3 - Unauthenticated PHP Object Injection",
    "slug": "wp-foodbakery",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32927",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Welcart e-Commerce \u003c 2.2.8 - Missing Capabilities Check to Information Disclosure",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 2.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4375",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "EZ Form Calculator \u003c= 2.14.0.3 - Reflected Cross-Site Scripting",
    "slug": "ez-form-calculator",
    "type": "plugin",
    "affected_version": "* - 2.14.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32133",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Box / Page Plugin \u003c= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-facebook-like-box",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4754",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Page Generator Plugin – MPG \u003c= 3.4.0 - Cross-Site Request Forgery",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31301",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Compress \u003c= 6.50.54 - Missing Authorization",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.50.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.50.54",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57899",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VEDA - MultiPurpose WordPress Theme \u003c= 4.2 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "veda",
    "type": "theme",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13787",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Super Simple Subscriptions \u003c= 1.1.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "super-simple-subscriptions",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30523",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6823",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wise Chat \u003c= 2.6.3 - Reverse Tabnabbing",
    "slug": "wise-chat",
    "type": "plugin",
    "affected_version": "[*, 2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-6780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lightbox Gallery \u003c= 0.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "lightbox-gallery",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4682",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – QR Codes \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "edd-qr-codes",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Scratch \u0026 Win – Giveaways and Contests \u003c= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "scratch-win-giveaways-for-website-facebook",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11898",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Everest Forms \u003c= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "* - 3.0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10471",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RentSyst \u003c= 2.0.92 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "rentsyst",
    "type": "plugin",
    "affected_version": "* - 2.0.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.92",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32501",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Change Role \u003c= 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "bulk-role-change",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50504",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Dummy Content Generator \u003c= 3.4.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion",
    "slug": "wp-dummy-content-generator",
    "type": "plugin",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49234",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AutomateWoo \u003c= 5.7.5 - Missing Authorization",
    "slug": "automatewoo",
    "type": "plugin",
    "affected_version": "* - 5.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36512",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Slider Revolution \u003c= 6.6.20 - Missing Authorization",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34444",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Form Builder \u003c= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-form-builder",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3906",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Chat App \u003c= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-whatsapp",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4664",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.13 - Unauthenticated Local File Inclusion",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-38717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38717",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP MultiTasking \u003c= 0.1.12 - Cross-Site Request Forgery to Permalink Suffix Update",
    "slug": "wp-multitasking",
    "type": "plugin",
    "affected_version": "* - 0.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6860",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Selar.co Widget \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "selar-co-widget",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51598",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Widget \u003c= 1.4.2 - Cross-Site Request Forgery",
    "slug": "new-contact-form-widget",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48037",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Live Sports Streamthunder \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "live-sports-streamthunder",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49967",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Piotnet Addons For Elementor \u003c= 2.4.27 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "piotnet-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33630",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page View Count \u003c= 2.5.5 - Cross-Site Request Forgery",
    "slug": "page-views-count",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40131",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "InfiniteWP Client \u003c= 1.9.4.4 - Authentication Bypass",
    "slug": "iwp-client",
    "type": "plugin",
    "affected_version": "* - 1.9.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-8772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8772",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "QR Code Composer – Automatic QR code Generator \u003c= 2.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "qr-code-composer",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32560",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Revolution \u003c= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.7.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10249",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPress \u003c= 2.2.1 - Missing Authorization",
    "slug": "booking-and-rental-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22720",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "4ECPS Web Forms \u003c= 0.2.18 - Unauthenticated Arbitrary File Upload",
    "slug": "4ecps-webforms",
    "type": "plugin",
    "affected_version": "* - 0.2.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-22504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22504",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MomentoPress for Momento360 \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "cmyee-momentopress",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-46782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46782",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enable Media Replace \u003c= 3.6.3 - Authenticated (Administrator+) Path Traversal",
    "slug": "enable-media-replace",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2554",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N"
  },
  {
    "title": "NEX-Forms - Ultimate Form Builder \u003c= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0272",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDataTables - Tables \u0026 Table Charts \u003c= 2.1.65 - Authenticated(Administrator+) PHP Object Injection",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "[*, 2.1.66)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.66",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4314",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DocoDoco Store Locator \u003c= 1.0.1 - Authenticated (Editor+) Arbitrary File Upload",
    "slug": "docodoco-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10754",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LearnDash LMS \u003c= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change",
    "slug": "sfwd-lms",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3105",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Database Backup for WordPress \u003c= 2.3.3 - Authenticated Stored Cross-Site Scripting via backup_receipient Parameter",
    "slug": "wp-db-backup",
    "type": "plugin",
    "affected_version": "[*, 2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24322",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "xili-tidy-tags \u003c= 1.12.06 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xili-tidy-tags",
    "type": "plugin",
    "affected_version": "* - 1.12.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58240",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Primer MyData for Woocommerce \u003c= 4.2.5 - Cross-Site Request Forgery",
    "slug": "primer-mydata",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53575",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Crocoblock JetEngine \u003c= 3.1.3 - Authenticated(Author+) Arbitrary File Upload to Remote Code Execution",
    "slug": "jet-engine",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1406",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EmbedPress \u003c= 3.8.3 - Cross-Site Request Forgery",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "[*, 3.8.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-51375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51375",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.3.9.4 - Content Spoofing",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.3.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23985",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ULTIMATE TABLES \u003c= 1.6.5 - Reflected Cross-Site Scripting",
    "slug": "ultimate-tables",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36357",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ethiopian Calendar \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ethiopian-calendar",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31589",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GetBookingsWP \u003c= 1.1.27 - Missing Authorization",
    "slug": "get-bookings-wp",
    "type": "plugin",
    "affected_version": "* - 1.1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31896",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Affiliate Links Lite \u003c= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "affiliate-links",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22696",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Groups and Communities \u003c= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10900",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "SendPress Newsletters \u003c 1.2 - Authenticated SQL Injection",
    "slug": "sendpress",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9448",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MF Gig Calendar \u003c= 1.2.1 - Cross-Site Request Forgery to Event Deletion",
    "slug": "mf-gig-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3756",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spectra Pro \u003c= 1.1.5 - Authenticated (Author+) Privilege Escalation",
    "slug": "spectra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3828",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Visibility by Country for WooCommerce \u003c= 1.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "product-visibility-by-country-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47660",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode IMDB \u003c= 6.0.8 - Cross-Site Request Forgery",
    "slug": "shortcode-imdb",
    "type": "plugin",
    "affected_version": "* - 6.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37892",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conversion Ninja (Unspecified Version) - Cross-Site Scripting",
    "slug": "conversionninja",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4017",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.03",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11740",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Download Manager \u003c= 3.3.25 - Unauthenticated Sensitive Information Exposure",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60092",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Wtyczka SeoPilot dla WP \u003c= 3.3.091 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wtyczka-seopilot-dla-wp",
    "type": "plugin",
    "affected_version": "* - 3.3.091",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.091",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11812",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress \u0026 WooCommerce \u003c= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Block",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11636",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile Domain \u003c= 1.5.2 - Cross-Site Request Forgery and Stored Cross-Site Scripting",
    "slug": "mobile-domain",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-1581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1581",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar \u003c= 5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mp3-music-player-by-sonaar",
    "type": "plugin",
    "affected_version": "* - 5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30530",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light \u003c= 2.4.37 - Unauthenticated Remote Code Execution",
    "slug": "excel-like-price-change-for-woocommerce-and-wp-e-commerce-light",
    "type": "plugin",
    "affected_version": "* - 2.4.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.37",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48123",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FooGallery \u003c= 2.2.44 - Reflected Cross-Site Scripting",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "[*, 2.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-44244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44244",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FW Anker \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fw-anker",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58836",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Gallery with Slideshow Plugin \u003c= 1.5.2 - Blind SQL Injection via imgid",
    "slug": "image-gallery-with-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002013",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cardealer \u003c= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Change and Delete JS and CSS Files",
    "slug": "cardealer",
    "type": "theme",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1681",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "SureForms \u003c= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3513",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4569",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Isolved Talent Acquisition \u003c= 1.3.9 - Reflected Cross-Site Scripting",
    "slug": "applicantpro",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23920",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hardening – Fix Your WordPress Security \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "wp-security-hardening",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24373",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Name Directory \u003c= 1.25.3 - Cross-Site Request Forgery",
    "slug": "name-directory",
    "type": "plugin",
    "affected_version": "* - 1.25.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2071",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Order Tracking \u003c= 3.3.11 - Missing Authorization via send_test_email()",
    "slug": "order-tracking",
    "type": "plugin",
    "affected_version": "* - 3.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43343",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \u003c= 4.7.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting",
    "slug": "print-invoices-packing-slip-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24644",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Forms \u003c= 2.6.93 - Missing Authorization",
    "slug": "smart-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1307",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Import Export Suite for CSV and XML Datafeed \u003c= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 7.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2008",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import Export Suite for CSV and XML Datafeed \u003c= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "7.20",
    "from_version": "7.20",
    "from_inclusive": true,
    "to_version": "7.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2008",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Poll Maker \u003c= 4.0.1 - Admin+ Stored Cross-Site Scripting",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1456",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5667",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library",
    "slug": "wp-featherlight",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5667",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Macro Calculator with Admin Email Optin \u0026 Data \u003c= 1.0 - Unauthenticated Information Disclosure",
    "slug": "macro-admin-email-data-optin-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26730",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPBot Pro Wordpress Chatbot \u003c= 12.7.0 - Unauthenticated PHP Object Injection",
    "slug": "wpbot-pro",
    "type": "plugin",
    "affected_version": "* - 12.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47582",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Magic Embeds \u003c= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-embed-facebook",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4799",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MM-Breaking News \u003c= 0.7.9 - Reflected Cross-Site Scripting",
    "slug": "mm-breaking-news",
    "type": "plugin",
    "affected_version": "* - 0.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8056",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackWPup \u003c= 3.4.1 - Unauthenticated Backup Download",
    "slug": "backwpup",
    "type": "plugin",
    "affected_version": "[*, 3.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-2551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2551",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Appointment Booking Calendar \u003c= 1.3.69 - Missing Authorization",
    "slug": "appointment-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 1.3.69",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.69",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43482",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Woo Search \u003c= 2.77 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-woo-search",
    "type": "plugin",
    "affected_version": "* - 2.77",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.77",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2452",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Widgets Shortcode \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-widgets-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TCBD Auto Refresher \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tcbd-auto-refresher",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12519",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better WP Login Page \u003c= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "better-wp-login-page",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54442",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Enquiry \u003c= 2.6.0 - Unauthenticated Self-Based Cross-Site Scripting",
    "slug": "woo-product-enquiry",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32796",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kargo Entegratör \u003c= 1.1.14 - Authenticated (Shop Manager+) SQL Injection",
    "slug": "kargo-entegrator",
    "type": "plugin",
    "affected_version": "* - 1.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26908",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Social Stream \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-social-stream",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25074",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.10 - Missing Authorization to Authenticated (Subscriber+) to Enable/Disable Addons",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43937",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP OAuth Server \u003c= 4.2.5 - Authenticated (Subscriber+) Arbitrary Client Deletion (wo_ajax_remove_client)",
    "slug": "oauth2-provider",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4148",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin \u003c= 3.1.0 - Multiple Cross-Site Request Forgery",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "[*, 3.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-2579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2579",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "X Addons for Elementor \u003c= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Video ID Field",
    "slug": "x-addons-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9204",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Profile Picture \u003c 2.6.0 - Authenticated Insecure Direct Object Reference",
    "slug": "users-profile-picture",
    "type": "plugin",
    "affected_version": "[*, 2.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24473",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VK All in One Expansion Unit \u003c= 9.87.0.1 - Reflected Cross-Site Scripting via REQUEST_URI",
    "slug": "vk-all-in-one-expansion-unit",
    "type": "plugin",
    "affected_version": "* - 9.87.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.87.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0937",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mediamatic – Media Library Folders \u003c= 2.8.1 - Cross-Site Request Forgery",
    "slug": "mediamatic",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47142",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "oik \u003c= 4.15.1 - Missing Authorization",
    "slug": "oik",
    "type": "plugin",
    "affected_version": "* - 4.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49241",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Youzify – BuddyPress Community, User Profile, Social Network \u0026 Membership Plugin for WordPress \u003c= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license)",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13370",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Download Monitor \u003c= 5.0.13 - Missing Authorization to Sensitive Information Exposure",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 5.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10399",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WidgetKit Pro \u003c= 1.13.1 - Reflected Cross-Site Scripting",
    "slug": "widgetkit-pro",
    "type": "plugin",
    "affected_version": "* - 1.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46494",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Colorful Tag Cloud \u003c= 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "wp-colorful-tag-cloud",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28865",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Function",
    "slug": "frontend-dashboard",
    "type": "plugin",
    "affected_version": "1.0 - 2.2.6",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4104",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TinyMCE Color Picker \u003c= 1.1 - Missing Authorization",
    "slug": "tinymce-colorpicker",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-3844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3844",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PropertyShift \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "propertyshift",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51762",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swiss Toolkit For WP \u003c= 1.4.0 - Missing Authorization",
    "slug": "swiss-toolkit-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31546",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PJW Mime Config \u003c= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "pjw-mime-config",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10017",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "5 Stars Rating Funnel \u003c= 1.2.67 - Missing Authorization",
    "slug": "5-stars-rating-funnel",
    "type": "plugin",
    "affected_version": "* - 1.2.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.67",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32725",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP-Recall – Registration, Profile, Commerce \u0026 More \u003c= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1322",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ocean Extra \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Buy Me a Coffee – Button and Widget Plugin \u003c= 3.7 - Cross-Site Request Forgery",
    "slug": "buymeacoffee",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2079",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4216",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Dashboard \u003c= 3.7.10 - Login Page Disclosure on Multi-site",
    "slug": "ultimate-dashboard",
    "type": "plugin",
    "affected_version": "* - 3.7.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49822",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AM-HiLi \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "am-hili-affiliate-manager-for-publishers",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44586",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom 404 Pro \u003c= 3.7.2 - Reflected Cross-Site Scripting via 's'",
    "slug": "custom-404-pro",
    "type": "plugin",
    "affected_version": "* - 3.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2023",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Multistore Locator \u003c= 2.5.2 - Unauthenticated SQL Injection",
    "slug": "wp-multi-store-locator",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28898",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MailPoet Newsletters \u003c= 2.8.1 - Spam Injection",
    "slug": "wysija-newsletters",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20853",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Protected Posts Logout Button \u003c= 1.4.5 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "protected-posts-logout-button",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25978",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tickera – WordPress Event Ticketing \u003c= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "tickera-event-ticketing-system",
    "type": "plugin",
    "affected_version": "* - 3.5.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10263",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Super Addons for Elementor \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "super-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51588",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ERP | Complete HR solution with recruitment \u0026 job listings | WooCommerce CRM \u0026 Accounting \u003c= 1.13.1 - Authenticated (AccountingManager+) SQL Injection",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1173",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Powr Pack \u003c= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "powr-pack",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45609",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Masteriyo - LMS \u003c= 1.11.4 - Authenticated (Student+) Insecure Direct Object Reference",
    "slug": "learning-management-system",
    "type": "plugin",
    "affected_version": "* - 1.11.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43239",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HTML5 Video Player – mp4 Video Player Plugin and Block \u003c= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update",
    "slug": "html5-video-player",
    "type": "plugin",
    "affected_version": "* - 2.5.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7721",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Include URL \u003c= 0.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "include-url",
    "type": "plugin",
    "affected_version": "* - 0.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30593",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Google Map \u003c= 3.1.5 - Missing Authorization",
    "slug": "responsive-google-map",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28920",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IP Vault – WP Firewall \u003c= 1.1 - IP Address Spoofing to Protection Mechanism Bypass",
    "slug": "ip-vault-wp-firewall",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4536",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Piotnet Addons For Elementor \u003c= 2.4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Attributes",
    "slug": "piotnet-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4262",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Analytics Opt-Out \u003c= 2.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "google-analytics-opt-out",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25712",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u0026 WooCommerce Affiliate Program \u003c= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation",
    "slug": "wp-wc-affiliate-program",
    "type": "plugin",
    "affected_version": "* - 8.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9289",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP DB Booster \u003c= 1.0.1 - Missing Authorization",
    "slug": "wp-db-booster",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53318",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Textboxes \u003c= 0.1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "textboxes",
    "type": "plugin",
    "affected_version": "* - 0.1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50469",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flat Preloader \u003c 1.5.5 - Stored Cross-Site Scripting",
    "slug": "flat-preloader",
    "type": "plugin",
    "affected_version": "[*, 1.5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24789",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick View for WooCommerce \u003c= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woo-quickview",
    "type": "plugin",
    "affected_version": "* - 2.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58228",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Facethumb \u003c= 1.0 - Cross-Site Scripting",
    "slug": "wp-facethumb",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4585",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Archivist – Custom Archive Templates \u003c= 1.7.4 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "archivist-custom-archive-templates",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via id parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6573",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfileGrid  \u003c= 5.9.3 - Cross-Site Request Forgery",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49273",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPZOOM Shortcodes \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode",
    "slug": "wpzoom-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9027",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coupon Plugin \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "coupon-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12516",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "POEditor \u003c= 0.9.7 - Cross-Site Request Forgery",
    "slug": "poeditor",
    "type": "plugin",
    "affected_version": "* - 0.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4209",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps \u0026 Hybrid Mobile Apps \u003c 2.0.2 - Information Disclosure",
    "slug": "wordpress-mobile-pack",
    "type": "plugin",
    "affected_version": "[*, 2.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-5337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5337",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FundEngine – Donation and Crowdfunding Platform \u003c= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wp-fundraising-donation",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6698",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Z-Downloads \u003c= 1.11.3 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "z-downloads",
    "type": "plugin",
    "affected_version": "* - 1.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-34555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34555",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Web Librarian \u003c= 3.5.4 - SQL Injection",
    "slug": "weblibrarian",
    "type": "plugin",
    "affected_version": "* - 3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-1010034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1010034",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CarDealerPress \u003c= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter",
    "slug": "cardealerpress",
    "type": "plugin",
    "affected_version": "* - 6.8.2505.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.2505.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3860",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Filterable Portfolio \u003c= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "responsive-filterable-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10049",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sermon'e \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "sermone-online-sermons-management",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chartjs \u003c= 2023.2 - Authenticated(Editor+) Stored Cross-Site Scripting",
    "slug": "enigma-chartjs",
    "type": "plugin",
    "affected_version": "* - 2023.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2023.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6081",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WhatsApp Click to Chat Plugin for WordPress \u003c= 2.2.12 - Unauthenticated Local File Inclusion",
    "slug": "wpt-whatsapp",
    "type": "plugin",
    "affected_version": "* - 2.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39411",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ENL Newsletter \u003c= 1.0.1 - Authenticated (Admin+) SQL Injection",
    "slug": "enl-newsletter",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3060",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Drag and Drop Multiple File Upload - Contact Form 7 \u003c= 1.3.7.3 - Unauthenticated Arbitrary File Upload",
    "slug": "drag-and-drop-multiple-file-upload-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5822",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WebP \u0026 SVG Support \u003c= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "webp-svg-support",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3633",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leyka \u003c= 3.31.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "* - 3.31.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.31.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53275",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenify \u003c= 1.4.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "gutenify",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35165",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Amelia \u003c= 1.0.75 - Unauthenticated Reflected Cross-Site Scripting via 'code'",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.0.75",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.75",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29427",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Minimalist 200901 \u003c= 1.1 - Cross-Site Scripting",
    "slug": "web-minimalist-200901",
    "type": "theme",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3861",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial Rotator \u003c= 3.0.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "testimonial-rotator",
    "type": "plugin",
    "affected_version": "[*, 3.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-26672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-26672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKT Blocks – Gutenberg based Page Builder \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-blocks",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26998",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Login Logout Plugin \u003c= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "my-loginlogout",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "I Draw \u003c= 1.0 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "idraw",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39436",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SAML Single Sign On – SSO Login Premium Multisite \u003c 20.0.7 - Open Redirect",
    "slug": "miniorange-saml-20-single-sign-on",
    "type": "plugin",
    "affected_version": "[16, 16.0.8)",
    "from_version": "16",
    "from_inclusive": true,
    "to_version": "16.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4496",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L"
  },
  {
    "title": "SAML Single Sign On – SSO Login Premium Multisite \u003c 20.0.7 - Open Redirect",
    "slug": "miniorange-saml-20-single-sign-on",
    "type": "plugin",
    "affected_version": "[12, 12.1.0)",
    "from_version": "12",
    "from_inclusive": true,
    "to_version": "12.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4496",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L"
  },
  {
    "title": "SAML Single Sign On – SSO Login Premium Multisite \u003c 20.0.7 - Open Redirect",
    "slug": "miniorange-saml-20-single-sign-on",
    "type": "plugin",
    "affected_version": "[20, 20.0.7)",
    "from_version": "20",
    "from_inclusive": true,
    "to_version": "20.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4496",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L"
  },
  {
    "title": "WP Import Export Lite \u003c= 3.9.26 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "wp-import-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.9.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-31308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31308",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Corner Ad \u003c 1.0.8 - Cross-Site Scripting",
    "slug": "corner-ad",
    "type": "plugin",
    "affected_version": "[*, 1.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18579",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Pricing Table \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-pricing-table",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13628",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial Slider \u003c= 3.5.8.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "testimonial-add",
    "type": "plugin",
    "affected_version": "* - 3.5.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-60126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60126",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VM Backups \u003c= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "vm-backups",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24173",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Addons for WPBakery Page Builder \u003c= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "Ultimate_VC_Addons",
    "type": "plugin",
    "affected_version": "* - 3.19.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5251",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZdStatistics \u003c= 2.0.1 - Cross-Site Scripting",
    "slug": "zdstats",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4605",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 4.3.0 - Missing Authorization in Multiple AJAX Actions",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2544",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "wpDataTables – WordPress Tables \u0026 Table Charts Plugin \u003c= 2.1.27 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "* - 2.1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25618",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form, Survey \u0026 Form Builder – MightyForms \u003c= 1.3.9 - Missing Authorization",
    "slug": "mightyforms",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56002",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Tribute Testimonials – WordPress Testimonial Grid/Slider \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tribute-testimonial-gridslider",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10886",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Proxy \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "simple-proxy",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56026",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Backup \u0026 Migration \u003c= 1.4.0 - Missing Authorization via wt_delete_schedule",
    "slug": "wp-migration-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33928",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "CardGate Payments for WooCommerce \u003c= 3.1.15 - Lack of Origin Validation",
    "slug": "cardgate",
    "type": "plugin",
    "affected_version": "[*, 3.1.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-8819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8819",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Meta Box – WordPress Custom Fields Framework \u003c= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meta-box",
    "type": "plugin",
    "affected_version": "* - 5.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6526",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Modal \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "media-modal",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51604",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Discy \u003c= 5.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "discy",
    "type": "theme",
    "affected_version": "[*, 5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1421",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cozy Blocks \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cozy-addons",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30838",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hide Categories \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-hide-categories",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31028",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support Board \u003c= 3.3.3 - Multiple Unauthenticated SQL Injections",
    "slug": "supportboard",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24741",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Plugin Inspector \u003c= 1.5 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "plugin-inspector",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53298",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "String Locator \u003c= 2.4.2 - Authenticated Arbitrary File Read",
    "slug": "string-locator",
    "type": "plugin",
    "affected_version": "[*, 2.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0493",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced Page Visit Counter \u003c= 8.0.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "advanced-page-visit-counter",
    "type": "plugin",
    "affected_version": "* - 8.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32098",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Kangu para WooCommerce \u003c= 2.2.10 - Reflected Cross-Site Scripting",
    "slug": "kangu",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32296",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPUpper Share Buttons \u003c= 3.51 - Cross-Site Request Forgery to Custom CSS Update",
    "slug": "wpupper-share-buttons",
    "type": "plugin",
    "affected_version": "* - 3.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13883",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slope Widgets \u003c= 4.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slope-widgets",
    "type": "plugin",
    "affected_version": "* - 4.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11902",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Builder \u003c= 1.9.9.0 - Cross-Site Request Forgery",
    "slug": "contact-form-add",
    "type": "plugin",
    "affected_version": "* - 1.9.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23795",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Statistics \u003c= 13.0.7 - Unauthenticated SQL Injection",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "[*, 13.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.0.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24340",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Theme Blvd Shortcodes \u003c= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "theme-blvd-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5338",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MoveTo \u003c= 6.2 - Unauthenticated SQL Injection",
    "slug": "moveto",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-25910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25910",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Project Manager \u003c= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "simple-project-managment",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23497",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Share on Diaspora \u003c 0.7.2 - Reflected Cross-Site Scripting",
    "slug": "share-on-diaspora",
    "type": "plugin",
    "affected_version": "[*, 0.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18534",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search Cloud One \u003c= 2.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "search-cloud-one",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58883",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DeepL Pro API translation \u003c= 2.4.1.1 - Cross-Site Request Forgery via wpdeepl_prune_logs",
    "slug": "wpdeepl",
    "type": "plugin",
    "affected_version": "* - 2.4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46620",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Profile Builder – User Profile \u0026 User Registration Forms \u003c= 3.9.0 - Insecure Password Reset Mechanism",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2297",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads – Manual Purchases \u003c 1.9.1 - Reflected Cross-Site Scripting",
    "slug": "edd-manual-purchases",
    "type": "plugin",
    "affected_version": "[*, 1.9.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9517",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdForest \u003c= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover",
    "slug": "adforest",
    "type": "theme",
    "affected_version": "* - 5.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11350",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.3, 4.3.27)",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.27",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.7, 4.7.22)",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.22",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.9, 4.9.19)",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.19",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.0, 5.0.15)",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.15",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.2, 5.2.14)",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.14",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.2, 4.2.31)",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.31",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.1, 5.1.12)",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.12",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.6, 5.6.7)",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.8, 5.8.3)",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.4, 4.4.26)",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.26",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.5, 4.5.25)",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.25",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.8, 4.8.18)",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.18",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.7, 5.7.5)",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.1, 4.1.34)",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.34",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.6, 4.6.22)",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.22",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.3, 5.3.11)",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.4, 5.4.9)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Meta_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.5, 5.5.8)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21664",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Video Player \u003c= 1.5.22 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "player",
    "type": "plugin",
    "affected_version": "* - 1.5.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48320",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Envo Extra \u003c= 1.8.16 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "envo-extra",
    "type": "plugin",
    "affected_version": "* - 1.8.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4385",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MLL Audio Player MP3 Ajax \u003c= 0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "music-let-loose-mp3-audio-player",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23561",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Contact Form Builder \u0026 Lead Generation Plugin \u003c= 1.8.9 - Cross-Site Request Forgery",
    "slug": "lead-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1415",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Raptive Ads \u003c= 3.7.3 - Reflected Cross-Site Scripting",
    "slug": "adthrive-ads",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32554",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Field Suite \u003c= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]",
    "slug": "custom-field-suite",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3558",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Supersized \u003c= 3.1.6 - Cross-Site Request Forgery",
    "slug": "wp-supersized",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31438",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c 0.8.3.5 - Multiple Cross-Site Request Forgery",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "[*, 0.8.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.3.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-4089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4089",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Duplicate Title Checker \u003c= 1.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "duplicate-title-checker",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32558",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ruza \u003c= 1.0.7 - Unauthenticated Local File Inclusion",
    "slug": "ruza",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49255",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Issuu Panel \u003c= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "issuu-panel",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23976",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UrbanGo Membership \u003c= 1.0.4 - Unauthenticated Privilege Escalation",
    "slug": "urbango-membership",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3278",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MStore API – Create Native Android \u0026 iOS Apps On The Cloud \u003c= 4.15.2 - Authentication Bypass to Account Takeover",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.15.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7628",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cwicly \u003c= 1.4.0.2 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "cwicly",
    "type": "plugin",
    "affected_version": "* - 1.4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-24707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24707",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery Manager \u003c= 1.5.12 - Cross-Site Scripting",
    "slug": "fancy-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-125096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-125096",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Access Control \u003c= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API",
    "slug": "wordpress-access-control",
    "type": "plugin",
    "affected_version": "* - 4.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0975",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WZone - Lite \u003c= 3.1 - Cross-Site Request Forgery",
    "slug": "woocommerce-amazon-affiliates-light-version",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-27628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27628",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Super Minify \u003c= 1.5.1 - Cross-Site Request Forgery via 'wpsmy_admin_options'",
    "slug": "wp-super-minify",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27615",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NOTICE BOARD \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "notice-board",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38460",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SendPulse Free Web Push \u003c= 1.3.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "sendpulse-web-push",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9184",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Download Manager \u003c 2.9.1 - Cross-Site Request Forgery via editHeader",
    "slug": "cm-download-manager",
    "type": "plugin",
    "affected_version": "[*, 2.9.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-1962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1962",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Adverts Plugin \u003c= 1.4 - Missing Authorization",
    "slug": "adverts-click-tracker",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31848",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Quiz \u003c= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-quiz",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46482",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Checker \u003c= 1.11.8 - Reflected Cross-Site Scripting",
    "slug": "broken-link-checker",
    "type": "plugin",
    "affected_version": "[*, 1.11.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17207",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cartpauj Register Captcha \u003c= 1.0.02 - CAPTCHA Bypass",
    "slug": "cartpauj-register-captcha",
    "type": "plugin",
    "affected_version": "* - 1.0.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40673",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post to Google My Business \u003c= 3.1.14 - Cross-Site Request Forgery to Dismiss Notification",
    "slug": "post-to-google-my-business",
    "type": "plugin",
    "affected_version": "[*, 3.1.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-41689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41689",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "List category posts \u003c= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "list-category-posts",
    "type": "plugin",
    "affected_version": "* - 0.89.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.89.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1051",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Coder \u003c= 2.5.2 - Cross-Site Request Forgery",
    "slug": "wp-coder",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2388",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SKT Skill Bar \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-skill-bar",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38698",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CardGate Payments for WooCommerce \u003c= 3.2.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "cardgate",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32119",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Code Insert Shortcode \u003c= 1.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "simple-code-insert-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49613",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Content Cloner \u003c= 1.0.1 - Missing Authorization",
    "slug": "super-seo-content-cloner",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22681",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Picture Gallery – Frontend Image Uploads, AJAX Photo List \u003c= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "picture-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13584",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by BestWebSoft \u003c= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_subject",
    "slug": "contact-form-plugin",
    "type": "plugin",
    "affected_version": "* - 4.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2200",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easyfonts \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "easyfonts",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31005",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Gift Cards for WooCommerce – Create, Redeem \u0026 Manage Digital Gift Certificates with Personalized Templates \u003c= 2.6.6 - Missing Authorization to Unauthenticated Information Exposure",
    "slug": "woo-gift-cards-lite",
    "type": "plugin",
    "affected_version": "* - 2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1857",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0382",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enhanced Text Widget \u003c= 1.6.3 - Missing Authorization via etw_hide_admin_notification_callback",
    "slug": "enhanced-text-widget",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49192",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "External Media without Import \u003c= 1.1.2 - Authenticated (Subscriber+) Blind Server-Side Request Forgery",
    "slug": "external-media-without-import",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1398",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import any XML, CSV or Excel File to WordPress \u003c= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "* - 3.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10001",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Explara Events \u003c= 0.1.3 - Reflected Cross-Site Scripting",
    "slug": "explara-events",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52466",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.19",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.16",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.11",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.30",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.23",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.15",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.9",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.5",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.3 - 6.3.1",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.7",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.7",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.29",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.26",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.18",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.13",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.12",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.1 - 6.1.3",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.2 - 6.2.2",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 4.1.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.35",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.31",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.26",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.22",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Webmaster \u003c 8.2.4 - Cross-Site Request Forgery",
    "slug": "all-in-one-webmaster",
    "type": "plugin",
    "affected_version": "[*, 8.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-2696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2696",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WPSPX \u003c= 1.0.2 - Unauthenticated Local File Inclusion",
    "slug": "wpspx",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-44034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44034",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Loginplus \u003c= 1.2 - Missing Authorization",
    "slug": "loginplus",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23514",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.1.18 -  Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5053",
    "auth_type": "Auth",
    "cvss_score": 4.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Order Barcodes \u003c= 1.6.4 - Cross-Site Request Forgery",
    "slug": "woocommerce-order-barcodes",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36511",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Frontend Checklist \u003c= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Items",
    "slug": "frontend-checklist",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4959",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ova Advent \u003c= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ova-advent",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8561",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Maintenance Mode \u003c= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "smart-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12682",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Userpro \u003c= 5.1.9 - Missing Authorization",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56211",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CarSpot – Dealership Wordpress Classified Theme \u003c= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover",
    "slug": "carspot",
    "type": "theme",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12860",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.7.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1080",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Icons for Elementor \u003c= 0.3.3 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "custom-icons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 0.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49676",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ArtPlacer Widget \u003c= 2.20.6 - Authenticated (Editor+) SQL Injection",
    "slug": "artplacer-widget",
    "type": "plugin",
    "affected_version": "* - 2.20.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6373",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hero Maps Premium \u003c= 2.2.2 - Reflected Cross-Site Scripting",
    "slug": "hmapsprem",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19134",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce OpenPos \u003c= 6.4.4 - Unauthenticated Arbitrary File Deletion",
    "slug": "woocommerce-openpos",
    "type": "plugin",
    "affected_version": "* - 6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37932",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Theme My Login \u003c= 6.3.9 - Local File Inclusion",
    "slug": "theme-my-login",
    "type": "plugin",
    "affected_version": "[*, 6.3.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-5155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5155",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Prime Slider – Addons For Elementor \u003c= 3.11.10 - Incorrect Authorization via bdt_duplicate_as_draft",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.11.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24883",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Goldstar \u003c= 2.1.1 - Missing Authorization",
    "slug": "goldstar",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23962",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Debug Assistant \u003c= 1.4 - Cross-Site Request Forgery via imlt_create_admin",
    "slug": "debug-assistant",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-26516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26516",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Feather Login Page 1.0.7 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "feather-login-page",
    "type": "plugin",
    "affected_version": "1.0.7 - 1.1.1",
    "from_version": "1.0.7",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2549",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_multiple_files_for_post",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4164",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_multiple_files_for_post",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4164",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Demo Import Kit \u003c= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "demo-import-kit",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10051",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Timeline \u003c= 1.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "rich-event-timeline",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1324",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Material Design Icons for Page Builders \u003c= 1.4.2 - Cross-Site Request Forgery",
    "slug": "material-design-icons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-24382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24382",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Appointment Hour Booking \u003c= 1.3.72 - CSV Injection",
    "slug": "appointment-hour-booking",
    "type": "plugin",
    "affected_version": "* - 1.3.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4034",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Jupiter Theme \u003c= 6.10.1 and JupiterX Core Plugin \u003c= 2.0.7 - Authenticated Privilege Escalation",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1654",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Jupiter Theme \u003c= 6.10.1 and JupiterX Core Plugin \u003c= 2.0.7 - Authenticated Privilege Escalation",
    "slug": "jupiter",
    "type": "theme",
    "affected_version": "* - 6.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1654",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "GreenPay(tm) by Green.Money 3.0.0 - 3.0.9 - Unauthenticated Information Exposure",
    "slug": "green-money-payment-gateway",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.0.9",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2882",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPify Woo Czech \u003c= 4.0.10 - Reflected Cross-Site Scripting",
    "slug": "wpify-woo",
    "type": "plugin",
    "affected_version": "* - 4.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33946",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp tabber widget \u003c= 4.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-tabber-widget",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10730",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "NEX-Forms \u003c= 8.3.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2114",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Safe SVG \u003c= 1.9.4 - Denial of Service",
    "slug": "safe-svg",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-18854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-18854",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Skimlinks Affiliate Marketing Tool \u003c= 1.3 - Missing Authorization",
    "slug": "skimlinks",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57944",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PostX – Gutenberg Blocks for Post Grid \u003c= 3.2.3 - Incorrect Authorization",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Yoast SEO Premium \u003c= 20.4 - Missing Authorization to Zapier Key Reset",
    "slug": "wordpress-seo-premium",
    "type": "plugin",
    "affected_version": "* - 20.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28775",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spam protection, AntiSpam, FireWall by CleanTalk \u003c= 5.173 - Reflected Cross-Site Scripting",
    "slug": "cleantalk-spam-protect",
    "type": "plugin",
    "affected_version": "* - 5.173",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.173",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-28222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-28222",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) \u003c= 5.2.3 - Missing Authorization",
    "slug": "wp-analytify",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1809",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "TheCartPress eCommerce Shopping Cart \u003c= 1.5.3.6 - Sensitive Information Disclosure",
    "slug": "thecartpress",
    "type": "plugin",
    "affected_version": "* - 1.5.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3302",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Frontend Dashboard \u003c= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "frontend-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29775",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "B Blocks - The ultimate block collection \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "b-blocks",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32173",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ads Pro Plugin \u003c= 4.88 - Unauthenticated Local File Inclusion",
    "slug": "ap-plugin-scripteo",
    "type": "plugin",
    "affected_version": "* - 4.88",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.88",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-46444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46444",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sync Posts \u003c= 1.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "sync-posts",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32579",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ConvertPlus \u003c= 3.4.4 - Unauthorized Account Creation",
    "slug": "convertplug",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15863",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Superb Social Media Share Buttons and Follow Buttons \u003c= 1.1.3 - Missing Authorization via spbsmAjax",
    "slug": "superb-social-share-and-follow-buttons",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29428",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Qe SEO Handyman \u003c= 1.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "qe-seo-handyman",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4352",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Instant Chat Floating Button for WordPress Websites \u003c= 1.0.5 - Unauthenticated Local File Inclusion",
    "slug": "instant-chat-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-44018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44018",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AutoCatSet \u003c= 2.1.4 - Cross-Site Request Forgery",
    "slug": "autocatset",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9631",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hara \u003c= 1.2.10 - Unauthenticated Local File Inclusion",
    "slug": "hara",
    "type": "theme",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49259",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sogrid \u003c= 1.5.6 - Unauthenticated Local File Inclusion",
    "slug": "sogrid",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54374",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Support Plus Responsive Ticket System \u003c= 4.1 - SQL Injection",
    "slug": "wp-support-plus-responsive-ticket-system",
    "type": "plugin",
    "affected_version": "[*, 4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-10387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10387",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Justified Image Gallery \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "justified-image-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22518",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Custom Cursors \u003c= 3.0.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-custom-cursors",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3150",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.8.4 - Forced Password Reset",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2009-2762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2762",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WPHelpful \u003c= 1.2.4 - Reflected Cross-Site Scripting",
    "slug": "wphelpful",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51761",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complianz - GDPR/CCPA Cookie Consent \u003c= 6.4.4 - Cross-Site Request Forgery via ajax_script_add",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33333",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "If-So Dynamic Content Personalization \u003c= 1.7.1 - Missing Authorization",
    "slug": "if-so",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34820",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy PayPal Events \u003c= 1.2.2 - Cross-Site Request Forgery",
    "slug": "easy-paypal-events-tickets",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47519",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The GDPR Framework By Data443 \u003c= 2.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gdpr-framework",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13621",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Classifieds Plugin – Ad Directory \u0026 Listings by AWP Classifieds \u003c 3.0 - SQL Injection",
    "slug": "another-wordpress-classifieds-plugin",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-10013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10013",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "DiveBook \u003c= 1.1.4 - SQL Injection",
    "slug": "divebook",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-14207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-14207",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Realtyna Organic IDX plugin \u003c= 4.14.4 - Unauthenticated SQL Injection",
    "slug": "real-estate-listing-realtyna-wpl",
    "type": "plugin",
    "affected_version": "* - 4.14.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32128",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.2.3 - Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta Shortcode",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9170",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 6.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5692",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Donations via PayPal \u003c= 1.9.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "paypal-donations",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3822",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Email Capture \u003c= 3.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-email-capture",
    "type": "plugin",
    "affected_version": "* - 3.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23723",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Limit Login Attempts (Spam Protection) \u003c= 2.8 - Missing Authorization to Arbitrary Plugin Installation/Activation",
    "slug": "wp-limit-failed-login-attempts",
    "type": "plugin",
    "affected_version": "[*, 2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24194",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blogty \u003c= 1.0.11 - Unauthenticated Local File Inclusion",
    "slug": "blogty",
    "type": "theme",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49278",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OneClick Chat to Order \u003c= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "oneclick-whatsapp-order",
    "type": "plugin",
    "affected_version": "* - 1.0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4760",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Responsive Tabs \u003c= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-responsive-tabs",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13387",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Universal Slider \u003c= 1.6.5 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "fusion-slider",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5649",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Tax Rate Upload \u003c= 2.4.5 - Reflected Cross-Site Scripting",
    "slug": "tax-rate-upload",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31105",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opencart Product in WP \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "opencart-product-in-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22335",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Open Hours – Easy Opening Hours \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "open-hours",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12813",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MonsterInsights \u003c= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via Google Analytics",
    "slug": "google-analytics-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 8.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3904",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mass Email To users \u003c= 1.1.4 - Unauthenticated Reflected Cross-Site Scripting via 'entrant'",
    "slug": "mass-email-to-users",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47600",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SrbTransLatin \u003c= 1.46 - Cross-Site Request Forgery",
    "slug": "srbtranslatin",
    "type": "plugin",
    "affected_version": "* - 1.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.46",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-5368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5368",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) \u003c= 2.6.1 - Cross-Site Request Forgery to Limited Arbitrary Options Update",
    "slug": "sky-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11601",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WPtouch \u003c= 4.3.44 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "wptouch",
    "type": "plugin",
    "affected_version": "* - 4.3.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.44",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3416",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.31",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.4",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.2",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.34",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.32",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.31",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.22",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.19",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.18",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.14",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.15",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.28",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.24",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.23",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.10",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.1",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.34",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.6",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Stored Cross-Site Scripting via post slugs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.7",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRUDLab Google Plus Button \u003c= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "crudlab-google-plus",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54399",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blix 0.9.1 and Blix 0.9.1 Rus - Cross-Site Scripting",
    "slug": "blix",
    "type": "theme",
    "affected_version": "* - 0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4481",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Checker \u003c 1.10.6 - Reflected Cross Site Scripting",
    "slug": "broken-link-checker",
    "type": "plugin",
    "affected_version": "[*, 1.10.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-10098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10098",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Albo Pretorio Online \u003c= 4.6.3 - Reflected Cross-Site Scripting",
    "slug": "albo-pretorio-on-line",
    "type": "plugin",
    "affected_version": "* - 4.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32108",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Visitors \u003c= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header",
    "slug": "nm-visitors",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4541",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SAPO Feed \u003c= 2.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sapo-feed",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53462",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Register Profile With Shortcode \u003c= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-register-profile-with-shortcode",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Cookie Banner: GDPR \u0026 ePrivacy Cookie Consent \u003c= 5.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "real-cookie-banner",
    "type": "plugin",
    "affected_version": "* - 5.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1485",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Cookie Banner: GDPR \u0026 ePrivacy Cookie Consent \u003c= 5.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "real-cookie-banner-pro",
    "type": "plugin",
    "affected_version": "* - 5.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1485",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ArtPlacer Widget \u003c= 2.21.1 - Cross-Site Request Forgery",
    "slug": "artplacer-widget",
    "type": "plugin",
    "affected_version": "* - 2.21.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.21.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7269",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BookIt \u003c= 2.3.7 - Authentication Bypass",
    "slug": "bookit",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2834",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Create by Mediavine \u003c= 1.9.4 - Unauthenticated SQL Injection via 'id'",
    "slug": "mediavine-create",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-1711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1711",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TOCHAT.BE \u003c= 1.3.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "tochat-be",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37563",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XML Travel Portal Widget \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "oganro-reservation-widget",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49968",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-PhotoNav \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photonav Shortcode",
    "slug": "wp-photonav",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6383",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajax Comment Form CST \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ajax-comment-form-cst",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3867",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCafe \u003c= 2.2.32 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-cafe",
    "type": "plugin",
    "affected_version": "* - 2.2.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.32",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39452",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Video Sidebar Widgets \u003c= 6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "video-sidebar-widgets",
    "type": "plugin",
    "affected_version": "* - 6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4785",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quill Forms \u003c= 3.3.0 - Cross-Site Request Forgery",
    "slug": "quillforms",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46610",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "LoginPress \u003c= 3.3.1 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "loginpress",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1764",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Fastest Cache \u003c= 0.8.8.5 - Cross-Site Scripting via wpFastestCachePage options, wpFastestCachePreload_number or wpFastestCacheLanguage parameter",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 0.8.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-17585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17585",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 3.9.0 - Authentication Bypass",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2733",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rating by BestWebSoft \u003c= 1.7 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "rating-bws",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39527",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Health and Server Condition – Integrated with Google Page Speed \u003c= 4.1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-condition",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32520",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shopkeeper Extender \u003c= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shopkeeper-extender",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2801",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Easy Toggles \u003c= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-easy-toggles",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10190",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Tables For WPBakery Page Builder (formerly Visual Composer) \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcode",
    "slug": "pricing-tables-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10175",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Graphina \u003c= 3.1.1 - Unauthenticated Local File Inclusion",
    "slug": "graphina-elementor-charts-and-graphs",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23968",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Gallery Exporter \u003c= 1.3 - Authenticated (Administrator+) Arbitrary File Download",
    "slug": "wp-gallery-exporter",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-31342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31342",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Starbox – the Author Box for Humans \u003c= 3.4.7 - Insecure Direct Object Reference",
    "slug": "starbox",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0366",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Internal Links Generator \u003c= 3.51 - Reflected Cross-Site Scripting",
    "slug": "internal-links-generator",
    "type": "plugin",
    "affected_version": "* - 3.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23571",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Busiprof \u003c= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "busiprof",
    "type": "theme",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43262",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CMS Tree Page View \u003c= 1.6.7 - Reflected Cross-Site Scripting via 'post_type'",
    "slug": "cms-tree-page-view",
    "type": "plugin",
    "affected_version": "[*, 1.6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-30868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30868",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Importer \u003c= 0.8.3 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "wordpress-importer",
    "type": "plugin",
    "affected_version": "* - 0.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13889",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Shortcode by MyThemeShop \u003c= 1.4.16 - Cross-Site Request Forgery",
    "slug": "wp-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.4.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28495",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Grid \u003c= 2.2.50 -  Missing Authorization to Sensitive Information Exposure via REST API",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.50",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-40211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40211",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PowerPack Lite for Beaver Builder \u003c= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameter",
    "slug": "powerpack-addon-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12239",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH Maintenance Mode \u003c= 1.3.7 - Stored Cross-Site Scripting",
    "slug": "yith-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36841",
    "auth_type": "Privileged",
    "cvss_score": 6.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N"
  },
  {
    "title": "WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms \u003c= 1.1.3 - Cross-Site Request Forgery",
    "slug": "cf7-zendesk",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32269",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Options Editor \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "advanced-options-editor",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54249",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Private Files \u003c 2.0.5 - Insecure Direct Object Reference",
    "slug": "user-private-files",
    "type": "plugin",
    "affected_version": "[*, 2.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "affiliate-toolkit \u003c= 3.6.7 - Reflected Cross-Site Scripting",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10675",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "f(x) TOC \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fx-toc",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0490",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Elementor Addons \u003c= 1.3.8 - Missing Authorization",
    "slug": "better-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41656",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnDash LMS \u003c= 4.20.0.1 - Missing Authorization",
    "slug": "sfwd-lms",
    "type": "plugin",
    "affected_version": "* - 4.20.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.20.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24662",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Locatoraid Store Locator \u003c= 3.9.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "locatoraid",
    "type": "plugin",
    "affected_version": "* - 3.9.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32576",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woo Manage Fraud Orders \u003c= 2.6.1 - Reflected Cross-Site Scripting",
    "slug": "woo-manage-fraud-orders",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9937",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.0.3 -  IP Address Spoofing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2006-2702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-2702",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blogmentor – Blog Layouts for Elementor \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagination_style Parameter",
    "slug": "blogmentor",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4623",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Prune Posts \u003c= 1.8.0 - Cross-Site Request Forgery via admin_menu",
    "slug": "auto-prune-posts",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27423",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ProfileGrid \u003c= 5.8.6 - Missing Authorization",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5453",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CartBounty – Save and recover abandoned carts for WooCommerce \u003c= 8.2 - Cross-Site Request Forgery",
    "slug": "woo-save-abandoned-carts",
    "type": "plugin",
    "affected_version": "* - 8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47634",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Filter \u003c= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wordpress-filter",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54391",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 5.8.8 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-41955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41955",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hot Random Image \u003c= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hot-random-image",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29796",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Youzify \u003c= 1.0.6 - Stored Cross-Site Scripting",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LuckyWP Table of Contents \u003c= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "luckywp-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2953",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FAT Services Booking \u003c= 5.6 - Unauthenticated SQL Injection",
    "slug": "fat-services-booking",
    "type": "plugin",
    "affected_version": "* - 5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54221",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4478",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SUMO Reward Points \u003c= 30.7.0 - Unauthenticated Local File Inclusion",
    "slug": "rewardsystem",
    "type": "plugin",
    "affected_version": "* - 30.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "30.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32925",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Category and Taxonomy Meta Fields \u003c= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-custom-taxonomy-meta",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9590",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LOGIN AND REGISTRATION ATTEMPTS LIMIT\u003c= 2.1 - IP Address Spoofing to Protection Mechanism Bypass",
    "slug": "login-attempts-limit-wp",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4532",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) \u003c= 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update",
    "slug": "sky-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11104",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Industrial \u003c= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "industrial",
    "type": "theme",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13376",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP ALL Export Pro \u003c= 1.7.8 - Authenticated SQL Injection",
    "slug": "wp-all-export-pro",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3395",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Include Mastodon Feed \u003c= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "include-mastodon-feed",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11455",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CYAN Backup \u003c= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cyan-backup",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9663",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Saoshyant Element \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "saoshyant-element",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51646",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Upload Resume \u003c= 1.2.0 - Captcha Bypass via resume_upload_form",
    "slug": "resume-upload-form",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2751",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 4.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11227",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GD Rating System \u003c= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11198",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "301 Redirects - Easy Redirect Manager \u003c 2.51 - SQL Injection",
    "slug": "eps-301-redirects",
    "type": "plugin",
    "affected_version": "[*, 2.51)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.51",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24142",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Poll Maker \u003c= 5.7.7 - Unauthenticated Race Condition to Multi-Vote",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47545",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "root Cookie \u003c= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "root-cookie",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPKoi Templates for Elementor \u003c= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters",
    "slug": "wpkoi-templates-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4980",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPB Elementor Addons \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpb-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34791",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "belingoGeo \u003c= 1.12.0 - Unauthenticated Arbitrary File Download",
    "slug": "belingogeo",
    "type": "plugin",
    "affected_version": "* - 1.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47603",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook \u003c= 1.1.12 - Authenticated (Administrator+) SQL Injection",
    "slug": "forms-to-zapier",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32134",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Easy Image Collage \u003c= 1.13.5 - Missing Authorization to Authenticated (Contributor+) Data Clearance",
    "slug": "easy-image-collage",
    "type": "plugin",
    "affected_version": "* - 1.13.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5863",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Ultimate Video Player WordPress \u0026 WooCommerce Plugin \u003c= 10.1 - Unauthenticated Server-Side Request Forgery",
    "slug": "fwduvp",
    "type": "plugin",
    "affected_version": "* - 10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49430",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.11 - Reflected Cross-Site Scripting",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40196",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPAdverts \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpadverts",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39576",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Track Geolocation Of Users Using Contact Form 7 \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "track-geolocation-of-users-using-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49188",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accessibility Checker by Equalize Digital \u003c= 1.31.0 - Missing Authorization",
    "slug": "accessibility-checker",
    "type": "plugin",
    "affected_version": "* - 1.31.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58981",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Download Read More Excerpt Link \u003c= 1.6.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "read-more-excerpt-link",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1068",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WS Form LITE \u003c= 1.9.217 - Unauthenticated CSV Injection",
    "slug": "ws-form",
    "type": "plugin",
    "affected_version": "* - 1.9.217",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.217",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5424",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WS Form LITE \u003c= 1.9.217 - Unauthenticated CSV Injection",
    "slug": "ws-form-pro",
    "type": "plugin",
    "affected_version": "* - 1.9.217",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.217",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5424",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Planning Center Online Giving \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "planning-center-online-giving",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11502",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route",
    "slug": "integration-cds",
    "type": "plugin",
    "affected_version": "2.77 - 2.81",
    "from_version": "2.77",
    "from_inclusive": true,
    "to_version": "2.81",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7695",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AMP Img Shortcode \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "amp-img-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51576",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6088",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy YouTube Gallery \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-youtube-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24721",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LeadLab by wiredminds \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "wiredminds-leadlab",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31568",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TrustMate.io – WooCommerce integration \u003c= 1.14.0 - Cross-Site Request Forgery",
    "slug": "trustmate-io-integration-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58802",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ghostwriter \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "ghostwriter",
    "type": "theme",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23988",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) \u003c= 1.3.2 - Unauthenticated PHP Object Injection",
    "slug": "wholesalex",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30224",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sina Extension for Elementor \u003c= 3.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49262",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Penci Podcast \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "penci-podcast",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59584",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin \u003c= 2.2.1 - Reflected Cross-Site Scripting",
    "slug": "booking-and-rental-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12412",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Organization chart \u003c= 1.4.4 - Cross-Site Request Forgery",
    "slug": "organization-chart",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24384",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Upload Restriction \u003c= 2.2.4 - Missing Authorization Checks",
    "slug": "wp-upload-restriction",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34626",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HDW Player Plugin (Video Player \u0026 Video Gallery) \u003c= 2.4.2 - Authenticated (Admin+) SQL Injection",
    "slug": "hdw-player-video-player-video-gallery",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-5180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5180",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "EELV Newsletter \u003c 4.6.1 - Cross-Site Scripting",
    "slug": "eelv-newsletter",
    "type": "plugin",
    "affected_version": "[*, 4.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Contact form 7 DB \u003c= 1.8.7 - Stored Cross-Site Scripting",
    "slug": "advanced-cf7-db",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29408",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schedule \u003c= 1.0.0 - Unauthenticated SQL Injection",
    "slug": "schedule",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22523",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "yURL ReTwitt \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "yurl-retwitt",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9341",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON \u003c= 2.4.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47494",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quick Restaurant Menu \u003c= 2.0.2 - Cross-Site Request Forgery",
    "slug": "quick-restaurant-menu",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0554",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Tutor LMS \u003c= 2.7.1 - Authenticated (Admin+) Path Traversal",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-37266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37266",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form X \u003c= 2.4 - Reflected Cross-Site Scripting",
    "slug": "contact-form-x",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25601",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grand Restaurant WordPress \u003c= 7.0 - Missing Authorization",
    "slug": "grandrestaurant",
    "type": "theme",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39353",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nokaut Offers Box \u003c= 1.4.0 - Cross-Site Request Forgery to Plugin Setting Reset",
    "slug": "nokaut-offers-box",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10634",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI Engine \u003c= 2.2.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0378",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "eForm \u003c= 4.18.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-fsqm-pro",
    "type": "plugin",
    "affected_version": "* - 4.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.18.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1294",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zuppler Online Ordering \u003c= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "zuppler-online-ordering",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6053",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Checker \u003c= 1.11.19 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "broken-link-checker",
    "type": "plugin",
    "affected_version": "* - 1.11.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3922",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageInject \u003c= 1.18 - Authenticated (Admin+) Stored XSS",
    "slug": "wp-inject",
    "type": "plugin",
    "affected_version": "* - 1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4243",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anthologize \u003c= 0.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "anthologize",
    "type": "plugin",
    "affected_version": "* - 0.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44591",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GamiPress – The #1 gamification plugin to reward points, achievements, badges \u0026 ranks in WordPress \u003c= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 6.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1799",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Blocks \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-blocks",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49270",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FourSquare Checkins \u003c 1.3 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "foursquare-checkins",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-2709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2709",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "5 Stars Rating Funnel \u003c= 1.2.53 - Unauthenticated SQL Injection",
    "slug": "5-stars-rating-funnel",
    "type": "plugin",
    "affected_version": "* - 1.2.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.53",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0657",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Q2W3 Post Order \u003c= 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "q2w3-post-order",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47521",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Job Board by BestWebSoft \u003c= 1.0.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "job-board",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-125100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-125100",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode Redirect \u003c= 1.0.01 - Cross-Site Scripting",
    "slug": "shortcode-redirect",
    "type": "plugin",
    "affected_version": "* - 1.0.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-5325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5325",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Total Security \u003c= 3.4 - Cross-Site Scripting",
    "slug": "total-security",
    "type": "plugin",
    "affected_version": "[*, 3.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10898",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer \u003c= 3.10.8 - Unauthenticated Full Path Disclosure",
    "slug": "smartcrawl-seo",
    "type": "plugin",
    "affected_version": "* - 3.10.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6556",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Enhanced Text Widget \u003c= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "enhanced-text-widget",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0559",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Recent Posts \u003c= 0.6.14 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode",
    "slug": "advanced-recent-posts",
    "type": "plugin",
    "affected_version": "* - 0.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0212",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Encyclopedia / Glossary / Wiki \u003c= 1.7.60 - Reflected Cross-Site Scripting",
    "slug": "encyclopedia-lexicon-glossary-wiki-dictionary",
    "type": "plugin",
    "affected_version": "* - 1.7.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schema Pro \u003c= 2.7.7 - Cross-Site Request Forgery",
    "slug": "wp-schema-pro",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36682",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Gum Elementor Addon \u003c= 1.3.5 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "gum-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37565",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 1.4.12 - SQL Injection",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 1.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-11515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11515",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CWD 3D Image Gallery \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "cwd-3d-image-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49632",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Waitlist Woocommerce ( Back in stock notifier ) \u003c= 2.6 - Missing Authorization",
    "slug": "waitlist-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43134",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mindmeister Shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mindmeister-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23896",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.3 - Missing Authorization in 'regenerateSitemaps'",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1024",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multivendor Marketplace Solution for WooCommerce – WC Marketplace \u003c= 3.8.11.8 - Multiple Unprotected AJAX Actions",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 3.8.11.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.11.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2657",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "New Order Notification for Woocommerce \u003c= 2.0.2 - Missing Authorization",
    "slug": "new-order-notification-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31098",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Share Buttons Adder \u003c= 4.4 - Cross-Site Request Forgery",
    "slug": "simple-share-buttons-adder",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4717",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Return Refund and Exchange For WooCommerce \u003c= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "woo-refund-and-exchange-lite",
    "type": "plugin",
    "affected_version": "* - 4.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13692",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Project Manager \u003c= 2.6.22 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22649",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "fGallery 2.4.1 - SQL injection",
    "slug": "fgallery",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-0491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0491",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "WP Limit Login Attempts \u003c 2.0.1 - SQL Injection",
    "slug": "wp-limit-login-attempts",
    "type": "plugin",
    "affected_version": "[*, 2.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-6829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6829",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elemenda \u003c= 0.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "elemenda",
    "type": "plugin",
    "affected_version": "* - 0.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9373",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FileOrganizer \u003c= 1.0.7 - Sensitive Information Exposure via Directory Listing",
    "slug": "fileorganizer",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5599",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPGraphQL \u003c= 0.2.3 - Information Exposure",
    "slug": "wp-graphql",
    "type": "plugin",
    "affected_version": "* - 0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9880",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Best WordPress Gallery Plugin – FooGallery \u003c= 2.4.7 -Authenticated(Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0604",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dropbox Folder Share \u003c= 1.9.7 - Unauthenticated Server-Side Request Forgery via 'link'",
    "slug": "dropbox-folder-share",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3025",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ExactMetrics \u003c= 8.1.0 - Missing Authorization",
    "slug": "google-analytics-dashboard-for-wp",
    "type": "plugin",
    "affected_version": "* - 8.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24750",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Super Testimonials \u003c= 3.0.0 - Cross-Site Request Forgery",
    "slug": "sola-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38345",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Tickets with Ticket Scanner \u003c= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "event-tickets-with-ticket-scanner",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6711",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lucas String Replace \u003c= 2.0.5 - Reflected Cross-Site Scripting",
    "slug": "lucas-string-replace",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Browsing History \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "browsing-history",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51885",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Just Custom Fields \u003c= 3.3.2 - Missing Authorization on AJAX Actions",
    "slug": "just-custom-fields",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46203",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BackWPup \u003c= 1.7.1 - Remote File Inclusion",
    "slug": "backwpup",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2011-4342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4342",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Dashboard Notes \u003c= 1.0.10 - Missing Authorization to Arbitrary Private Notes Update",
    "slug": "wp-dashboard-notes",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7239",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "authLdap \u003c= 2.5.8 - Cross-Site Request Forgery",
    "slug": "authldap",
    "type": "plugin",
    "affected_version": "* - 2.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41654",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Live Chat Support \u003c= 7.1.04 - Cross-Site Scripting",
    "slug": "wp-live-chat-support",
    "type": "plugin",
    "affected_version": "* - 7.1.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18507",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider by Soliloquy \u003c= 2.7.6 - Missing Authorization to Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "soliloquy-lite",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35775",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yogi \u003c= 2.9.0 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "yogi",
    "type": "theme",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24779",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.9.2 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2010-0682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-0682",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 8.1.18 - Cross-Site Request Forgery",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51521",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shield Security \u003c= 17.0.17 - Missing Authorization",
    "slug": "wp-simple-firewall",
    "type": "plugin",
    "affected_version": "[*, 17.0.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.0.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-0993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0993",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Online Order for Clover \u003c= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update",
    "slug": "clover-online-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7030",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stars Testimonials \u003c= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode",
    "slug": "stars-testimonials-with-slider-and-masonry-grid",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form \u0026 Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "2.0 - 2.13.9",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.13.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-7777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7777",
    "auth_type": "Privileged",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H"
  },
  {
    "title": "EventON \u003c= 4.9.9 - Missing Authorization",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47565",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP MMenu Lite \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-mmenu-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51705",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post State Tags \u003c= 2.0.6 - Cross-Site Request Forgery to Settings Reset",
    "slug": "post-state-tags",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32588",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Save as PDF by Pdfcrowd \u003c= 3.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "save-as-image-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3062",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Youzify – BuddyPress Community, User Profile, Social Network \u0026 Membership Plugin for WordPress \u003c= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13368",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FERMA.ru.net \u003c= 1.3.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "ferma-ru-net-checkout",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49620",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-GeoMeta 0.3.4 - 0.3.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via wp_ajax_wpgm_start_geojson_import Function",
    "slug": "wp-geometa",
    "type": "plugin",
    "affected_version": "0.3.4 - 0.3.5",
    "from_version": "0.3.4",
    "from_inclusive": true,
    "to_version": "0.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4103",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "1003 Mortgage Application \u003c= 1.87 - Missing Authorization",
    "slug": "1003-mortgage-application",
    "type": "plugin",
    "affected_version": "* - 1.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22591",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Accordion – Best Accordion FAQ Plugin for WordPress \u003c= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-accordion-free",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1363",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Flipclock \u003c= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-flipclock",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maan Addons For Elementor \u003c= 1.0.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "maan-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49251",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EAN for WooCommerce \u003c= 4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta Shortcode",
    "slug": "ean-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6892",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Evernote Sync \u003c= 3.0.0 - Reflected Cross-Site Scripting",
    "slug": "evernote-sync",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54422",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CF7 WOW Styler \u003c= 1.7.2 - Unauthenticated Local File Inclusion",
    "slug": "cf7-styler",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54028",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wishlist \u003c= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wishlist",
    "type": "plugin",
    "affected_version": "* - 1.0.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12809",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Album and Image Gallery with Lightbox – Flagallery Photo Portfolio \u003c 1.57 - Cross-Site Scripting",
    "slug": "flash-album-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.57)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.57",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-4624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4624",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment and Event Booking Calendar - Amelia \u003c 1.0.47 - Arbitrary File Upload",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "[*, 1.0.47)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.47",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0687",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RegistrationMagic - Custom Registration Forms \u003c= 3.7.9.2 - PHP Object Injection",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "[*, 3.7.9.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.9.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-20208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20208",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WD WidgetTwitter \u003c= 1.0.9 -  Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "widget-twitter",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5709",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Group category creator \u003c= 1.3.0.3 - Reflected Cross-Site Scripting",
    "slug": "group-category-creator",
    "type": "plugin",
    "affected_version": "* - 1.3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23603",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amelia \u003c= 1.0.98 - Missing Authorization",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.0.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.98",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22298",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Optimize Database after Deleting Revisions \u003c= 5.1.1 - Cross-Site Request Forgery via 'odb_start_manually'",
    "slug": "rvg-optimize-database",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25980",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce 8.8.0 - 8.9.2 - Reflected Cross-Site Scripting via Order Attribution",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "8.8.0 - 8.8.4",
    "from_version": "8.8.0",
    "from_inclusive": true,
    "to_version": "8.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37297",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce 8.8.0 - 8.9.2 - Reflected Cross-Site Scripting via Order Attribution",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "8.9.0 - 8.9.2",
    "from_version": "8.9.0",
    "from_inclusive": true,
    "to_version": "8.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37297",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WpTravelly \u003c= 1.8.7 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "tour-booking-manager",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30891",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Motors \u003c= 1.4.71 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32170",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Call Now Accessibility Button \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "accessibility-help-button",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28933",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seraphinite Post .DOCX Source \u003c= 2.16.9 - Missing Authorization",
    "slug": "seraphinite-post-docx-source",
    "type": "plugin",
    "affected_version": "* - 2.16.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38727",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Inventory Manager \u003c= 2.1.0.13 - Cross-Site Request Forgery via delete_item",
    "slug": "wp-inventory-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34002",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Off-Canvas Sidebars \u0026 Menus (Slidebars) \u003c= 0.5.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "off-canvas-sidebars",
    "type": "plugin",
    "affected_version": "* - 0.5.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30860",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Lister Lite for Amazon \u003c= 2.6.11 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-lister-for-amazon",
    "type": "plugin",
    "affected_version": "* - 2.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2889",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Blocks with Lightbox \u003c= 3.0.7 - Missing Authorization in pgc_sgb_action_wizard",
    "slug": "simply-gallery-block",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0441",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP-Recall – Registration, Profile, Commerce \u0026 More \u003c= 16.26.5 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32710",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4926",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Captcha by BestWebSoft \u003c= 5.2.0 - Captcha Bypass",
    "slug": "captcha-bws",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31295",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.11.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.11.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4774",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dashboard To-Do List \u003c= 1.2.0 - Missing Authorization via ardtdw_widgetsetup()",
    "slug": "dashboard-to-do-list",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35723",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpShopGermany IT-RECHT KANZLEI \u003c= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpshopgermany-it-recht-kanzlei",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37993",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Symposium \u003c 13.04 - Cross-Site Scripting",
    "slug": "wp-symposium",
    "type": "plugin",
    "affected_version": "[*, 13.04)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.04",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-2695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2695",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "PopAd \u003c= 1.0.4 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "popad",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60175",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UpStore \u003c= 1.7.0 - Reflected Cross-Site Scripting",
    "slug": "upstore",
    "type": "theme",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48296",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog2Social: Social Media Auto Post \u0026 Scheduler \u003c= 5.0.2 - Reflected Cross-Site Scripting",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "[*, 5.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-9576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9576",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Finale Lite \u003c= 2.18.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation",
    "slug": "finale-woocommerce-sales-countdown-timer-discount",
    "type": "plugin",
    "affected_version": "* - 2.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30485",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Wonder FontAwesome \u003c= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wonder-fontawesome",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seofy Core \u003c= 1.4.5 - Unauthenticated Local File Inclusion",
    "slug": "seofy-core",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39473",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooSidebars Sidebar Manager Converter \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "woosidebars-sbm-converter",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10115",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Custom Admin Interface \u003c= 7.32 - Missing Authorization to Transients Deletion",
    "slug": "wp-custom-admin-interface",
    "type": "plugin",
    "affected_version": "[*, 7.33)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.33",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44988",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "My Contador lesr \u003c= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export",
    "slug": "my-contador-wp",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11334",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Mollie for Contact Form 7 \u003c= 5.0.0 - Reflected Cross-Site Scripting",
    "slug": "cf7-mollie",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12165",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeachPay Payments \u003c= 1.117.4 - Missing Authorization",
    "slug": "peachpay-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.117.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.117.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58634",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "eCommerce Product Catalog for WordPress \u003c= 3.3.25 - Cross-Site Request Forgery",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "[*, 3.3.26)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.26",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5979",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Ticket Ultra Help Desk \u0026 Support Plugin \u003c= 1.0.5 - Unauthenticated Local File Inclusion",
    "slug": "wp-ticket-ultra",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-44011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44011",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cooked Pro \u003c= 1.7.5.5 - Reflected Cross-Site Scripting",
    "slug": "cooked-pro",
    "type": "plugin",
    "affected_version": "[*, 1.7.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24233",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Parsi Date \u003c= 5.1.1 - Reflected Cross-Site Scripting via add_query_arg Parameter",
    "slug": "wp-parsidate",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11032",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BoomBox Theme Extensions \u003c= 1.8.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode",
    "slug": "boombox-theme-extensions",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12859",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Opt-in \u003c= 1.4.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-opt-in",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2123",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Database Cleaner \u003c= 3.1.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "advanced-database-cleaner",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-49764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49764",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPMasterToolKit \u003c= 1.13.1 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "wpmastertoolkit",
    "type": "plugin",
    "affected_version": "* - 1.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56249",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Floating Social Buttons \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "floating-social-buttons",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6405",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Landing Page Builder – Free Landing Page Templates \u003c= 3.1.9.8 - Local File Inclusion via 'lpp_template_select'",
    "slug": "ultimate-landing-page",
    "type": "plugin",
    "affected_version": "* - 3.1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-24379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24379",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FormFacade \u003c= 1.3.2 - Reflected Cross-Site Scripting",
    "slug": "formfacade",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43313",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wise Chat \u003c= 3.1.3 - Cross-Site Request Forgery",
    "slug": "wise-chat",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32504",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Antioch \u003c= 1.3 - Arbitrary File Download",
    "slug": "antioch",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-10397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10397",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Lock User Account \u003c= 1.0.5 - User Lock Bypass",
    "slug": "lock-user-account",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11197",
    "auth_type": "Auth",
    "cvss_score": 4.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Dokan \u003c= 3.7.12 - Authenticated (Vendor+) SQL Injection",
    "slug": "dokan-lite",
    "type": "plugin",
    "affected_version": "* - 3.7.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-26525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26525",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "N5 Upload Form \u003c= 1.0 - Arbitrary File Upload",
    "slug": "n5-uploadform",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24223",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Local Magic \u003c= 2.6.0 - Unauthenticated SQL Injection",
    "slug": "local-magic",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32636",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Eazy Under Construction \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "eazy-under-construction",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24645",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classified Listing \u003c= 5.0.0 - Authenticated (Contributor+) Content Injection",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54698",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Restaurant Menu by MotoPress \u003c= 2.4.6 - Cross-Site Request Forgery",
    "slug": "mp-restaurant-menu",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54038",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "nuajik CDN \u003c= 0.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "nuajik-cdn",
    "type": "plugin",
    "affected_version": "* - 0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33210",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Skippy WP-DB Backup (Legacy Plugin) \u003c= 1.7 - Authenticated (Admin+) Directory Traversal",
    "slug": "wp-db-backup.php",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2006-4208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-4208",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "WP Lightbox 2 \u003c= 3.0.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "wp-lightbox-2",
    "type": "plugin",
    "affected_version": "* - 3.0.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45747",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integrate Dynamics 365 CRM \u003c= 1.0.9 - Missing Authorization",
    "slug": "integrate-dynamics-365-crm",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10746",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Leaflet Map \u003c= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "leaflet-map",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5050",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetFormBuilder \u003c= 3.5.1.2 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "jetformbuilder",
    "type": "plugin",
    "affected_version": "* - 3.5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53990",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Frontend File Manager \u003c= 22.7 - Sensitive Information Exposure via user uploads",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "* - 22.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "22.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25903",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multi-column Tag Map \u003c= 17.0.26 - Cross-Site Request Forgery",
    "slug": "multi-column-tag-map",
    "type": "plugin",
    "affected_version": "* - 17.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41651",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce POS \u003c= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure",
    "slug": "woocommerce-pos",
    "type": "plugin",
    "affected_version": "* - 1.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2384",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Chained Quiz Plugin \u003c 1.0 - Cross-Site Scripting",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "[*, 1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10892",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Taboola \u003c= 2.0.1 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "taboola",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38398",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords \u003c= 3.1 - Information Exposure",
    "slug": "muzaara-adwords-optimize-dashboard",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12159",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Modern Events Calendar \u003c= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery",
    "slug": "modern-events-calendar",
    "type": "plugin",
    "affected_version": "* - 7.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.12.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6522",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Modern Events Calendar \u003c= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 7.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.12.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6522",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.16.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8486",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Blocks \u003c= 1.1.0 - Cross-Site Request Forgery",
    "slug": "page-blocks",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9626",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Conferencing with Zoom \u003c= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "video-conferencing-with-zoom-api",
    "type": "plugin",
    "affected_version": "* - 4.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2031",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amazon Native Shopping Recommendations \u003c= 1.3 - Unauthenticated SQL Injection",
    "slug": "woozone-contextual",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30633",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Accessibility Helper  \u003c= 0.6.0.6 - Reflected Cross-Site Scripting via wahi",
    "slug": "wp-accessibility-helper",
    "type": "plugin",
    "affected_version": "[*, 0.6.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "ultraaddons-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4866",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Maintenance Mode \u003c= 2.0.6 - Authenticated Information Disclosure",
    "slug": "wp-maintenance-mode",
    "type": "plugin",
    "affected_version": "[*, 2.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20154",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Time Sheets \u003c= 1.29.2 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "time-sheets",
    "type": "plugin",
    "affected_version": "* - 1.29.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0893",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WorkScout - Job Board WordPress Theme \u003c= 2.0.31 - Stored Cross-Site Scripting",
    "slug": "workscout-core",
    "type": "plugin",
    "affected_version": "[*, 1.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24246",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WorkScout - Job Board WordPress Theme \u003c= 2.0.31 - Stored Cross-Site Scripting",
    "slug": "workscout",
    "type": "theme",
    "affected_version": "* - 2.0.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24246",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post to CSV by BestWebSoft \u003c= 1.3.8 - Authenticated (Author+) CSV Injection",
    "slug": "post-to-csv",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3393",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Track Logins \u003c= 1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "track-logins",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13608",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Firebase OTP Authentication \u003c= 1.0.1 - Missing Authorization to Privilege Escalation",
    "slug": "authentication-via-otp-using-firebase",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54294",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Brands for WooCommerce \u003c= 3.8.2.2 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval",
    "slug": "brands-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 3.8.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44149",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PayPal Marketing Solutions \u003c= 1.2 - Missing Authorization",
    "slug": "paypal-promotions-and-insights",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23930",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CardGate Payments for WooCommerce \u003c= 3.2.1 - Reflected Cross-Site Scripting",
    "slug": "cardgate",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12257",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bookly \u003c= 22.3.1 - Authenticated(Administrator+) SQL Injection",
    "slug": "bookly-responsive-appointment-booking-tool",
    "type": "plugin",
    "affected_version": "* - 22.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "22.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4691",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PHP/MySQL CPU performance statistics \u003c= 1.2.1 - Unauthenticated PHP Object Injection",
    "slug": "mywebtonet-performancestats",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22526",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email Subscription Popup \u003c= 1.2.20 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "email-subscribe",
    "type": "plugin",
    "affected_version": "* - 1.2.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27960",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime – Events Calendar, Bookings and Tickets \u003c= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1126",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WappPress \u003c= 5.0.3 - Unauthenticated Arbitrary File Upload",
    "slug": "wapppress-builds-android-app-for-website",
    "type": "plugin",
    "affected_version": "* - 5.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-49815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49815",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SMTP by BestWebSoft \u003c= 1.0.9 - Multiple Cross-Site Scripting",
    "slug": "bws-smtp",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18518",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Auto Tag \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "simple-auto-tag",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25153",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sheet2Site \u003c= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sheet2site",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31762",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2006-1263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-1263",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flex QR Code Generator \u003c= 1.2.5 - Unauthenticated Arbitrary File Upload",
    "slug": "flex-qr-code-generator",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-10041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10041",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sniplets \u003c 1.2.3 - Remote File Inclusion",
    "slug": "sniplets",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2008-1059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-1059",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Membership \u003c= 4.4.1 - Open Redirect",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22308",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextScripts: Social Networks Auto-Poster \u003c= 4.2.7 - Reflected Cross-Site Scripting",
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "type": "plugin",
    "affected_version": "[*, 4.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-9911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9911",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MaanStore API \u003c= 1.0.1 - Authentication Bypass via Account Takeover",
    "slug": "maanstore-api",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50487",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Falcon – WordPress Optimizations \u0026 Tweaks \u003c= 2.8.3 - Missing Authorization",
    "slug": "falcon",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54384",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.7.0 - Missing Authorization",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4223",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wishlist \u003c= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wishlist",
    "type": "plugin",
    "affected_version": "* - 1.0.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49075",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Video Player \u003c= 10.0 - Unauthenticated Arbitrary File Download",
    "slug": "fwduvp",
    "type": "plugin",
    "affected_version": "* - 10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10804",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Zynith SEO \u003c= 7.4.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "zynith-seo",
    "type": "plugin",
    "affected_version": "* - 7.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32562",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flash News / Post (Responsive) \u003c= 4.1 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "flashnews-fading-effect-pearlbells",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56012",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Blocks – WordPress Blocks Plugin \u003c= 3.1.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Multiple Blocks",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4268",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stockholm Core \u003c= 2.4.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "stockholm-core",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-34554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34554",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MBStore - Digital WooCommerce WordPress Theme \u003c= 2.3 - Unauthenticated Local File Inclusion",
    "slug": "mbstore",
    "type": "theme",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-28947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28947",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FancyPost \u003c= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-block",
    "type": "plugin",
    "affected_version": "* - 6.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31875",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Gallery - Responsive Photo Gallery \u003c= 1.0.7 - SQL Injection",
    "slug": "gallery-images",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-7153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7153",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Animation Addons for Elementor Pro \u003c= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation",
    "slug": "animation-addons-for-elementor-pro",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1639",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Bootstrap Gallery \u003c= 1.1 - Missing Authorization",
    "slug": "wp-bootstrap-gallery",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43471",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "AMP for WP – Accelerated Mobile Pages \u003c= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "accelerated-mobile-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.99.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.99.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9598",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI Engine \u003c= 2.4.7 - Authenticated (Admin+) SQL Injection",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6723",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP HRM LITE \u003c= 1.1 - Unauthenticated SQL Injection",
    "slug": "wp-hrm-lite-human-resource-management-system",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-46455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46455",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CPO Companion \u003c= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cpo-companion",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0162",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Performance Score Booster \u003c= 2.0 - Settings Change via Cross-Site Request Forgery",
    "slug": "wp-performance-score-booster",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24776",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Recipes manager - WPH \u003c= 1.0.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wph-recipes-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50011",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wordlift \u003c= 3.37.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wordlift",
    "type": "plugin",
    "affected_version": "* - 3.37.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.37.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3069",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.13",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.8",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.4",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.5",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.32",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.21",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.29",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.22",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.20",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.16",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.32",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.29",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.17",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.12",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.2",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.30",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.1 - Cross-Site Scripting in the Block Editor",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.26",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "List all posts by Authors, nested Categories and Title \u003c= 2.8.2 - Cross-Site Scripting",
    "slug": "list-all-posts-by-authors-nested-categories-and-titles",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49182",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Images Ape \u003c= 2.2.8 - Reflected Cross-Site Scripting",
    "slug": "gallery-images-ape",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22317",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Google Sheet Connector \u003c= 1.3.9 - Cross-Site Request Forgery",
    "slug": "wc-gsheetconnector",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2329",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Theme My Login 2FA \u003c 1.2 - 2FA Bypass via Brute Force",
    "slug": "tml-2fa",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6272",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Trust Payments Gateway for WooCommerce (JavaScript Library) \u003c= 1.3.6 - Cross-Site Request Forgery",
    "slug": "trust-payments-gateway-3ds2",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53569",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MemberSonic Lite Membership Site Plugin \u003c= 1.2 - Authentication Bypass",
    "slug": "membership-site",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-10971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10971",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PropertyHive \u003c= 2.0.5 - Unauthenticated PHP Object Injection via propertyhive_currency",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-23513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23513",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Customers Manager \u003c= 30.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "woocommerce-customers-manager",
    "type": "plugin",
    "affected_version": "* - 30.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "30.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lis Video Gallery \u003c= 0.2.1 - Unauthenticated PHP Object Injection",
    "slug": "lis-video-gallery",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52430",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Xin \u003c= 1.0.8.1 - Unauthenticated PHP Object Injection",
    "slug": "xin",
    "type": "theme",
    "affected_version": "* - 1.0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52412",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kognetiks Chatbot for WordPress \u003c= 2.1.7 - Reflected Cross-Site Scripting",
    "slug": "chatbot-chatgpt",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10684",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.24.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9939",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Permalink Manager Lite and Permalink Manager Pro \u003c= 2.4.3.1 - Reflected Cross-Site Scripting",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2738",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Permalink Manager Lite and Permalink Manager Pro \u003c= 2.4.3.1 - Reflected Cross-Site Scripting",
    "slug": "permalink-manager-pro",
    "type": "plugin",
    "affected_version": "* - 2.4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2738",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bitly URL Shortener \u003c= 1.4.1 - Cross-Site Request Forgery",
    "slug": "codehaveli-bitly-url-shortener",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30629",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "dForms \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "dforms",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23592",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podčlánková inzerce \u003c= 2.4.0 - Reflected Cross-Site Scripting",
    "slug": "podclankova-inzerce",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23697",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2919",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Masquerade \u003c= 1.1.0 - Authenticated (Subscriber+) Account Takeover",
    "slug": "wp-masquerade",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-33550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33550",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Calculated Fields Form \u003c= 1.1.120 - Cross-Site Request Forgery",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 1.1.120",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.120",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26523",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Check \u0026 Log email \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "check-email",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Contact Form DB \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "sb-elementor-contact-form-db",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-3133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-3133",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "3D Work In Progress \u003c= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "renee-work-in-progress",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49652",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Wound \u003c= 0.0.1 - Unauthenticated Local File Inclusion",
    "slug": "the-wound",
    "type": "theme",
    "affected_version": "* - 0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2558",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Related Sites \u003c= 2.2 - SQL Injection",
    "slug": "related-sites",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2009-2383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2383",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CTL Behance Importer Lite \u003c= 1.0 - Unauthenticated SQL Injection",
    "slug": "ctl-behance-importer-lite",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9587",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Porsline \u003c= 1.0.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "porsline",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51620",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Symposium \u003c= 11.11.26 - Cross-Site Scripting",
    "slug": "wp-symposium",
    "type": "plugin",
    "affected_version": "* - 11.11.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.11.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3841",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Solar Energy \u003c= 3.5 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "solar",
    "type": "theme",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32283",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Cross-Site Request Forgery via 'deleteCssAndJsCacheToolbar'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1927",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shield Security \u003c= 17.0.17 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-simple-firewall",
    "type": "plugin",
    "affected_version": "[*, 17.0.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.0.18",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-0992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0992",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Order Statuses for WooCommerce \u003c= 1.5.2 - Cross-Site Request Forgery",
    "slug": "custom-order-statuses-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25930",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "MultiManager WP – Manage All Your WordPress Sites Easily \u003c= 1.0.5 - Authentication Bypass via User Impersonation",
    "slug": "multimanager-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11028",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Import \u003c= 1.3.7 - Cross-Site Request Forgery",
    "slug": "advanced-import",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3677",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Order Delivery Date for WooCommerce 2.0 - 12.3.1- Unauthenticated Arbitrary Options Update",
    "slug": "order-delivery-date",
    "type": "plugin",
    "affected_version": "[2.0, 12.3.1)",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "12.3.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-2907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2907",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wallet System for WooCommerce \u003c= 2.6.7 - Cross-Site Request Forgery",
    "slug": "wallet-system-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54041",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Notification Bar for WordPress \u003c= 1.1.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "8-degree-notification-bar",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29476",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Instagram Feed – WordPress Plugin \u003c 1.3 - Reflected Cross-Site Scripting",
    "slug": "ultimate-instagram-feed",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-16758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16758",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPFront Notification Bar \u003c= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via wpfront-notification-bar-options[custom_class]",
    "slug": "wpfront-notification-bar",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0625",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Indeed Membership Pro \u003c= 12.7 - Unauthenticated PHP Object Injection",
    "slug": "indeed-membership-pro",
    "type": "plugin",
    "affected_version": "* - 12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43242",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pearl - Corporate Business \u003c 3.4.8 - Unauthenticated Local File Inclusion",
    "slug": "pearl",
    "type": "theme",
    "affected_version": "[*, 3.4.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-26986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26986",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wishlist for WooCommerce: Multi Wishlists Per Customer \u003c= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name",
    "slug": "wish-list-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13774",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Checkout for PayPal \u003c= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "checkout-for-paypal",
    "type": "plugin",
    "affected_version": "* - 1.0.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13398",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Private Content \u003c= 8.11.5 - Unauthenticated Privilege Escalation via Account Takeover",
    "slug": "private-content",
    "type": "plugin",
    "affected_version": "* - 8.11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.11.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26966",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Shamsi \u003c= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation",
    "slug": "wp-shamsi",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4555",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Showcase \u003c 25.05.13 - Missing Authorization",
    "slug": "team-showcase-cm",
    "type": "plugin",
    "affected_version": "[*, 25.05.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "25.05.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-49248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49248",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Free Woocommerce Product Table View \u003c= 1.78 - Missing Authorization to Arbitrary Content Deletion",
    "slug": "free-product-table-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.78",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.78",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31758",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-WebAuthn \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-webauthn",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47650",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CYAN Backup \u003c= 2.5.3 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "cyan-backup",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52390",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Woomotiv \u003c= 3.6.1 - Unauthenticated SQL Injection",
    "slug": "woomotiv",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12416",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "File Manager \u003c= 3.0 - Unauthenticated Arbitrary File Upload/Download",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-25105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-25105",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rehub \u003c= 19.6.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "rehub-theme",
    "type": "theme",
    "affected_version": "* - 19.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-31233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31233",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CM Answers \u003c= 3.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cm-answers",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25992",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ActiveCampaign for WooCommerce \u003c= 1.9.6 - Missing Authorization to Error Log Deletion",
    "slug": "activecampaign-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3923",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Calculator Builder – Create an Online Calculator \u003c= 1.6.2 - Unauthenticated Local File Inclusion",
    "slug": "calculator-builder",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26760",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JetPopup \u003c= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-popup",
    "type": "plugin",
    "affected_version": "* - 2.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53994",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PayMaster for WooCommerce \u003c= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "woocommerce-paymaster-gateway-019",
    "type": "plugin",
    "affected_version": "* - 0.4.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6729",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BadgeOS \u003c= 3.7.1.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "badgeos",
    "type": "plugin",
    "affected_version": "* - 3.7.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2958",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SmartCrawl SEO checker, analyzer \u0026 optimizer \u003c= 3.14.3 - Missing Authorization to Plugin Settings Update",
    "slug": "smartcrawl-seo",
    "type": "plugin",
    "affected_version": "* - 3.14.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11163",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Seraphinite Accelerator \u003c= 2.20.47 - Unauthenticated Sensitive Information Exposure via Log File",
    "slug": "seraphinite-accelerator",
    "type": "plugin",
    "affected_version": "* - 2.20.47",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.47",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22138",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "stats \u003c= 1.0 - Stored Cross-Site Scripting",
    "slug": "stats",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-3288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-3288",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uploader \u003c= 1.0.4 - Multiple Cross-Site Scripting",
    "slug": "uploader",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2287",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Barcode Generator for WooCommerce \u003c= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "embedding-barcodes-into-product-pages-and-orders",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31879",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Clients \u003c= 1.1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "clients",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54245",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conversion Helper \u003c= 1.12 - Reflected Cross-Site Scripting",
    "slug": "conversion-helper",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10676",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.7.2.4 - Reflected Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.7.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39594",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wA11y – The Web Accessibility Toolbox \u003c= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wa11y",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30623",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageMeta \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "imagemeta",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23845",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Maker \u003c= 1.14.11 - Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.14.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1564",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BSK Forms Blacklist \u003c= 3.6.2 - Authenticated (Administrator+) SQL Injection via 'order' and 'orderby'",
    "slug": "bsk-gravityforms-blacklist",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-30872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30872",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPGlobus Translate Options \u003c= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wpglobus-translate-options",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9434",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Webmaster Tools \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "webmaster-tools",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46093",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "License Manager for WooCommerce \u003c= 3.0.9 - Reflected Cross-Site Scripting",
    "slug": "license-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accessibility Suite by Online ADA \u003c= 4.12 - Authenticated (Subscriber+) SQL Injection",
    "slug": "online-accessibility",
    "type": "plugin",
    "affected_version": "* - 4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47420",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Login History \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "user-login-history",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47676",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Internal Link Building \u003c= 1.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "internal-link-building-plugin",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46192",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Flipbook, 3D Flipbook WordPress – DearFlip Lite \u003c= 1.7.12 - Contributor+ Stored Cross-Site Scripting",
    "slug": "3d-flipbook-dflip-lite",
    "type": "plugin",
    "affected_version": "* - 1.7.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24732",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Store Locator WordPress \u003c= 1.4.9 - Authenticated (Editor+) Stored Cross-Site Scripting via 'category_name', 'description', 'description_2' parameters",
    "slug": "agile-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27618",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 3.9.6 - Cross-Site Request Forgery to Order Message Update",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3200",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Categories \u003c= 1.9.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-media-library-categories",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47596",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Portfolio Post \u003c= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "themify-portfolio-post",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-32970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-32970",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Power: Complete AI Pack \u003c= 1.8.89 - Unauthenticated Arbitrary File Upload",
    "slug": "gpt3-ai-content-generator",
    "type": "plugin",
    "affected_version": "* - 1.8.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.89",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10392",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Google Map \u003c= 1.8.0 - Subscriber+ Arbitrary Post Deletion and Plugin Settings Update",
    "slug": "gmap-embed",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25011",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WPBookit \u003c= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update",
    "slug": "wpbookit",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3811",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "what3words Address Field \u003c= 4.0.0 - Authenticated (Administrator+) Sensitive Information Exposure in class-w3w-autosuggest-public.php",
    "slug": "3-word-address-validation-field",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4428",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.17",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.17",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.14",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.11",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.5",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.2",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.1",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.15",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.14",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.7",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.6",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPZOOM Social Feed Widget \u0026 Block \u003c= 2.1.13 - Missing Authorization to Authenticated (Subscriber+) Instagram Image Deletion",
    "slug": "instagram-widget-by-wpzoom",
    "type": "plugin",
    "affected_version": "* - 2.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3662",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "DB Backup \u003c= 6.0 - Missing Authorization",
    "slug": "db-backup",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50031",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Database for Contact Form 7, WPforms, Elementor forms \u003c= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion",
    "slug": "contact-form-entries",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7384",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My YouTube Channel \u003c= 3.0.12.1 - Missing Authorization",
    "slug": "youtube-channel",
    "type": "plugin",
    "affected_version": "* - 3.0.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0447",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Side Cart Woocommerce (Ajax) \u003c= 2.0 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "side-cart-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0215",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import XML and RSS Feeds \u003c= 2.0.2 - Server-Side Request Forgery",
    "slug": "import-xml-feed",
    "type": "plugin",
    "affected_version": "[*, 2.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-24148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24148",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
  },
  {
    "title": "Nifty Newsletters \u003c= 4.0.23 – Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "sola-newsletters",
    "type": "plugin",
    "affected_version": "* - 4.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-34634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34634",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TeraWallet – For WooCommerce \u003c= 1.3.24 - Cross-Site Request Forgery via lock_unlock_terawallet",
    "slug": "woo-wallet",
    "type": "plugin",
    "affected_version": "* - 1.3.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36401",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Basic Contact Form \u003c= 20221201 - Reflected Cross-Site Scripting",
    "slug": "simple-basic-contact-form",
    "type": "plugin",
    "affected_version": "* - 20221201",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20221201",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4150",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Product Stickers for Woocommerce \u003c= 1.9.0 - Reflected Cross-Site Scripting",
    "slug": "custom-product-stickers-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28889",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GigPress \u003c= 2.3.10 - SQL Injection",
    "slug": "gigpress",
    "type": "plugin",
    "affected_version": "[*, 2.3.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9353",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booster for WooCommerce \u003c= 5.4.3 - Authentication Bypass",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 5.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-34646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34646",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Unlimited Elements for Elementor \u003c= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.107",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.107",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4779",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ghost Kit \u003c= 3.4.1 - Unauthenticated Local File Inclusion",
    "slug": "ghostkit",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53567",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Jquery Validation For Contact Form 7 \u003c= 5.2 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "jquery-validation-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2144",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Buttonizer - Smart Floating Action Button \u003c= 2.5.4 - Admin+ Stored Cross-Site Scripting",
    "slug": "buttonizer-multifunctional-button",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24992",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Feed \u003c= 6.5.2 - Missing Authorization to Settings Modification",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 6.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6883",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Widget Manager Light \u003c= 1.18 - Missing Authorization",
    "slug": "widget-manager-light",
    "type": "plugin",
    "affected_version": "* - 1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31768",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ConvertCalculator for WordPress \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and type Parameter",
    "slug": "convertcalculator",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10015",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment \u0026 Event Booking Calendar Plugin – Webba Booking \u003c= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update",
    "slug": "webba-booking-lite",
    "type": "plugin",
    "affected_version": "* - 5.0.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8432",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ads Booster by Ads Pro \u003c= 1.12 - Unauthenticated Local File Inclusion",
    "slug": "free-wp-booster-by-ads-pro",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52428",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2007-0541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-0541",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Polls CP \u003c= 1.0.76 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cp-polls",
    "type": "plugin",
    "affected_version": "* - 1.0.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.76",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8854",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada \u003c= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2311",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social LikeBox \u0026 Feed \u003c= 2.8.4 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "facebook-by-weblizar",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15781",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Subscribers – Free Web Push Notifications \u003c= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "subscribers-com",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22684",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 5.2.63 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 5.2.63",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.63",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13382",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NACC WordPress Plugin \u003c= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nacc-wordpress-plugin",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12506",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cost Calculator \u003c= 7.4 - Missing Authorization",
    "slug": "ql-cost-calculator",
    "type": "plugin",
    "affected_version": "* - 7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54047",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Maps Widget for Google Maps \u003c= 4.24 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "google-maps-widget",
    "type": "plugin",
    "affected_version": "* - 4.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1913",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 4.1.7 - Cross-Site Request Forgery",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30493",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Media Links \u003c= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "social-media-links",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39415",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smoothscroller \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "smoothscroller",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23811",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReviewX \u003c= 1.6.13 - Arbitrary Usermeta Update  to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "reviewx",
    "type": "plugin",
    "affected_version": "* - 1.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2833",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blizzard Quotes \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "blizzard-quotes",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53729",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yext \u003c= 1.1.3 - Missing Authorization",
    "slug": "yext",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60129",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Search and filter pro \u003c= 2.5.19 - Missing Authorization to Authenticated (Subscriber+) Post Meta Exposure",
    "slug": "search-filter-pro",
    "type": "plugin",
    "affected_version": "* - 2.5.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1528",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "IgniteUp – Coming Soon and Maintenance Mode \u003c= 3.4.0 - Information Disclosure",
    "slug": "igniteup",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17235",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Crisp Live Chat \u003c= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "crisp",
    "type": "plugin",
    "affected_version": "* - 0.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-43353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-43353",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EZPlayer \u003c= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ezplayer",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23950",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls \u0026 Member Access Subscriptions \u003c= 241114 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "s2member",
    "type": "plugin",
    "affected_version": "* - 241114",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "241114",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8326",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FluentCRM - Marketing Automation For WordPress \u003c= 2.8.01 - Insufficient Use of Hash as Authorization Control",
    "slug": "fluent-crm",
    "type": "plugin",
    "affected_version": "* - 2.8.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1430",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Careerfy \u003c 3.9.0 - Cross-Site Scripting",
    "slug": "careerfy",
    "type": "theme",
    "affected_version": "[*, 3.9.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1169",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cookies Enabler \u003c= 1.0.1 - Unauthenticated Local File Inclusion",
    "slug": "wp-cookies-enabler",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54380",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.38.9 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.38.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.38.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6979",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ListingPro Plugin \u003c= 2.9.4 - Unauthenticated SQL Injection",
    "slug": "listingpro-plugin",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-38795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38795",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Indexisto \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "indexisto",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000138",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.3 - Unauthorized Image File Upload",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-0587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0587",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Microblog Poster \u003c= 2.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "microblog-poster",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31435",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.9.33 - Simple Download Monitor \u003c= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "* - 3.9.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8977",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \u003c= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widget",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1428",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Product Catalogue \u003c= 5.2.15 - Cross-Site Request Forgery via reset_settings()",
    "slug": "ultimate-product-catalogue",
    "type": "plugin",
    "affected_version": "* - 5.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31921",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pie Register \u003c= 3.8.3.2 - Unauthenticated Arbitrary File Upload",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "* - 3.8.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-27957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27957",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Embed Google Fonts \u003c= 3.1.0 - Missing Authorization",
    "slug": "embed-google-fonts",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33925",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gallery \u003c= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "gallery",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26778",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Style Admin \u003c= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "style-admin",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23801",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Libre Form 2 \u003c= 2.0.8 - Sensitive Information Disclosure",
    "slug": "libreform",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-34867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34867",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Getwid – Gutenberg Blocks \u003c= 2.0.10 - Missing Authentication to MailChimp API key update",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6491",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wolmart | Multi-Vendor Marketplace WooCommerce Theme \u003c= 1.8.11 - Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmore",
    "slug": "wolmart",
    "type": "theme",
    "affected_version": "* - 1.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13793",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Ninja Forms \u003c= 3.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43999",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishlist for WooCommerce: Multi Wishlists Per Customer \u003c= 3.1.2 - Reflected Cross-Site Scripting",
    "slug": "wish-list-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56228",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobCareer | Job Board Responsive WordPress Theme \u003c 2.4 - Unauthenticated Arbitrary Password Reset",
    "slug": "jobcareer",
    "type": "plugin",
    "affected_version": "[*, 2.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-19488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19488",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JobCareer | Job Board Responsive WordPress Theme \u003c 2.4 - Unauthenticated Arbitrary Password Reset",
    "slug": "wp-jobhunt",
    "type": "plugin",
    "affected_version": "[*, 2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-19488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19488",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) \u003c= 7.6.4 - Authentication Bypass",
    "slug": "miniorange-login-openid",
    "type": "plugin",
    "affected_version": "* - 7.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2982",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Project Showcase \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gs-projects",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56261",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPKoi Templates for Elementor \u003c= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpkoi-templates-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57999",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter subscription optin module \u003c= 1.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "newsletter-subscription-widget-for-sendblaster",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48308",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooMS \u003c= 9.12 - Missing Authorization",
    "slug": "wooms",
    "type": "plugin",
    "affected_version": "* - 9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57957",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Rankchecker.io Integration \u003c= 1.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "rankchecker-io-integration",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28857",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4920",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ImageMapper \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "imagemapper",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5507",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bible Text \u003c= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bible-text",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5444",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Consent \u003c= 2.6.0 - Cross-Site Request Forgery to Bulk Delete",
    "slug": "webtoffee-gdpr-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8286",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Filterable Portfolio \u003c= 1.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "jungbillig-portfolio-gallery",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4234",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.8 - Reflected Cross-Site Scripting",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6161",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Notify Odoo \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "notify-odoo",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56299",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder Sandwich \u003c= 5.1.0 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Post Editing",
    "slug": "page-builder-sandwich",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1285",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Yandex.News Feed by Teplitsa \u003c= 1.12.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "yandexnews-feed-by-teplitsa",
    "type": "plugin",
    "affected_version": "* - 1.12.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25052",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.35 - Sensitive Information Disclosure",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "[*, 0.9.36)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.36",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36835",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Pricing Table Plugin \u003c= 3.6 - Unauthenticated SQL Injection",
    "slug": "arprice-responsive-pricing-table",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0867",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Visual Email Designer for WooCommerce \u003c= 1.7.1 - Authenticated (Author+) SQL Injection",
    "slug": "email-customizer-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3860",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Eventer \u003c= 3.9.6 - Unauthenticated SQL Injection",
    "slug": "eventer",
    "type": "plugin",
    "affected_version": "* - 3.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39481",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Photo Gallery, Images, Slider in Rbs Image Gallery \u003c= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UpdraftPlus \u003c= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage",
    "slug": "updraftplus",
    "type": "plugin",
    "affected_version": "* - 1.23.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32960",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spiffy XSPF Player \u003c= 0.1 - SQL Injection",
    "slug": "spiffy",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-3530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3530",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FlashCounter \u003c= 1.1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "flashcounter",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23978",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextGEN Gallery Plugin \u003c= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-7175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-7175",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DN Footer Contacts \u003c= 1.8 - Cross-Site Request Forgery",
    "slug": "dn-footer-contacts",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31839",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "customer-reviews-collector-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "widgets-for-alibaba-reviews",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "reviews-widgets-for-yelp",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "review-widgets-for-arukereso",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "widgets-for-thumbtack-reviews",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "widgets-for-ebay-reviews",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "widgets-for-zillow-reviews",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "widgets-for-aliexpress-reviews",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "review-widgets-for-foursquare",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "free-facebook-reviews-and-recommendations-widgets",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "wp-reviews-plugin-for-google",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "review-widgets-for-capterra",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "review-widgets-for-booking-com",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "review-widgets-for-hotels-com",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "reviews-widgets",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "review-widgets-for-tripadvisor",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "review-widgets-for-opentable",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "review-widgets-for-amazon",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "review-widgets-for-szallas-hu",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "review-widgets-for-airbnb",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by Trustindex.io \u003c= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload",
    "slug": "widgets-for-sourceforge-reviews",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48275",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.100 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.100",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.100",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43322",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Disqus Comment System \u003c 2.76 - Cross-Site Request Forgery",
    "slug": "disqus-comment-system",
    "type": "plugin",
    "affected_version": "[*, 2.76)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.76",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-5347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5347",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery \u003c= 1.5.66 - Authenticated Stored Cross-Site Scripting via Gallery Title",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.67)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.67",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24310",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hotel Booking \u003c= 3.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "nd-booking",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47498",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Confetti Fall Animation \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "confetti-fall-animation",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47641",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Permalink Manager Lite \u003c= 2.2.20.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.20.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.20.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4410",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider by 10Web \u003c= 1.2.51 - Admin+ Stored Cross-Site Scripting",
    "slug": "slider-wd",
    "type": "plugin",
    "affected_version": "* - 1.2.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1320",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simplr Registration Form Plus+ \u003c= 2.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change",
    "slug": "simplr-registration-form",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4213",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Automatic Newsletter Lite \u003c= 3.2.0 - Reflected Cross-Site Scripting",
    "slug": "easy-automatic-newsletter",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23879",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wr Age Verification \u003c= 2.0.0 - Unauthenticated SQL Injection",
    "slug": "wr-age-verification",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-55980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55980",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "YOP Poll \u003c= 6.4.2 - IP Spoofing via X-Forwarded-For header",
    "slug": "yop-poll",
    "type": "plugin",
    "affected_version": "* - 6.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1600",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz and Survey Master \u003c= 7.0.0 - Arbitrary File Upload",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "[*, 7.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-35949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35949",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IGIT Related Posts With Thumb Image After Posts \u003c=  4.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "igit-related-posts-with-thumb-images-after-posts",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46518",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.4 - Cross-Site Request Forgery to Arbitrary Post Deletion",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5382",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WPQA - Builder forms Addon For WordPress  \u003c= 5.4 - Unauthenticated Private Message Disclosure",
    "slug": "wpqa",
    "type": "plugin",
    "affected_version": "* - 5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1598",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.201 - Missing Authorization",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.201",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.201",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54714",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elegant Themes (Multiple Versions) - Arbitrary File Upload",
    "slug": "divi-builder",
    "type": "plugin",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35945",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elegant Themes (Multiple Versions) - Arbitrary File Upload",
    "slug": "Divi",
    "type": "theme",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35945",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elegant Themes (Multiple Versions) - Arbitrary File Upload",
    "slug": "extra",
    "type": "theme",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35945",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Citadela Listing \u003c= 5.18.1 - Unauthenticated Sensitive Information Exposure",
    "slug": "citadela-directory",
    "type": "plugin",
    "affected_version": "* - 5.18.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.18.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32086",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced Cron Manager – debug \u0026 control \u003c= 2.5.9 - Missing Authorization",
    "slug": "advanced-cron-manager",
    "type": "plugin",
    "affected_version": "* - 2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43154",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.24.7 - Missing Authorization",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.24.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39639",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "TrueBooker \u003c= 1.0.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "truebooker-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6925",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Duplicator \u003c= 2.31 - Missing Authorization via mtphr_duplicate_post",
    "slug": "post-duplicator",
    "type": "plugin",
    "affected_version": "* - 2.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Z-Downloads \u003c= 1.11.6 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG",
    "slug": "z-downloads",
    "type": "plugin",
    "affected_version": "* - 1.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8673",
    "auth_type": "Privileged",
    "cvss_score": 4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) \u003c= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1055",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Directory Kit \u003c= 1.3.5 - Reflected Cross-Site Scripting",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37487",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EZ SQL Reports Shortcode Widget and DB Backup \u003c= 5.25.08 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "elisqlreports",
    "type": "plugin",
    "affected_version": "* - 5.25.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.25.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30787",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Save as Image plugin by Pdfcrowd \u003c= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "save-as-image-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40665",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sitekit \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sitekit",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AWEOS WP Lock \u003c= 1.4.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "aweos-wp-lock",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47522",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smooth Scroll Page Up/Down Buttons \u003c= 1.3 - Cross-Site Scripting",
    "slug": "smooth-page-scroll-updown-buttons",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24331",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "W3 Total Cache \u003c= 2.1.3 - Reflected Cross-Site Scripting via extension",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "[*, 2.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24436",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.2.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4139",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.2.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "2.2 - 2.2.1",
    "from_version": "2.2",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4139",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coupon Affiliates \u003c= 5.4.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "woo-coupon-usage",
    "type": "plugin",
    "affected_version": "* - 5.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28992",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leaflet Map \u003c 3.0.0 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "leaflet-map",
    "type": "plugin",
    "affected_version": "* - 2.23.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.23.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24467",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "kk Star Ratings \u003c= 5.4.3 - IP Spoofing to Protection Mechanism Bypass",
    "slug": "kk-star-ratings",
    "type": "plugin",
    "affected_version": "* - 5.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36528",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Doctor Appointment Booking \u003c= 1.0.0 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "doctor-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27264",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1293",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flexible Custom Post Type \u003c 0.1.7 - Cross-Site Scripting",
    "slug": "flexible-custom-post-type",
    "type": "plugin",
    "affected_version": "[*, 0.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-5106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5106",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pulsating Chat Button \u003c= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "amin-chat-button",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup by Supsystic \u003c= 1.10.19 - Missing Authorization to Sensitive Information Exposure",
    "slug": "popup-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.10.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46197",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Property Lot Management System \u003c= 1.0 - Authenticated (Salesman+) Arbitrary File Upload",
    "slug": "plms",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49331",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Find and Replace All \u003c= 1.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "find-and-replace-all",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2311",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GNUPress \u003c= 0.2.9 - Reflected Cross-Site Scripting",
    "slug": "gnupress",
    "type": "plugin",
    "affected_version": "* - 0.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26565",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spacer \u003c= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information Disclosure",
    "slug": "spacer",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-10527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10527",
    "auth_type": "Auth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "IP2Location Country Blocker \u003c= 2.26.4 - Subscriber+ Arbitrary Country Ban",
    "slug": "ip2location-country-blocker",
    "type": "plugin",
    "affected_version": "* - 2.26.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.26.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25095",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Page Builder Gutenberg Blocks – CoBlocks \u003c= 3.1.12 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "coblocks",
    "type": "plugin",
    "affected_version": "* - 3.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7132",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register Premium \u003c 3.8.3.3 - Unauthenticated Arbitrary File Upload",
    "slug": "pie-register-premium",
    "type": "plugin",
    "affected_version": "[*, 3.8.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2024-53822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53822",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3957",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "TemplatesNext ToolKit \u003c= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "templatesnext-toolkit",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22310",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailChimp Subscribe Forms  \u003c= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mailchimp-subscribe-sm",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22727",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2 - Reflected Cross-Site Scripting via dnf",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4210",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Management Xtended \u003c= 2.4.4 - Cross-Site Request Forgery to Post Status Update",
    "slug": "admin-management-xtended",
    "type": "plugin",
    "affected_version": "[*, 2.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1599",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "A Simple Multilanguage Plugin \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "a-simple-multilanguage",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9854",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c=  4.4.6 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37418",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Links On Admin Dashboard Toolbar \u003c= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "customize-wpadmin",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25135",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Animator \u003c= 3.0.16 - Cross-Site Request Forgery",
    "slug": "scroll-triggered-animations",
    "type": "plugin",
    "affected_version": "* - 3.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54039",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Very Simple Contact Form \u003c= 11.5 - Captcha Bypass",
    "slug": "very-simple-contact-form",
    "type": "plugin",
    "affected_version": "* - 11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1801",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Geoportail Shortcode \u003c= 2.4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "geoportail-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share, Social Login and Social Comments Plugin – Super Socializer \u003c= 7.14 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey'",
    "slug": "super-socializer",
    "type": "plugin",
    "affected_version": "* - 7.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13230",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Participants Database \u003c= 2.4.9 - Cross-Site Request Forgery via _process_general",
    "slug": "participants-database",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31235",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Easy Custom CSS \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "easy-custom-css",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31395",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FundPress \u003c= 2.0.6 - Unauthenticated PHP Object Injection",
    "slug": "fundpress",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24601",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Facebook for WooCommerce \u003c= 1.9.12 - Cross-Site Request Forgery allowing Option Update",
    "slug": "facebook-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15841",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wpDataTables \u003c= 2.1.49 -  Authenticated (Contributor+) Stored Cross Site Scripting",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "* - 2.1.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.49",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23876",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Reset – Most Advanced WordPress Reset Tool (PRO) 5.00- 5.98 - Missing Authorization to Database Reset",
    "slug": "wp-reset",
    "type": "plugin",
    "affected_version": "5.00 - 5.98",
    "from_version": "5.00",
    "from_inclusive": true,
    "to_version": "5.98",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36909",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FastDup \u003c= 2.1.9 - Sensitive Information Exposure via Directory Listing",
    "slug": "fastdup",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6592",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile \u0026 User signup \u003c= 4.0.30 - Open Redirect",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4133",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsmatic \u003c= 1.3.4 - Unauthenticated Information Exposure via newsmatic_filter_posts_load_tab_content",
    "slug": "newsmatic",
    "type": "theme",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1587",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "The Business \u003c= 1.6.1 - Missing Authorization",
    "slug": "nrgbusiness",
    "type": "theme",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31630",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Personalization \u003c= 1.1.2 - Unauthenticated PHP Object Injection",
    "slug": "personalization-by-flowcraft",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52411",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Job Board \u003c= 2.10.5 - Missing Authorization",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "* - 2.10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47188",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Recent Posts Slider \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "recent-posts-slider",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35043",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Analytics by Monster Insights \u003c= 8.21.0 - Missing Authorization",
    "slug": "google-analytics-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 8.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.21.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52220",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Payflex Payment Gateway \u003c= 2.5.0 - Missing Authorization to Order Status Update",
    "slug": "payflex-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0619",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LH QR Codes \u003c= 1.06 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lh-qr-codes",
    "type": "plugin",
    "affected_version": "* - 1.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51572",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.3.21.1 - SQL Injection",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.3.21.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.21.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-15025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15025",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CM Tooltip Glossary  – Better SEO and UEX for your WP site \u003c= 3.3.4 - Reflected Cross-Site Scripting",
    "slug": "enhanced-tooltipglossary",
    "type": "plugin",
    "affected_version": "[*, 3.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-1000132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000132",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Invoice – Web Invoice and Billing \u003c= 4.1.0 - Missing Authorization",
    "slug": "wp-invoice",
    "type": "plugin",
    "affected_version": "[*, 4.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-11008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11008",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wp Time Machine \u003c= 3.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-time-machine",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3097",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Font Farsi \u003c= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "font-farsi",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2657",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Herd Effects \u003c= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mwp-herd-effect",
    "type": "plugin",
    "affected_version": "[*, 5.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4022",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ActivityPub \u003c= 0.17.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Content Exposure",
    "slug": "activitypub",
    "type": "plugin",
    "affected_version": "* - 0.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3707",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP-Lister Lite for eBay \u003c= 3.6.0 - Reflected Cross-Site Scripting",
    "slug": "wp-lister-for-ebay",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43306",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Community by PeepSo – Social Network, Membership, Registration, User Profiles \u003c= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7655",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HidePost \u003c= 2.3.8 - Cross-Site Request Forgery",
    "slug": "hidepost",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9896",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPBakery Visual Composer \u003c= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1805",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder by SiteOrigin \u003c= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter",
    "slug": "siteorigin-panels",
    "type": "plugin",
    "affected_version": "* - 2.31.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.31.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12240",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Round Robin Lead Distribution \u003c= 1.2.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "contact-form-7-round-robin-lead-distribution",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23784",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Simple Pay Lite Manager \u003c= 1.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "stripe-manager",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-55989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55989",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BetterLinks – Shorten, Track and Manage any URL \u003c= 1.2.5 - Stored Cross-Site Scripting",
    "slug": "betterlinks",
    "type": "plugin",
    "affected_version": "[*, 1.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24812",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GPX Viewer \u003c= 2.2.11 - Authenticated (Editor+) Path Traversal",
    "slug": "gpx-viewer",
    "type": "plugin",
    "affected_version": "* - 2.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.11",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-27274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27274",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Analytify \u003c= 5.2.1 - Missing Authorization to Unauthenticated Google Analytics Tracking ID Modification",
    "slug": "wp-analytify",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1584",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tutor LMS – eLearning and online course solution \u003c= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4279",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Redirect 404 Error Page to Homepage or Custom Page with Logs \u003c= 1.8.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "redirect-404-error-page-to-homepage-or-custom-page",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47530",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sitekit \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe' shortcode",
    "slug": "sitekit",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5071",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Manager \u003c= 1.6.6 - Missing Authorization to Arbitrary Popup Deletion",
    "slug": "popup-manager",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4124",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Bulk Delete Users by Email \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "bulk-delete-users-by-email",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4267",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Chat App \u003c= 3.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-whatsapp",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51370",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XV Random Quotes \u003c= 1.40 - Reflected Cross-Site Scripting",
    "slug": "xv-random-quotes",
    "type": "plugin",
    "affected_version": "* - 1.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13574",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Marketplace Items \u003c= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "marketplace-items",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12437",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bible SuperSearch \u003c= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via selector_height Parameter",
    "slug": "biblesupersearch",
    "type": "plugin",
    "affected_version": "* - 6.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8064",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6804",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Header Builder Plugin – Pearl \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "pearl-header-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4000",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Post \u003c= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via events_cal Shortcode",
    "slug": "event-post",
    "type": "plugin",
    "affected_version": "* - 5.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10186",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RealHomes \u003c= 4.3.6 - Unauthenticated Privilege Escalation",
    "slug": "realhomes",
    "type": "theme",
    "affected_version": "* - 4.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32444",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-ViperGB \u003c= 1.3.10 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "wp-vipergb",
    "type": "plugin",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9460",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Block For Mailchimp – Easy Mailchimp Form Integration \u003c= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery",
    "slug": "block-for-mailchimp",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10735",
    "auth_type": "Unauth",
    "cvss_score": 4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Ultimate Gift Card \u003c= 2.9.2 - Unauthenticated Arbitrary File Upload",
    "slug": "woocommerce-ultimate-gift-card",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8425",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GDPR Tools \u003c= 1.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "gdpr-tools",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26537",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery \u003c= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pixel-gallery",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7644",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PlainInventory \u003c= 3.1.6 - Unauthenticated PHP Object Injection",
    "slug": "z-inventory-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56291",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Piotnet Forms \u003c= 1.0.30 - Authenticated (Editor+) Path Traversal",
    "slug": "piotnetforms",
    "type": "plugin",
    "affected_version": "* - 1.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.30",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-32205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32205",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Go Maps (formerly WP Google Maps) \u003c= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3557",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web3 \u003c= 2.8.0 - Authentication Bypass",
    "slug": "web3-authentication",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6036",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CoBlocks \u003c= 3.1.13 - Missing Authorization",
    "slug": "coblocks",
    "type": "plugin",
    "affected_version": "* - 3.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24751",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WC Affiliate – A Complete WooCommerce Affiliate Plugin \u003c= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wf-export-all",
    "slug": "wc-affiliate",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12336",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Notif Bell \u003c= 0.9.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "notif-bell",
    "type": "plugin",
    "affected_version": "* - 0.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22496",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54006",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Narnoo Operator \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "narnoo-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23680",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jupiter X Core \u003c= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 4.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0366",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Realteo \u003c 1.2.4 - Missing Authorization",
    "slug": "realteo",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24238",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Extra File Types \u003c= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-extra-file-types",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24936",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom WooCommerce Checkout Fields Editor \u003c= 1.3.4 - Cross-Site Request Forgery",
    "slug": "add-fields-to-checkout-page-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58799",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4655",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One \u003c= 2.2.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "ai-auto-tool",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31564",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Transcoder \u003c= 1.3.5 - Cross-Site Request Forgery",
    "slug": "transcoder",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31305",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Crelly Slider \u003c= 1.3.4 - Arbitrary File Upload",
    "slug": "crelly-slider",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15866",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OptinMonster \u003c= 2.12.1 -  Authenticated (Subscriber+) Sensitive Information Disclosure via Shortcode",
    "slug": "optinmonster",
    "type": "plugin",
    "affected_version": "* - 2.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0772",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JoomSport – for Sports: Team \u0026 League, Football, Hockey \u0026 more \u003c= 5.2.5 - Authentciated (Admin+) SQL Injection via orderby",
    "slug": "joomsport-sports-league-results-management",
    "type": "plugin",
    "affected_version": "* - 5.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2717",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Event Manager \u003c= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-event-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.49",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2799",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SurveyJS: Drag \u0026 Drop WordPress Form Builder to create, style and embed multiple forms of any complexity \u003c= 1.12.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion via SurveyJS_DeleteFile",
    "slug": "surveyjs",
    "type": "plugin",
    "affected_version": "* - 1.12.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12544",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "vooPlayer v4 \u003c= 4.0.4 - Reflected Cross-Site Scripting",
    "slug": "vooplayer",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22565",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LifterLMS \u003c= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "* - 8.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2290",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Houzez Theme - Functionality \u003c= 3.2.2 - Authenticated (Seller+) SQL Injection",
    "slug": "houzez-theme-functionality",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5793",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_ajax_hrm_insert_employee AJAX Action",
    "slug": "hrm",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.2.17",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.2.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5953",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Astra Pro \u003c= 4.3.1 - Authenticated(Contributor+) Remote Code Execution via Metabox",
    "slug": "astra-addon",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-49830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49830",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JiangQie Official Website Mini Program \u003c= 1.8.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "jiangqie-official-website-mini-program",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30604",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "imaGenius \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "imagenius",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23772",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.15",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.10",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.9",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.19",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.18",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.11",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.5",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.1",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.21",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.21",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Shortcodes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.18",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relevanssi \u003c= 4.24.5 (Free) and \u003c= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights",
    "slug": "relevanssi-premium",
    "type": "plugin",
    "affected_version": "* - 2.27.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.27.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5016",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relevanssi \u003c= 4.24.5 (Free) and \u003c= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "* - 4.24.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5016",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 13.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4333",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.12.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29107",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All In One Redirection \u003c=  2.2.0 - Reflected Cross-Site Scripting",
    "slug": "all-in-one-redirection",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30506",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sign-up Sheets \u003c= 1.0.13 - Stored Cross-Site Scripting",
    "slug": "sign-up-sheets",
    "type": "plugin",
    "affected_version": "[*, 1.0.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24440",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Review Manager \u003c= 2.2.0 - Missing Authorization",
    "slug": "review-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Business Directory Plugin \u003c= 5.10.1 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "business-directory-plugin",
    "type": "plugin",
    "affected_version": "* - 5.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24179",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mail SMTP \u003c= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure",
    "slug": "wp-mail-smtp",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-6694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6694",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Surfer \u003c= 1.5.0.502 - Authenticated (Administrator+) SQL Injection",
    "slug": "surferseo",
    "type": "plugin",
    "affected_version": "* - 1.5.0.502",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0.502",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49299",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Team Circle Image Slider With Lightbox \u003c= 1.0.17 - Reflected Cross-Site Scripting",
    "slug": "circle-image-slider-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2604",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Poll Maker \u003c= 3.1 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "epoll-wp-voting",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-31240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31240",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Property 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in PayPal Registration",
    "slug": "property",
    "type": "plugin",
    "affected_version": "1.0.5 - 1.0.6",
    "from_version": "1.0.5",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5117",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Add custom content after post \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "add-custom-content-after-post",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23652",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woodmart \u003c= 7.0.4 - Unauthenticated Arbitrary Content Injection",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 7.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25790",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "URL Shortener \u003c= 3.0.7 - Missing Authorization",
    "slug": "exact-links",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28965",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPBulky \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpbulky-wp-bulk-edit-post-types",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30482",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BizLibrary \u003c= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bizlibrary",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0892",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Custom Code (LESS/CSS/JS) – Live editing \u003c= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-custom-code",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37536",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sparkle Elementor Kit \u003c= 2.0.9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "sparkle-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32157",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "List Related Attachments \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "list-related-attachments-widget",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26897",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CodeBard Help Desk \u003c= 1.1.1 - Cross-Site Request Forgery",
    "slug": "codebard-help-desk",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56222",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wordpress File Upload \u003c= 4.23.2 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "[*, 4.23.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.23.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4811",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-EMail \u003c= 2.68.2 - Cross-Site Request Forgery to Log Deletion",
    "slug": "wp-email",
    "type": "plugin",
    "affected_version": "[*, 2.69.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.69.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1630",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Highcompress Image Compressor \u003c= 5.0.0 - Missing Authorization via multiple AJAX actions",
    "slug": "high-compress",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40209",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Smart YouTube PRO \u003c= 4.3 - Cross-Site Request Forgery via handle_colorbox_options",
    "slug": "smart-youtube",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25475",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.30 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10562",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BulkPress \u003c= 0.3.5 - Reflected Cross-Site Scripting",
    "slug": "bulkpress",
    "type": "plugin",
    "affected_version": "* - 0.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9615",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Permalinks Customizer \u003c= 2.8.2 - Cross-Site Request Forgery via post_settings",
    "slug": "permalinks-customizer",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45103",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Auto Poster \u003c= 5.3.14 - Cross-Site Request Forgery via Multiple Functions",
    "slug": "social-auto-poster",
    "type": "plugin",
    "affected_version": "* - 5.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6751",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "MainWP Child \u003c= 4.4.1.1 - Information Disclosure via Back-Up Files",
    "slug": "mainwp-child",
    "type": "plugin",
    "affected_version": "* - 4.4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3132",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "rtMedia for WordPress, BuddyPress and bbPress \u003c= 4.6.15 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "buddypress-media",
    "type": "plugin",
    "affected_version": "* - 4.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5931",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.6 - Reflected Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0181",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "HTML5 Video Player \u003c= 2.5.26 - Unauthenticated SQL Injection",
    "slug": "html5-video-player",
    "type": "plugin",
    "affected_version": "* - 2.5.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5522",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "OAuth Server \u003c= 4.3.3 - Open Redirect",
    "slug": "oauth2-provider",
    "type": "plugin",
    "affected_version": "* - 4.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31253",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Kattene \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kattene",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32590",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscribe2 \u003c= 10.40 - Missing Authorization",
    "slug": "subscribe2",
    "type": "plugin",
    "affected_version": "* - 10.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1844",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 5.12.6 - Authenticated (Contributor+) Stored Cross Site Scripting",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 5.12.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25040",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hover Effects \u003c= 5.5 - Cross-Site Request Forgery",
    "slug": "image-hover-effects",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47552",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.8 - Arbitrary File Upload",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "[*, 1.5.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1409",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfect Portal Widgets \u003c= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "perfect-portal-widgets",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12527",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Popups \u003c= 1.1.1 - Cross-Site Request Forgery Bypass",
    "slug": "advanced-popups",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4421",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TS Comfort DB \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "ts-comfort-database",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22345",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 5.1.5 - Authenticated (Editor+) Path Traversal",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-54382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54382",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zalo Official Live Chat \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "zalo-official-live-chat",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46498",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BizCalendar Web \u003c= 1.1.0.25 - Reflected Cross-Site Scripting via 'tab'",
    "slug": "bizcalendar-web",
    "type": "plugin",
    "affected_version": "* - 1.1.0.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-RecentComments \u003c= 2.0.6 - Cross-Site Scripting",
    "slug": "wp-recentcomments",
    "type": "plugin",
    "affected_version": "[*, 2.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-1068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-1068",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery by BestWebSoft \u003c= 4.6.9 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "gallery-plugin",
    "type": "plugin",
    "affected_version": "* - 4.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0764",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.5.2 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2203",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Widget Settings Importer/Exporter Plugin \u003c= 1.5.3 - Unauthorized Widget Import to Stored Cross-Site Scripting",
    "slug": "widget-settings-importexport",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36769",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Easy PayPal Buy Now Button \u003c= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-ecommerce-paypal",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4628",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.4.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0614",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Sessions Time Monitoring Full Automatic \u003c= 1.0.8 - Unauthenticated SQL injection",
    "slug": "activitytime",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5203",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Import Export for WooCommerce \u003c= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function",
    "slug": "product-import-export-for-woo",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-1911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1911",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shariff Wrapper \u003c= 4.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shariff",
    "type": "plugin",
    "affected_version": "* - 4.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1450",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BCM Duplicate Menu \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "bcm-duplicate-menu",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58798",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BookingPress \u003c= 1.0.72 - Authenticated (Contributor+) SQL Injection",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.72",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-50841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50841",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FooGallery \u003c= 2.4.29 - Reflected Cross-Site Scripting",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 2.4.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22624",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mediabay - WordPress Media Library Folders \u003c= 1.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "mediabay",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28949",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JetBackup – WP Backup, Migrate \u0026 Restore \u003c= 1.3.9 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "backup",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36669",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \u003c= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.6.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2342",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Element Pack Lite - Addons for Elementor \u003c= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.10.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12851",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PopupAlly \u003c= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "popupally",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33639",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "More From Google \u003c= 0.0.2 - Reflected Cross-Site Scripting",
    "slug": "more-from-google",
    "type": "plugin",
    "affected_version": "* - 0.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38319",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Switch \u003c= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie",
    "slug": "wp-user-switch",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2546",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Awesome buttons \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode",
    "slug": "wp-awesome-buttons",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10148",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register Premium \u003c 3.8.3.3 - Unauthenticated Cross-Site Scripting",
    "slug": "pie-register-premium",
    "type": "plugin",
    "affected_version": "[*, 3.8.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-53821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53821",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Child Theme Creator \u003c= 1.5.4 - Reflected Cross-Site Scripting",
    "slug": "orbisius-child-theme-creator",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43276",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Go Animate \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "goanimate",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54397",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Upload Media By URL \u003c= 1.0.7 - Cross-Site Request Forgery via 'umbu_download'",
    "slug": "upload-media-by-url",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3720",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Meta Keywords \u0026 Description \u003c= 0.8 - Unauthenticated Local File Inclusion",
    "slug": "wp-meta-keywords-meta-description",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-46454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46454",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Inspectlet - User Session Recording and Heatmaps \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "inspectlet-heatmaps-and-user-session-recording",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49048",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X \u003c= 0.98 - Authenticated Stored Cross-Site Scripting",
    "slug": "free-sales-funnel-squeeze-pages-landing-page-builder-templates-make",
    "type": "plugin",
    "affected_version": "[*, 0.99)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.99",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-11508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11508",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Killer Theme Options \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "killer-theme-options",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23473",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.0.3 - Authenticated(Editor+) Stored Cross-Site Scripting",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6525",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 \u003c= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials",
    "slug": "wp2speed",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5810",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "3D Cover Carousel \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "3d-cover-carousel",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38318",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2803",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Timetable and Event Schedule by MotoPress \u003c= 2.4.1 - Unauthorised Event TimeSlot Deletion",
    "slug": "mp-timetable",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24583",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JS Help Desk \u003c= 2.9.2 - Unauthenticated SQL Injection",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30886",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Strong Testimonials \u003c= 2.40.0 - Stored Cross Site Scripting",
    "slug": "strong-testimonials",
    "type": "plugin",
    "affected_version": "* - 2.40.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.40.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-8549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8549",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Miniorange OTP Verification with Firebase \u003c= 3.6.0 - Unauthenticated Arbitrary User Password Change",
    "slug": "miniorange-firebase-sms-otp-verification",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9862",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Musicbox \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "musicbox",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13327",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by jegstudio \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "intrace",
    "type": "theme",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33685",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by jegstudio \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "travey",
    "type": "theme",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33685",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by jegstudio \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "startupzy",
    "type": "theme",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33685",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by jegstudio \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "zeever",
    "type": "theme",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33685",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by jegstudio \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "photology",
    "type": "theme",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33685",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by jegstudio \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "accountra",
    "type": "theme",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33685",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag'",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0383",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Putler Connector for WooCommerce \u003c= 2.12.0 - Missing Authorization via 'send_resync_request'",
    "slug": "woocommerce-putler-connector",
    "type": "plugin",
    "affected_version": "* - 2.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40326",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ad Buttons \u003c= 2.3.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "ad-buttons",
    "type": "plugin",
    "affected_version": "[*, 2.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18553",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit \u003c= 3.5.1 - Unauthenticated SQL Injection via 'automationId'",
    "slug": "wp-marketing-automations",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2186",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Variation Images Gallery for WooCommerce \u003c= 2.3.3 - Reflected Cross-Site Scripting via style",
    "slug": "woo-product-variation-gallery",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37894",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Popular Posts \u003c= 7.1.0 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "wordpress-popular-posts",
    "type": "plugin",
    "affected_version": "* - 7.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11733",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "iPages Flipbook \u003c= 1.4.6 - Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode",
    "slug": "ipages-flipbook",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4394",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.6.1 - Spoof Post Authorship",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-4340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4340",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "JQueryFileTree \u003c= 2.1.5 - Directory Traversal",
    "slug": "better-search-tmc",
    "type": "plugin",
    "affected_version": "* - 1.0.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.52",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1000170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000170",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JQueryFileTree \u003c= 2.1.5 - Directory Traversal",
    "slug": "admin-page-framework",
    "type": "plugin",
    "affected_version": "* - 3.8.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1000170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000170",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JQueryFileTree \u003c= 2.1.5 - Directory Traversal",
    "slug": "task-scheduler",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1000170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000170",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JQueryFileTree \u003c= 2.1.5 - Directory Traversal",
    "slug": "faculty-weekly-schedule",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1000170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000170",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JQueryFileTree \u003c= 2.1.5 - Directory Traversal",
    "slug": "read-offline",
    "type": "plugin",
    "affected_version": "* - 0.9.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1000170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000170",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JQueryFileTree \u003c= 2.1.5 - Directory Traversal",
    "slug": "revision-manager-tmc",
    "type": "plugin",
    "affected_version": "* - 2.7.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.91",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1000170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000170",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JQueryFileTree \u003c= 2.1.5 - Directory Traversal",
    "slug": "delightful-downloads",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1000170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000170",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ListingPro Reviews \u003c= 1.6 - Missing Authorization",
    "slug": "listingpro-reviews",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58667",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.9.1.1 - Server Side Request Forgery",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "[*, 3.10.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-51676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51676",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 8.1.10 - Excessive Quiz Attempts",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37984",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Timeline – Vertical and Horizontal timeline plugin \u003c= 3.6.7 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-timelines",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-47324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47324",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ACF On-The-Go \u003c= 1.0.1 -  Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update",
    "slug": "acf-on-the-go",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3071",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hummingbird \u003c= 3.9.1 - Cross-Site Request Forgery",
    "slug": "hummingbird-performance",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43117",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SHOUT \u003c= 3.5.3 - Reflected Cross-Site Scripting",
    "slug": "lbg-audio8-html5-radio_ads",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31925",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stockdio Historical Chart \u003c= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stockdio-historical-chart",
    "type": "plugin",
    "affected_version": "* - 2.8.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13349",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.4.34 - Authenticated OAuth Connection Key Disclosure",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.4.34.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.34.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24164",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Table of Contents Plus \u003c= 2408 - Cross-Site Request Forgery",
    "slug": "table-of-contents-plus",
    "type": "plugin",
    "affected_version": "* - 2408",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2408",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49250",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ZoomSounds \u003c= 6.91 - Unauthenticated PHP Object Injection",
    "slug": "dzs-zoomsounds",
    "type": "plugin",
    "affected_version": "* - 6.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.91",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47568",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Schema \u0026 Structured Data for WP \u0026 AMP \u003c= 1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute",
    "slug": "schema-and-structured-data-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5582",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kadence Blocks Pro \u003c= 2.3.7 - Authenticated (Contributor+) Information Exposure",
    "slug": "kadence-blocks-pro",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1330",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files \u003c= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode",
    "slug": "embed-any-document",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1043",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PropertyHive \u003c= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3607",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Ravpage \u003c= 2.16 - Reflected Cross-Site Scripting",
    "slug": "ravpage",
    "type": "plugin",
    "affected_version": "* - 2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29415",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vertical scroll slideshow gallery v2 \u003c= 9.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "vertical-scroll-slideshow-gallery-v2",
    "type": "plugin",
    "affected_version": "* - 9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49897",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Email Verification for WooCommerce \u003c= 2.8.10 - Unauthenticated SQL Injection",
    "slug": "emails-verification-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49305",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Move Addons for Elementor \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "move-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47364",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Integrations 1.0 - 1.3.10 - Multiple Cross-Site scripting",
    "slug": "contact-form-7-integrations",
    "type": "plugin",
    "affected_version": "1.0 - 1.3.10",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-6445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6445",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BuddyBoss Platform Pro \u003c= 2.7.01 - Authentication Bypass via Apple OAuth provider",
    "slug": "buddyboss-platform-pro",
    "type": "plugin",
    "affected_version": "* - 2.7.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.01",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1909",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "File Manager \u003c= 7.2.7 - Missing Authorization",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "* - 7.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37254",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fluent Forms \u003c= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9651",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Meta Data Manager \u003c= 1.4.3 - Authentciated (Admin+) Multisite Privilege Escalation",
    "slug": "post-meta-data-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13835",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Adaptive Images for WordPress \u003c= 0.6.66 - Local File Inclusion",
    "slug": "adaptive-images",
    "type": "plugin",
    "affected_version": "[*, 0.6.67)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.67",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-14205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14205",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "All In One WP Security \u003c= 5.2.4 - Protection Bypass of Renamed Login Page via URL Encoding",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 5.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-52147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52147",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "3DPrint Lite \u003c=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'printer_text'",
    "slug": "3dprint-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3430",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Control horas \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "control-horas",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11381",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Community by PeepSo \u003c= 6.4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9873",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Icons \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "file-icons",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27288",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swiss Toolkit For WP \u003c= 1.0.7 - Authenticated (Contributor+) Authentication Bypass",
    "slug": "swiss-toolkit-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5204",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pie Register - Basic \u003c= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "* - 3.8.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6069",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kv TinyMCE Editor Add Fonts \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "kv-tinymce-editor-fonts",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44470",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients Widget",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2203",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 2.1.10 - Missing Authorization",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57995",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Team Manager \u003c= 2.1.12 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-team-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-38704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38704",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Everest Forms \u003c= 2.0.3 - Unauthorized Form Submission via Disabled Forms",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51377",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "weichuncai(WP伪春菜) \u003c= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "weichuncai",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7686",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Customer Area \u003c= 8.2.1 - Insecure Direct Object Reference to Address Modification",
    "slug": "customer-area",
    "type": "plugin",
    "affected_version": "* - 8.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6741",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Activello \u003c= 1.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "activello",
    "type": "theme",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45849",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify – WooCommerce Product Filter \u003c= 1.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "themify-wc-product-filter",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2278",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Garden Gnome Package \u003c= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "garden-gnome-package",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5664",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zero Spam \u003c= 5.4.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "zero-spam",
    "type": "plugin",
    "affected_version": "* - 5.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32121",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.40",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.33",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.9",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.1 - 6.1.6",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.2 - 6.2.5",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.28",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.28",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.24",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.25",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.9",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.4 - 6.4.4",
    "from_version": "6.4",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.5 - 6.5.4",
    "from_version": "6.5",
    "from_inclusive": true,
    "to_version": "6.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.37",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.32",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.31",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.21",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.18",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.15",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.14",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.13",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.20",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.17",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.11",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.8",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.3 - 6.3.4",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32111",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Chalet-Montagne.com Tools \u003c= 2.7.8 - Reflected Cross-Site Scripting",
    "slug": "chalet-montagne-com-tools",
    "type": "plugin",
    "affected_version": "* - 2.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12586",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Attachment File Icons (AF Icons) \u003c= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "attachment-file-icons",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6309",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Crowdsignal Dashboard – Polls, Surveys \u0026 more \u003c= 3.0.11 - Reflected Cross-Site Scripting",
    "slug": "polldaddy",
    "type": "plugin",
    "affected_version": "* - 3.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51488",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Indeed Membership Pro \u003c= 12.7 - Reflected Cross-Site Scripting",
    "slug": "indeed-membership-pro",
    "type": "plugin",
    "affected_version": "* - 12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43241",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Job Manager \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "js-jobs",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58234",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grid Plus \u003c= 1.3.4 - Reflected Cross-Site Scripting via grid_id",
    "slug": "grid-plus",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46209",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 2.3.3 - Authenticated Arbitrary Post Deletion",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "[*, 2.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24281",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Porto Theme - Functionality \u003c= 2.11.1 - Unauthenticated SQL Injection",
    "slug": "porto-functionality",
    "type": "plugin",
    "affected_version": "* - 2.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-48738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48738",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c= 2.2.2 - Cross-Site Scripting via range Parameter",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-6313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6313",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Photo Gallery by Supsystic \u003c= 1.15.16 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gallery-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.15.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29921",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ERE Recently Viewed \u003c= 1.3 - Unauthenticated PHP Object Injection",
    "slug": "ere-recently-viewed",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-24797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24797",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple 301 Redirects Addon Bulk Uploader \u003c= 1.2.4 - Missing Authorization",
    "slug": "simple-301-redirects-addon-bulk-uploader",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15776",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 4.0.27 - Cross-Site Request Forgery",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32090",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ad Blocking Detector \u003c= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ad-blocking-detector",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22732",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Background Tile \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-background-tile",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23573",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magty \u003c= 1.0.6 - Unauthenticated Local File Inclusion",
    "slug": "magty",
    "type": "theme",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49280",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BookingPress \u003c 1.0.11 - SQL Injection",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "[*, 1.0.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0739",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Azure offload \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "wp-azure-offload",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22360",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP GoToWebinar \u003c= 15.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-gotowebinar",
    "type": "plugin",
    "affected_version": "* - 15.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38671",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Fonts \u003c= 3.1.4 - Reflected Cross-Site Scripting",
    "slug": "wp-google-fonts",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24935",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Database for Contact Form 7 \u003c= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cf7-database",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29103",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress 5.0.0-7.2.0 - Privilege Escalation via REST API",
    "slug": "buddypress",
    "type": "plugin",
    "affected_version": "5.0.0 - 7.2.0",
    "from_version": "5.0.0",
    "from_inclusive": true,
    "to_version": "7.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-21389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-21389",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Multiple Customer Addresses \u0026 Shipping \u003c= 21.6 - Missing Authorization leading to Authenticated (Subscriber+) Arbitrary Address Creation/Deletion/View/Updates",
    "slug": "woocommerce-multiple-customer-addresses",
    "type": "plugin",
    "affected_version": "[*, 21.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-0865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0865",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "My YouTube Channel \u003c= 3.23.3 - Cross-Site Request Forgery to Cache Deletion",
    "slug": "youtube-channel",
    "type": "plugin",
    "affected_version": "* - 3.23.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.23.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25987",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP File Manager \u003c= 6.4 - Unauthenticated Resource Access to Site Backups",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-24312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24312",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.6 - Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0182",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "The Pack Elementor addons \u003c= 2.1.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "the-pack-addon",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30845",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cyberus Key \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'uid' in 'cyberkey_settings' Plugin Setting",
    "slug": "cyberus-key",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28620",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seers \u003c= 8.1.1 - Missing Authorization via multiple AJAX actions",
    "slug": "seers-cookie-consent-banner-privacy-policy",
    "type": "plugin",
    "affected_version": "* - 8.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47515",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Media \u0026 Share Icons \u003c= 2.8.1 - Missing Authorization via handle_installation",
    "slug": "ultimate-social-media-icons",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34009",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Themes Coder – Create Android \u0026 iOS Apps For Your Woocommerce Site \u003c= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation",
    "slug": "tc-ecommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12402",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All-In-One Security (AIOS) – Security and Firewall \u003c= 5.0.8 - IP Spoofing to Protection Mechanism Bypass",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "* - 5.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4097",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Simple Charts \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-charts",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13581",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arya Multipurpose \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "arya-multipurpose",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27420",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wordable \u003c= 3.1.1 - Authentication Bypass",
    "slug": "wordable",
    "type": "plugin",
    "affected_version": "[*, 3.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-36724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36724",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SKT Blocks – Gutenberg based Page Builder \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-blocks",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3276",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Specia Companion \u003c= 4.8 - Missing Authorization",
    "slug": "specia-companion",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32212",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Category Post List Widget \u003c= 2.0 - Unauthenticated Stored Cross-Site Scripting via custom_css",
    "slug": "category-post-list-widget",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47516",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Calendar – Google Calendar Plugin \u003c 2.0.4 - Reflected Cross-Site Scripting",
    "slug": "google-calendar-events",
    "type": "plugin",
    "affected_version": "[*, 2.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-7138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7138",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SwiftXR (3D/AR/VR) Viewer \u003c= 1.0.7 - Cross-Site Request Forgery",
    "slug": "swiftxr-3darvr-viewer",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32248",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Splash Sync \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "splash-connector",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11368",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Delivery Date for WooCommerce – Lite \u003c= 2.7.2 - Missing Authorization",
    "slug": "product-delivery-date-for-woocommerce-lite",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38702",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Styler for Ninja Forms \u003c= 3.3.4 - Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license",
    "slug": "styler-for-ninja-forms-lite",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10717",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Project Manager  \u003c= 2.6.22 - Cross-Site Request Forgery",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32280",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pardakht Delkhah \u003c= 2.9.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "pardakht-delkhah",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4307",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-in-One Addons for Elementor – WidgetKit \u003c= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget",
    "slug": "widgetkit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2330",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Status Notifier Lite and Premium \u003c= 1.11.6 - Reflected Cross-Site Scripting via page",
    "slug": "post-status-notifier",
    "type": "plugin",
    "affected_version": "* - 1.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10048",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Status Notifier Lite and Premium \u003c= 1.11.6 - Reflected Cross-Site Scripting via page",
    "slug": "post-status-notifier-lite",
    "type": "plugin",
    "affected_version": "* - 1.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10048",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flash Photo Gallery \u003c= 0.7 - Cross-Site Scripting",
    "slug": "flash-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4529",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Post Grid \u003c= 7.7.11 - Authenticated (Contributor+) Information Disclosure",
    "slug": "the-post-grid",
    "type": "plugin",
    "affected_version": "* - 7.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7418",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FileOrganizer \u003c= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "fileorganizer",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7985",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cost of Goods for WooCommerce \u003c= 2.8.6 - Missing Authorization in save_costs",
    "slug": "cost-of-goods-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23868",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Chat Bubble \u003c= 2.3 - Cross-Site Request Forgery via cbb_submit_settings_data",
    "slug": "chat-bubble",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48769",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WooCommerce Recargo de Equivalencia \u003c= 1.6.24 - Cross-Site Request Forgery",
    "slug": "woo-recargo-de-equivalencia",
    "type": "plugin",
    "affected_version": "* - 1.6.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27342",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Captcha Code \u003c= 2.7 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "captcha-code-authentication",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-37411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37411",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Borderless – Widgets, Elements, Templates and Toolkit for Elementor \u0026 Gutenberg \u003c= 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "borderless",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10867",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliates Manager \u003c= 2.9.30 - Sensitive Information Exposure via Log File",
    "slug": "affiliates-manager",
    "type": "plugin",
    "affected_version": "* - 2.9.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52148",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AGP Font Awesome Collection \u003c= 3.2.4 - Cross-Site Request Forgery",
    "slug": "agp-font-awesome-collection",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45749",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Contact Form III \u003c= 1.6.2d - Reflected Cross-Site Scripting",
    "slug": "wp-contact-form-iii",
    "type": "plugin",
    "affected_version": "* - 1.6.2d",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2d",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26560",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Fonts Typography \u003c= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via blockType arguments",
    "slug": "olympus-google-fonts",
    "type": "plugin",
    "affected_version": "[*, 3.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24637",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Green Wallet Gateway \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "greenwallet-gateway",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1673",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Elementor Addons \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "better-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30423",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Instant Images – One Click Unsplash, Pixabay and Pexels Uploads \u003c= 4.4.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "instant-images",
    "type": "plugin",
    "affected_version": "* - 4.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24334",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HQ Rental Software \u003c= 1.5.29 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "hq-rental-software",
    "type": "plugin",
    "affected_version": "* - 1.5.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.29",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11689",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Feedify – Web Push Notifications \u003c= 2.4.2 - Reflected Cross-Site Scripting",
    "slug": "push-notification-by-feedify",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11811",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export customers list csv for WooCommerce \u003c= 2.0.67 - CSV Injection",
    "slug": "export-woocommerce-customer-list",
    "type": "plugin",
    "affected_version": "* - 2.0.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.67",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3603",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relevanssi Premium \u003c 1.14.6.1 - SQL Injection",
    "slug": "relevanssi-premium",
    "type": "plugin",
    "affected_version": "[*, 1.14.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.6.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10949",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photographer Connections \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "photographer-connections",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52340",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp2android \u003c= 1.1.4 - Arbitrary File Upload",
    "slug": "wp2android-turn-wp-site-into-android-app",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002003",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Meks Easy Social Share \u003c= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "meks-easy-social-share",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2574",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Database for Contact Form 7, WPforms, Elementor forms \u003c= 1.3.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contact-form-entries",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3715",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Sitemap – Create a Responsive HTML Sitemap \u003c= 3.6.0 - Missing Authorization",
    "slug": "simple-sitemap",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39413",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Slider by Ays- Responsive Slider and Carousel \u003c 2.5.0 - SQL Injection",
    "slug": "ays-slider",
    "type": "plugin",
    "affected_version": "[*, 2.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24463",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Age Verification / Restriction for WordPress \u003c= 3.0.2 - Unauthenticated Arbitrary File Download",
    "slug": "age-restriction",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49403",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Advanced Search \u003c= 1.1.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "advance-search",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3265",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ECT Add to Cart Button \u003c= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ect-add-to-cart-button",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23471",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bootstrap Buttons \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "bootstrap-buttons",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49677",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon Page – Responsive Coming Soon \u0026 Maintenance Mode \u003c= 1.1.18 - Cross-Site Scripting via counter_title parameter",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5662",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdsPlace'r – Ad Manager, Inserter, AdSense Ads \u003c= 1.1.5 - Reflected Cross-Site Scripting",
    "slug": "adsplacer",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31088",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mollie Forms \u003c= 2.6.3 - Missing Authorization to Arbitrary Post Duplication",
    "slug": "mollie-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1400",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress SQL Backup \u003c= 3.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wordpress-sql-backup",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30608",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobSearch \u003c= 2.9.0 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49978",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Antisnews \u003c= 1.09 - Cross-Site Scripting",
    "slug": "antisnews",
    "type": "theme",
    "affected_version": "* - 1.09",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.09",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3857",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.6.6 - Privilege Escalation via Arbitrary User Meta Updates",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-3460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3460",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UW Freelancer \u003c= 0.1 - Reflected Cross-Site Scripting",
    "slug": "uw-freelancer",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51706",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management System – WPSchoolPress \u003c= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation",
    "slug": "wpschoolpress",
    "type": "plugin",
    "affected_version": "* - 2.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9637",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Content Shortcode \u003c= 4.0.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "custom-content-shortcode",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24826",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.1 - Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.3",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3440",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.1 - Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.3",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3440",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.1 - Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3440",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Entries \u003c= 1.3.0 - Authenticated (Contributor+) SQL Injection via shortcode",
    "slug": "contact-form-entries",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-31212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31212",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Link Library \u003c= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2889",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Login New User After Registration \u003c= 1.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via alnuar_auto_login_new_user_after_registration_redirect",
    "slug": "auto-login-new-user-after-registration",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46201",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "dhtmlxSpreadsheet \u003c= 2.0 - Cross-Site Scripting",
    "slug": "dhtmlxspreadsheet",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6281",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment and Event Booking Calendar for WordPress – Amelia \u003c= 1.0.47 - Information Disclosure and SMS Spam",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "[*, 1.0.48)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.48",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0837",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Revolution \u003c= 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title Attributes",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.7.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4581",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventCalendar \u003c= 1.1.21 - Cross-Site Scripting",
    "slug": "event-calendar-wd",
    "type": "plugin",
    "affected_version": "* - 1.1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-16164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16164",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2126",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Compress – Instant Performance \u0026 Speed Optimization \u003c= 6.30.03 - Reflected Cross-Site Scripting via custom_server Parameter",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.30.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.30.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12047",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jupiter X Core \u003c= 4.8.5 - Missing Authorization to Authenticated Library Sync",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 4.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Beam me up Scotty – Back to Top Button \u003c= 1.0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "beam-me-up-scotty",
    "type": "plugin",
    "affected_version": "* - 1.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31864",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Share Buttons Adder \u003c= 8.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-share-buttons-adder",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4094",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVPMaker \u003c= 6.1.9 - SQL Injection",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 6.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-15646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15646",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "File Manager Pro \u003c= 8.3.4 - Reflected Cross-Site Scripting",
    "slug": "wp-file-manager-pro",
    "type": "plugin",
    "affected_version": "* - 8.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7015",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPress \u003c= 11.0.6 - Authenticated (Contributor+) Server-Side Request Forgery via wp_ajax_powerpress_media_info",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 11.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41239",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4482",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radio Player \u003c= 2.0.73 - Missing Authorization to Player Deletion",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "* - 2.0.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4024",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP SimpleMail \u003c= 1.0.6 - Cross-Site Scripting",
    "slug": "wp-simplemail",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-2579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2579",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flickr set slideshows \u003c= 0.9 - Authenticated (Subscriber+) SQL Injection",
    "slug": "flickr-set-slideshows",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30589",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "myCred – Points, Rewards, Gamification, Ranks, Badges \u0026 Loyalty Plugin \u003c= 2.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32711",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Content Control \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "content-control",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4509",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Book Landing Page \u003c= 1.2.3 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "book-landing-page",
    "type": "theme",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37230",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BERTHA AI Plugin \u003c= 1.11.10.7 - Unauthenticated Arbitrary File Upload",
    "slug": "bertha-ai-free",
    "type": "plugin",
    "affected_version": "[*, 1.11.10.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.10.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-51419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51419",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IP Loc8 \u003c= 1.1 - Unauthenticated PHP Object Injection",
    "slug": "ip-loc8",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-48028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48028",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Appointments \u003c= 3.11.9 - Cross-Site Request Forgery via multiple AJAX actions",
    "slug": "easy-appointments",
    "type": "plugin",
    "affected_version": "* - 3.11.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36424",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Royal Core \u003c= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "royal-core",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12129",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blocksy Companion \u003c= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blocksy-companion",
    "type": "plugin",
    "affected_version": "* - 2.0.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2392",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bricks \u003c= 1.8.1 - Cross-Site Request Forgery via save_settings",
    "slug": "bricks",
    "type": "theme",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3408",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder – Contact forms and much more \u003c= 8.5.6 - Missing Authorization via restore_records()",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0907",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Background Takeover \u003c 4.1.5 - Directory Traversal",
    "slug": "wpsite-background-takeover",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-9118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-9118",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Control Listings \u003c= 1.0.4.1 - Reflected Cross-Site Scripting",
    "slug": "control-listings",
    "type": "plugin",
    "affected_version": "* - 1.0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46234",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Map \u003c= 1.1 - Cross-Site Scripting",
    "slug": "custom-map",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17744",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UnGallery \u003c= 2.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ungallery",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3582",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DWT - Directory \u0026 Listing WordPress Theme \u003c= 3.3.3 - Reflected Cross-Site Scripting",
    "slug": "dwt-listing",
    "type": "theme",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0170",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ongkoskirim.id \u003c= 1.0.6 - Missing Authorization",
    "slug": "ongkoskirim-id",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57949",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP-Cufon \u003c= 1.6.10 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-cufon",
    "type": "plugin",
    "affected_version": "* - 1.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32541",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin",
    "slug": "simple-payment",
    "type": "plugin",
    "affected_version": "1.3.6 - 2.3.8",
    "from_version": "1.3.6",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6688",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LatePoint \u003c= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 5.1.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.94",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6815",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPtouch \u003c= 4.3.44 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "wptouch",
    "type": "plugin",
    "affected_version": "* - 4.3.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.44",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3417",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP JobHunt \u003c= 7.1 - Authentication Bypass",
    "slug": "wp-jobhunt",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11286",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Terms descriptions \u003c= 3.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "terms-descriptions",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6719",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Optio Dentistry \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "optio-dentistry",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9853",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Generic Elements \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "generic-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53709",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Revisions Delete \u003c= 1.5.3 - Cross-Site Request Forgery",
    "slug": "simple-revisions-delete",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30482",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.7.2 - Cross-Site Request Forgery",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39645",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "pixelstats \u003c= 0.8.2 - Reflected Cross-Site Scripting",
    "slug": "pixelstats",
    "type": "plugin",
    "affected_version": "* - 0.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2164",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CWW Portfolio \u003c= 1.3.1 - Unauthenticated Local File Inclusion",
    "slug": "cww-portfolio",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39359",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FraudLabs Pro SMS Verification \u003c= 1.10.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "fraudlabs-pro-sms-verification",
    "type": "plugin",
    "affected_version": "* - 1.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51688",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon Page – Responsive Coming Soon \u0026 Maintenance Mode \u003c= 1.1.18 - Cross-Site Scripting via logo_width parameter",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5661",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "//// WP BORN BABIES PLUGIN /// \u003c= 1.0 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "wp-born-babies",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1506",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages \u003c= 3.4.25 - Cross-Site Request Forgery to Limited Settings Update",
    "slug": "wc4bp",
    "type": "plugin",
    "affected_version": "* - 3.4.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1780",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Print PDF Generator and Publisher \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nopeamedia",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52394",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.3.1 - HTML Injection in Emails",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23735",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.24.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7301",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inspiro Pro \u003c= 7.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpzoom-inspiro-pro",
    "type": "theme",
    "affected_version": "* - 7.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2391",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Builder by vcita \u003c= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "contact-form-with-a-meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2300",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Page Contact \u003c= 1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "wpagecontact",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24403",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms \u003c 1.1.1 - SQL Injection",
    "slug": "limit-attempts",
    "type": "plugin",
    "affected_version": "[*, 1.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9335",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Top and footer bars for announcements, notifications, advertisements, promotions – YooBar \u003c= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yoo-bar",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11410",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Tracking Pro \u003c= 3.3.6 - Reflected Cross-Site Scripting",
    "slug": "order-tracking",
    "type": "plugin",
    "affected_version": "* - 3.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4471",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Active Directory Integration / LDAP Integration \u003c= 4.1.4 - Cross-Site Request Forgery to SQL Injection",
    "slug": "ldap-login-for-intranet-sites",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-2599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2599",
    "auth_type": "Unauth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "404 Solution \u003c= 2.33.0 - Sensitive Information Exposure via Log File",
    "slug": "404-solution",
    "type": "plugin",
    "affected_version": "* - 2.33.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.33.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52146",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Giveaways \u003c= 2.45.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings",
    "slug": "giveasap",
    "type": "plugin",
    "affected_version": "* - 2.45.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.45.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1120",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crypto Converter Widget \u003c= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "crypto-converter-widget",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29930",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Listings for Appfolio \u003c= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "listings-for-appfolio",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22658",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "百度站长SEO合集(支持百度/神马/Bing/头条推送) \u003c= 2.0.6 - Unauthenticated Arbitrary File Upload",
    "slug": "baiduseo",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3917",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kanban Boards for WordPress \u003c= 2.5.21 - Missing Authorization",
    "slug": "kanban",
    "type": "plugin",
    "affected_version": "* - 2.5.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37226",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Checkout Mestres WP \u003c= 7.1.9.6 - Unauthenticated SQL Injection",
    "slug": "checkout-mestres-wp",
    "type": "plugin",
    "affected_version": "* - 7.1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.9.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51469",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Language Bar Flags \u003c= 1.0.8 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting",
    "slug": "language-bar-flags",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24431",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Categorify \u003c= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxRenameCategory",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "* - 1.0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1909",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress \u003c= 1.1.16 - Authenticated (Subscriber+) SQL Injection",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10540",
    "auth_type": "Auth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quran Shortcode \u003c= 1.5 - Authenticated (Contributor+) SQL Injection",
    "slug": "quran-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51625",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Poll Maker \u003c= 5.6.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26971",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "White Label CMS \u003c 1.5.1 - Cross-Site Scripting",
    "slug": "white-label-cms",
    "type": "plugin",
    "affected_version": "[*, 1.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-5388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5388",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "PDF Invoices for WooCommerce + Drag and Drop Template Builder \u003c= 5.3.8 - Authenticated (Administrator+) SQL Injection",
    "slug": "pdf-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47537",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BuddyPress Better Registration \u003c= 1.6 - Authentication Bypass to Administrator",
    "slug": "better-bp-registration",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49247",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ditty – Responsive News Tickers, Sliders, and Lists \u003c= 3.1.42 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5575",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SendFox \u003c= 1.3.0 - Missing Authorization",
    "slug": "wp-sendfox",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27970",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.100",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.100",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7356",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Views Count  Plugin \u003c= 2.4.14 - Unauthenticated SQL Injection",
    "slug": "page-views-count",
    "type": "plugin",
    "affected_version": "[*, 2.4.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.15",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0434",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Jupiter X Core \u003c= 4.8.11 - Unauthenticated PHP Object Injection via PHAR",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 4.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2105",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Job Board Manager for WordPress \u003c= 1.0 - Unauthenticated Privilege Escalation",
    "slug": "jemployee",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49322",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AWP Classifieds \u003c= 4.2.1 - Unauthenticated SQL Injection",
    "slug": "another-wordpress-classifieds-plugin",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3254",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sydney Toolbox \u003c= 1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery",
    "slug": "sydney-toolbox",
    "type": "plugin",
    "affected_version": "* - 1.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3208",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DigiPass \u003c= 0.3.0 - Unauthenticated Arbitrary File Download",
    "slug": "digipass",
    "type": "plugin",
    "affected_version": "* - 0.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52378",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Additional Variation Images Gallery for WooCommerce \u003c= 1.1.28 - Authenticated Stored Cross-Site Scripting",
    "slug": "woo-variation-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.1.29)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.29",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15778",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 Cross-Site Request Forgery to Password Reset",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9039",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 Cross-Site Request Forgery to Password Reset",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.4",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9039",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 Cross-Site Request Forgery to Password Reset",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.4",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9039",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 Cross-Site Request Forgery to Password Reset",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.2",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9039",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 Cross-Site Request Forgery to Password Reset",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9039",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kento WordPress Stats \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "kento-wp-stats",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Posts with Multiple Custom Groups (FPMCG) \u003c= 4.0 - Reflected Cross-Site Scripting",
    "slug": "featured-posts-with-multiple-custom-groups-fpmcg",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48032",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Disable Elementor Editor Translation \u003c= 1.0.2 - Missing Authorization",
    "slug": "disable-elementor-editor-translation",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22671",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Empowerment \u003c= 1.0.2 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "empowerment",
    "type": "theme",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7433",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8902",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c= 3.4.5 - Cross-Site Scripting",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "[*, 3.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18567",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AntiSpam for Contact Form 7 \u003c= 0.6.3 - Cross-Site Request Forgery",
    "slug": "cf7-antispam",
    "type": "plugin",
    "affected_version": "* - 0.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54020",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.36.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.36.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9700",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Chatbot for Messenger \u003c= 4.7 - Missing Authorization",
    "slug": "wp-chatbot",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32581",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Smart Marketing SMS and Newsletters Forms \u003c= 5.0.4 - Missing Authorization",
    "slug": "smart-marketing-for-wp",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53784",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LOGIN AND REGISTRATION ATTEMPTS LIMIT \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "login-attempts-limit-wp",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47138",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Huge-IT gallery-images \u003c= 1.8.9 - SQL Injection",
    "slug": "gallery-images",
    "type": "plugin",
    "affected_version": "* - 1.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-11018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11018",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Nepali Date Utilities \u003c= 1.0.13 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "nepali-date-utilities",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32664",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DMSGuestbook \u003c= 1.7.0 - SQL Injection",
    "slug": "dmsguestbook",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-0616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0616",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DZS Ajaxer Lite – Ajaxify Your WordPress Site and Comment \u003c= 1.04 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "dzs-ajaxer-lite-dynamic-page-load",
    "type": "plugin",
    "affected_version": "* - 1.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23579",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Content Restriction \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "edd-content-restriction",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9509",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML filter and csv-file search \u003c= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "hk-filter-and-search",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5096",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sydney Toolbox \u003c= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget",
    "slug": "sydney-toolbox",
    "type": "plugin",
    "affected_version": "* - 1.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4473",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPExperts Square For GiveWP \u003c= 1.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "wpexperts-square-for-give",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47338",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Otter - Gutenberg Block \u003c= 3.0.3 - Missing Authorization",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51671",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quick Event Manager \u003c= 9.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "quick-event-manager",
    "type": "plugin",
    "affected_version": "* - 9.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46863",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Stories Widgets For Elementor \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcodes-for-amp-web-stories-and-elementor-widget",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52354",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.1.5 - Missing Authorization in ajaxCalculatePrice function",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40203",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Video Posts \u003c= 3.5.1 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "wp-video-posts",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27298",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H"
  },
  {
    "title": "MB Custom Post Types \u0026 Custom Taxonomies \u003c= 2.7.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mb-custom-post-type",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10143",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Click to Chat \u003c= 3.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "click-to-chat-for-whatsapp",
    "type": "plugin",
    "affected_version": "* - 3.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4480",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BSK PDF Manager \u003c= 1.4 - Authenticated SQL Injection",
    "slug": "bsk-pdf-manager",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-4944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4944",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Carousel Slider \u003c= 2.2.9 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "carousel-slider",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3703",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StageShow \u003c= 9.8.6 - Reflected Cross-Site Scripting",
    "slug": "stageshow",
    "type": "plugin",
    "affected_version": "* - 9.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13705",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BWL Advanced FAQ Manager \u003c= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update",
    "slug": "bwl-advanced-faq-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13801",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "breadcrumb simple \u003c= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "breadcrumb-simple",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-35092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35092",
    "auth_type": "Privileged",
    "cvss_score": 3.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Simple Job Board \u003c= 2.12.3 - Authenticated (Editor+) PHP Object Injection",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "* - 2.12.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7351",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ABCApp Creator \u003c= 1.1.2 - Unauthenticated Local File Inclusion",
    "slug": "abcapp-creator",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-44023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44023",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Nexter Extension \u003c= 2.0.3 - Authenticated(Editor+) Remote Code Execution via metabox",
    "slug": "nexter-extension",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-45751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45751",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "File Manager Pro \u003c= 8.3.9 - Unauthenticated Limited JavaScript File Upload",
    "slug": "wp-file-manager-pro",
    "type": "plugin",
    "affected_version": "* - 8.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8918",
    "auth_type": "Unauth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "All in One SEO \u003c= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3368",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SIS Handball \u003c= 1.0.45 - Cross-Site Request Forgery",
    "slug": "sis-handball",
    "type": "plugin",
    "affected_version": "* - 1.0.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41684",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Docxpresso \u003c= 2.6 - Authenticated (Contributor+) Arbitrary File Download",
    "slug": "docxpresso",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31554",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Yozi \u003c= 2.0.52 - Unauthenticated Local File Inclusion",
    "slug": "yozi",
    "type": "theme",
    "affected_version": "* - 2.0.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.52",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32289",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Club Manager \u003c= 2.2.11 - Missing Authorization",
    "slug": "wp-club-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32719",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spotify Embed Creator \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spotify-embed-creator",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9879",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Custom Post Popup \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-post-popup",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46471",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SimpleShop \u003c= 2.10.2 - Missing Authorization",
    "slug": "simpleshop-cz",
    "type": "plugin",
    "affected_version": "* - 2.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1229",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Manager, Events Calendar, Tickets, Registrations – Eventin \u003c= 4.0.24 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1770",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "House Manager – Easy Renter Management System for WordPress \u003c= 1.0.8.4 - Reflected Cross-Site Scripting",
    "slug": "house-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3973",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "140+ Widgets | Xpro Addons For Elementor – FREE \u003c= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2108",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wSecure Lite \u003c= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "wsecure",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39987",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Add Active Class To Menu Item \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "wp-add-active-class-to-menu-item",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28913",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.12 - Cross-Site Request Forgery in exec_multitask_widgets function",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25707",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Real Estate \u003c= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "essential-real-estate",
    "type": "plugin",
    "affected_version": "* - 4.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6827",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Table for WooCommerce \u003c= 3.1.2 - Missing Authorization",
    "slug": "woo-product-table",
    "type": "plugin",
    "affected_version": "[*, 3.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-1020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1020",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy2Map \u003c= 1.2.9 - Directory Traversal and Local File Inclusion",
    "slug": "easy2map",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-7669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7669",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPvivid Backup Plugin \u003c= 0.9.90 - Missing Authorization via 'start_staging' and 'get_staging_progress'",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "[*, 0.9.91)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.91",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-41243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41243",
    "auth_type": "Auth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"
  },
  {
    "title": "Academy LMS \u003c= 2.0.10 - Open Redirect",
    "slug": "academy",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37234",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "User Registration \u0026 Membership \u003c= 4.1.2 - Authentication Bypass",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2594",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OoohBoi Steroids for Elementor \u003c= 2.1.3 - Missing Authorization leading to Authenticated (Subscriber+) Attachment Deletion",
    "slug": "ooohboi-steroids-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0336",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WP Captcha \u003c= 2.0.0 - CAPTCHA Bypass",
    "slug": "wp-captcha",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44235",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Authorization Bypass to Remove Category Attribute",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.14",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5837",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Authorization Bypass to Remove Category Attribute",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.12",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5837",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Authorization Bypass to Remove Category Attribute",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.11",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5837",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Authorization Bypass to Remove Category Attribute",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.8",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5837",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Authorization Bypass to Remove Category Attribute",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.3",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5837",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Authorization Bypass to Remove Category Attribute",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.11",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5837",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Authorization Bypass to Remove Category Attribute",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.4",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5837",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Authorization Bypass to Remove Category Attribute",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.2",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5837",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Authorization Bypass to Remove Category Attribute",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-5837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5837",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Authorization Bypass to Remove Category Attribute",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.14",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5837",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Amazon Associate Filter \u003c= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "amazon-associate-filter",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51643",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YouTube Playlist Player \u003c= 4.6.4 - Cross-Site Request Forgery in ytpp_settings",
    "slug": "youtube-playlist-player",
    "type": "plugin",
    "affected_version": "* - 4.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33931",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OptinMonster \u003c= 2.6.0 - Reflected Cross-Site Scripting",
    "slug": "optinmonster",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39325",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GMO Social Connection \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "gmo-social-connection",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51636",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PropertyHive \u003c= 2.0.8 - Reflected Cross-Site Scripting",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29923",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myCred \u003c= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43353",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator \u003c= 1.29.0 - Reflected Cross-Site Scripting",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.29.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29777",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subaccounts for WooCommerce \u003c= 1.6.0 - Reflected Cross-Site Scripting",
    "slug": "subaccounts-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11370",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons \u003c= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9058",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Max Mega Menu \u003c= 2.3.8 - Authenticated Cross-Site Scripting",
    "slug": "megamenu",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18525",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fancy Product Designer \u003c= 6.4.3 - Unauthenticated SQL Injection",
    "slug": "fancy-product-designer",
    "type": "plugin",
    "affected_version": "* - 6.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-51818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51818",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Better Section Navigation Widget \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "better-section-navigation",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31465",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Send email only on Reply to My Comment \u003c= 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "send-email-only-on-reply-to-my-comment",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6223",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Chat Widget - Chaty \u003c= 3.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chaty",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3245",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple URLs \u003c= 117 - Missing Authorization via AJAX actions",
    "slug": "simple-urls",
    "type": "plugin",
    "affected_version": "* - 117",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "117",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40678",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BetterDocs – Best Documentation, FAQ \u0026 Knowledge Base Plugin with AI Support \u0026 Instant Answer For Elementor \u0026 Gutenberg \u003c= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "betterdocs",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2845",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Attachment \u003c= 2.1.8 - Cross-Site Request Forgery",
    "slug": "woo-product-attachment",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40212",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ZipList Recipe \u003c= 3.1 - Cross-Site Request Forgery",
    "slug": "ziplist-recipe-plugin",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28868",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Compress for MainWP \u003c= 6.30.03 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "wp-compress-mainwp",
    "type": "plugin",
    "affected_version": "* - 6.30.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.30.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31076",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hotel Booking \u003c= 2.2.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-51582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51582",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Matted Thumbnails \u003c= 1.01 - Reflected Cross-Site Scripting",
    "slug": "simple-matted-thumbnails",
    "type": "plugin",
    "affected_version": "* - 1.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38339",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Whois Domain \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-whois-domain",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hotel Booking \u003c= 3.6 - Unauthenticated Local File Inclusion",
    "slug": "nd-booking",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39526",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPJobBoard \u003c 5.11.1 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "wpjobboard",
    "type": "plugin",
    "affected_version": "[*, 5.11.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-30967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30967",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zigaform – Form Builder Lite \u003c= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zigaform-form-builder-lite",
    "type": "plugin",
    "affected_version": "* - 7.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13573",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Matterport Shortcode \u003c= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "shortcode-gallery-for-matterport-showcase",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35094",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Marekkis Watermark-Plugin \u003c= 0.9.4 - Cross-Site Scripting",
    "slug": "marekkis-watermark",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-1758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1758",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "publish post email notification \u003c= 1.0.2.3 - Cross-Site Request Forgery",
    "slug": "publish-post-email-notification",
    "type": "plugin",
    "affected_version": "* - 1.0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30816",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor \u003c= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.18.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48777",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Landing Page Builder \u003c= 1.4.9.5 - Reflected Cross-Site Scripting",
    "slug": "page-builder-add",
    "type": "plugin",
    "affected_version": "* - 1.4.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25067",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Virtue \u003c= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author",
    "slug": "virtue",
    "type": "theme",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4034",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12238",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Popup Box \u003c= 2.1.2 - Authenticated Local File Inclusion",
    "slug": "popup-box",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29445",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pool \u003c= 1.0.7 -  Reflected Cross-Site Scripting",
    "slug": "pool",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4482",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder \u003c= 2.5.4.3 - Missing Authorization",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.5.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36425",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP eMember \u003c= 10.6.5 - Reflected Cross-Site Scripting via 'login_pwd'",
    "slug": "wp-eMember",
    "type": "plugin",
    "affected_version": "* - 10.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5074",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto ThickBox Plus \u003c= 1.9 - Reflected Cross-Site Scripting",
    "slug": "auto-thickbox-plus",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9396",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Starbox \u003c= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings",
    "slug": "starbox",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0256",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bandsintown Events \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bandsintown",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13802",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Subscribe button \u003c= 1.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "podlove-subscribe-button",
    "type": "plugin",
    "affected_version": "* - 1.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58227",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Offline or Coming Soon \u003c= 1.6.6 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting",
    "slug": "site-is-offline-plugin",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1593",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Comments Import \u0026 Export \u003c= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal",
    "slug": "comments-import-export-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7514",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Event List \u003c 0.7.9 - Authenticated (Admin+) SQL Injection",
    "slug": "event-list",
    "type": "plugin",
    "affected_version": "[*, 0.7.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-9429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9429",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sugar Calendar (Lite) \u003c= 3.3.0 - Reflected Cross-Site Scripting",
    "slug": "sugar-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10878",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Miniorange OTP Verification with Firebase \u003c= 3.6.0 - Authentication Bypass",
    "slug": "miniorange-firebase-sms-otp-verification",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9861",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Video Robot \u003c= 1.20.0 -  Authenticated (Subscriber+) Privilege Escalation via User Meta Update",
    "slug": "wp-video-robot",
    "type": "plugin",
    "affected_version": "* - 1.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9192",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Brickscore \u003c= 1.4.2.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "brickscore",
    "type": "plugin",
    "affected_version": "* - 1.4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43950",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Constructo \u003c= 4.3.9 - Cross-Site Request Forgery",
    "slug": "constructo",
    "type": "theme",
    "affected_version": "* - 4.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58244",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Welcome Popup \u003c= 1.0.10 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "welcome-popup",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31605",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Revolution \u003c= 6.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47772",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orders Tracking for WooCommerce \u003c= 1.0.14 - Reflected Cross-Site Scripting",
    "slug": "woo-orders-tracking",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25062",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VdoCipher \u003c= 1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "vdocipher",
    "type": "plugin",
    "affected_version": "* - 1.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47639",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gift Up 2.21.3 - Cross-Site Request Forgery via consume_post",
    "slug": "gift-up",
    "type": "plugin",
    "affected_version": "* - 2.21.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.21.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49744",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShopLentor (formerly WooLentor)  \u003c= 2.8.7 - Missing Authorization via purchased_new_products",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6327",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "UpdraftPlus WordPress Backup Plugin \u003c 1.22.3 - Sensitive Information Disclosure",
    "slug": "updraftplus",
    "type": "plugin",
    "affected_version": "[1.16.7, 1.22.3)",
    "from_version": "1.16.7",
    "from_inclusive": true,
    "to_version": "1.22.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0633",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "UpdraftPlus WordPress Backup Plugin \u003c 1.22.3 - Sensitive Information Disclosure",
    "slug": "updraftplus-pro",
    "type": "plugin",
    "affected_version": "[*, 2.22.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.22.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0633",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Wordpress Photo Album Plus \u003c= 8.8.05.003 - Reflected Cross-Site Scripting",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 8.8.05.003",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.05.003",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9951",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "4stats \u003c= 2.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "4stats",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3869",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Garden Gnome Package \u003c= 2.3.0 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "garden-gnome-package",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12854",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Anonymous Restricted Content \u003c= 1.6.2 -  Protection Mechanism Bypass",
    "slug": "anonymous-restricted-content",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0909",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ND Shortcodes  \u003c= 5.9.1 - Unauthenticated WordPress Options Update",
    "slug": "nd-shortcodes",
    "type": "plugin",
    "affected_version": "[*, 6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15771",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider \u003c= 3.94.0 - Authenticated (Editor+) PHP Object Injection",
    "slug": "ml-slider",
    "type": "plugin",
    "affected_version": "* - 3.94.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.94.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26763",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Altra Side Menu \u003c= 2.0 - Cross-Site Request Forgery to Arbitrary Menu Deletion",
    "slug": "altra-side-menu",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12774",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Docket (WooCommerce Collections / Wishlist / Watchlist) \u003c 1.7.0 - Missing Authorization to Unauthenticated Arbitrary Post/Page Deletion",
    "slug": "woocommerce-collections",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-43131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43131",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Timeline Calendar \u003c= 1.2 - Authenticated (Admin+) SQL Injection",
    "slug": "timeline-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24553",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ANAC XML Render \u003c= 1.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "anac-xml-render",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30558",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download IP2Location Country Blocker \u003c= 2.34.2 - Cross-Site Request Forgery",
    "slug": "ip2location-country-blocker",
    "type": "plugin",
    "affected_version": "* - 2.34.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.34.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32443",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "jQuery TwentyTwenty \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "js-twentytwenty",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22546",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CGC Maintenance Mode \u003c= 1.2 - Sensitive Information Exposure",
    "slug": "cgc-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1418",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Travel Engine \u003c= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 6.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10606",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP About Author \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-about-author",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27323",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Alike - WordPress Custom Post Comparison \u003c= 3.0.1 - Reflected Cross-Site Scripting",
    "slug": "alike",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28975",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Delivery Date for WooCommerce \u003c= 4.1.0 - Missing Authorization",
    "slug": "order-delivery-date-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58599",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nino Social Connect \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "nino-social-connect",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32481",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leaflet Map \u003c= 2.23.3 - Contributor+ Stored Cross-Site Scripting",
    "slug": "leaflet-map",
    "type": "plugin",
    "affected_version": "* - 2.23.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.23.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24468",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.0.5 - Cross-Site Request Forgery",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40632",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Category Slider for WooCommerce \u003c= 1.4.15 - Missing Authorization via notice dismissal functionality",
    "slug": "woo-category-slider-grid",
    "type": "plugin",
    "affected_version": "* - 1.4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41132",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pro Mime Types \u003c= 1.0.7 - Cross-Site Request Forgery",
    "slug": "pro-mime-types",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32502",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Gallery – Responsive Photo Gallery \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "awesome-responsive-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12403",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cooked – Recipe Management \u003c= 1.7.15.4 - Cross-Site Request Forgery to Settings Update",
    "slug": "cooked",
    "type": "plugin",
    "affected_version": "* - 1.7.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.15.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39680",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Piotnet Addons For Elementor \u003c= 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "piotnet-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4432",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Generate PDF using Contact Form 7 \u003c= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "generate-pdf-using-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6316",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Ad Widget \u003c= 2.20.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ad-widget",
    "type": "plugin",
    "affected_version": "* - 2.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33696",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StreamWeasels Kick Integration \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "streamweasels-kick-integration",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7810",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integrate Google Drive \u003c= 1.5.2 - Cross-Site Request Forgery",
    "slug": "integrate-google-drive",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54703",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Kanban Boards for WordPress \u003c= 2.5.20 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "kanban",
    "type": "plugin",
    "affected_version": "* - 2.5.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0873",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Favorites \u003c= 1.0.6 - Cross-Site Scripting",
    "slug": "edd-favorites",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9513",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Echo Sign \u003c 1.2 - Reflected Cross-Site Scripting",
    "slug": "echosign",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10985",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Registrations for the Events Calendar \u003c= 2.7.5 - Unauthenticated SQL Injection",
    "slug": "registrations-for-the-events-calendar",
    "type": "plugin",
    "affected_version": "[*, 2.7.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24943",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SB Random Posts Widget \u003c= 1.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "sb-random-posts-widget",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-48029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48029",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Legull \u003c= 1.2.2 - Reflected Cross-Site Scripting",
    "slug": "legull",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13352",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EazyDocs \u003c= 2.6.4 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "eazydocs",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54376",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Are you robot google recaptcha for wordpress \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "are-you-robot-recaptcha",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28928",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Comment Remix \u003c 1.4.4 - SQL Injection",
    "slug": "wp-comment-remix",
    "type": "plugin",
    "affected_version": "[*, 1.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2008-4732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-4732",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Infinite Scroll – Ajax Load More \u003c= 6.1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 6.1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50874",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Project Manager  \u003c= 2.4.0 - Cross-Site Request Forgery Bypass",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "[*, 2.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36745",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gallery \u003c= 1.3 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "multi-gallery",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11501",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Maker \u003c= 1.17.1 - Missing Authorization via save_popup_enabled_state",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.17.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45819",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP2LEADS \u003c= 3.5.0 - Cross-Site Request Forgery",
    "slug": "wp2leads",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32922",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Limit Login Attempts Plus \u003c= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass",
    "slug": "limit-login-attempts-plus",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4533",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Envira Photo Gallery \u003c= 1.7.6 - Authenticated Stored Cross-Site Scripting",
    "slug": "envira-gallery-lite",
    "type": "plugin",
    "affected_version": "[*, 1.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-9334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9334",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextGEN Gallery Search \u003c= 2.12 - Reflected Cross-Site Scripting",
    "slug": "nextgen-gallery-search-galleries",
    "type": "plugin",
    "affected_version": "* - 2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53224",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "atec Debug \u003c= 1.2.22 - Authenticated (Administrator+) Remote Code Execution",
    "slug": "atec-debug",
    "type": "plugin",
    "affected_version": "* - 1.2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9517",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Hover Effects Ultimate 9.8.1 - 9.8.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "image-hover-effects-ultimate",
    "type": "plugin",
    "affected_version": "9.8.1 - 9.8.4",
    "from_version": "9.8.1",
    "from_inclusive": true,
    "to_version": "9.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4207",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.3 - Arbitrary File Upload",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-27862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27862",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Arconix Shortcodes \u003c= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "arconix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49858",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Role Scoper (Obsolete – Please install PublishPress Permissions) \u003c 1.3.67 - Reflected Cross-Site Scripting",
    "slug": "role-scoper",
    "type": "plugin",
    "affected_version": "[*, 1.3.67)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.67",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-8353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-8353",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeoDirectory \u003c= 2.3.61 - Authenticated (Subscriber+) SQL Injection",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.3.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.61",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43145",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Wow Moodboard Lite \u003c= 1.1.1.1 - Open Redirect",
    "slug": "wow-moodboard-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-4070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4070",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quantities and Units for WooCommerce \u003c= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quantities-and-units-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58917",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Power BI Embedded for WordPress \u003c= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embed-power-bi",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37959",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Social Sharing, Related Posts \u0026 Analytics – Shareaholic \u003c 7.6.1.0 - Authenticated (Subscriber+) Cross-Site Scripting",
    "slug": "shareaholic",
    "type": "plugin",
    "affected_version": "[*, 7.6.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9311",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Amazon Links \u003c= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via style",
    "slug": "amazon-auto-links",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4482",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LifterLMS \u003c= 7.7.5 - Authenticated (Admin+) SQL Injection",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "* - 7.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7349",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RLM Elementor Widgets Pack \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rlm-elementor-widgets-pack",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50542",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twitter Bootstrap Collapse aka Accordian Shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "twitter-bootstrap-collapse-aka-accordian-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12722",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter2Go \u003c= 4.0.14 - Authenticated(Subscriber+) Stored Cross-Site Scripting via style",
    "slug": "newsletter2go",
    "type": "plugin",
    "affected_version": "* - 4.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1328",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Answers \u003c= 3.2.6 - Missing Authorization",
    "slug": "cm-answers",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54267",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Google Sitemap \u003c= 1.6 - Cross-Site Request Forgery",
    "slug": "simple-google-sitemap",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27318",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Google Fonts For WordPress \u003c= 3.0.0 - Reflected Cross-Site Scripting",
    "slug": "free-google-fonts",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34180",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Reviews \u003c= 6.11.6 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "* - 6.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29095",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GG Bought Together for WooCommerce \u003c= 1.0.2 - Unauthenticated SQL Injection",
    "slug": "gg-bought-together",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23967",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Contact Form vCard Generator \u003c= 2.4 - Reflected Cross-Site Scripting",
    "slug": "contact-form-vcard-generator",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39521",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 26.0.6 - Reflected Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 26.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48291",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Borderless – Elementor Addons and Templates \u003c= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "borderless",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5290",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AchillesTheme-shortcodes \u003c= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "achilles-shortcodes",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51878",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Review \u0026 testimonial widgets \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "trustmary",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44022",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Finale Lite \u003c= 2.18.0 - Cross-Site Request Forgery",
    "slug": "finale-woocommerce-sales-countdown-timer-discount",
    "type": "plugin",
    "affected_version": "* - 2.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32107",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "IP Vault – WP Firewall \u003c= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ip-vault-wp-firewall",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47171",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Enquiry for WooCommerce \u003c= 3.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "product-enquiry-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3964",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MW WP Form \u003c= 5.0.1 - Unauthenticated Arbitrary File Upload",
    "slug": "mw-wp-form",
    "type": "plugin",
    "affected_version": "* - 5.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Upunzipper \u003c= 1.0.0 - Authenticated (Admin+) Arbitrary File Deletion",
    "slug": "upunzipper",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35744",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Ksher \u003c= 1.1.1 - Missing Authorization",
    "slug": "ksher-payment",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56001",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Reales WP STPT \u003c= 2.1.2 - Unauthorized User Registration",
    "slug": "short-tax-post",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3609",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Link Juice Keeper \u003c= 2.0.2 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "link-juice-keeper",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25793",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ever Compare \u003c= 1.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "ever-compare",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0505",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blogstand Banner \u003c= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "blogstand-smart-banner",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4848",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bradmax Player \u003c= 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bradmax-player",
    "type": "plugin",
    "affected_version": "* - 1.1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37957",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goto - Tour \u0026 Travel WordPress Theme \u003c 2.0 - Reflected Cross-Site Scripting",
    "slug": "goto",
    "type": "theme",
    "affected_version": "[*, 2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24235",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hide My WP Ghost – Security \u0026 Firewall \u003c= 5.2.01 - Login Page Disclosure",
    "slug": "hide-my-wp",
    "type": "plugin",
    "affected_version": "* - 5.2.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6420",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Frontend Checklist \u003c= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "frontend-checklist",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4957",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Alt Text AI \u003c= 1.9.93 - Missing Authorization",
    "slug": "alttext-ai",
    "type": "plugin",
    "affected_version": "* - 1.9.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46232",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "My Tickets \u003c= 1.9.11 - Authorization Bypass",
    "slug": "my-tickets",
    "type": "plugin",
    "affected_version": "* - 1.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23988",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Bus Ticket Booking with Seat Reservation \u003c= 5.2.3  - Reflected Cross-Site Scripting",
    "slug": "bus-ticket-booking-with-seat-reservation",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4067",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Export for WooCommerce \u003c= 3.23 - Unauthenticated Sensitive Information Exposure",
    "slug": "order-export-and-more-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43259",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Activity Log \u003c= 2.8.3 - CSV Injection",
    "slug": "aryo-activity-log",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-27858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27858",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "tagDiv Composer \u003c= 4.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3169",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MemberPress Discord Addon \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "expresstechsoftwares-memberpress-discord-add-on",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32605",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Education \u003c= 1.2.6 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "wp-education",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0498",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Krowd \u003c= 1.4.1 - Unauthenticated Local File Inclusion",
    "slug": "krowd",
    "type": "theme",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32595",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "* - 1.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10732",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.2.1 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-4154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4154",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 2.2.1 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "2.2 - 2.2.1",
    "from_version": "2.2",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-4154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4154",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Missing Authorization in 'clear_uucss_logs'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1337",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RD Station \u003c= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "integracao-rd-station",
    "type": "plugin",
    "affected_version": "* - 5.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6894",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Academy LMS Pro \u003c= 3.3.7 - Unauthenticated Privilege Escalation via Social Login Addon",
    "slug": "academy-pro",
    "type": "plugin",
    "affected_version": "* - 3.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-11086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11086",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Banner \u003c= 1.3 - Cross-Site Request Forgery",
    "slug": "free-event-banner",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24252",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Liveblogs \u003c= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-liveblogs",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11387",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13429",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "1 Click WordPress Migration Plugin – 100% FREE for a limited time \u003c= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "1-click-migration",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3455",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Variation Swatches for WooCommerce \u003c= 1.0.61 - Reflected Cross-Site Scripting",
    "slug": "woo-variation-swatches",
    "type": "plugin",
    "affected_version": "[*, 1.0.62)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.62",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-14774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14774",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2448",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Countdown, Coming Soon, Maintenance – Countdown \u0026 Clock \u003c= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "countdown-builder",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50516",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pressference Exporter \u003c= 1.0.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "pressference-exporter",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-45046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45046",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings \u003c= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rate-star-review",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13392",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FileBird – WordPress Media Library Folders \u0026 File Manager \u003c= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "filebird",
    "type": "plugin",
    "affected_version": "* - 5.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2345",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar \u003c= 1.3.92 - Cross-Site Request Forgery to SQL Injection",
    "slug": "appointment-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 1.3.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.92",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46241",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.82 - Unauthenticated Password Leak",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.82",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.82",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6421",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Inspirational Quote Rotator \u003c= 1.0.0 - Stored Cross-Site Scripting",
    "slug": "inspirational-quote-rotator",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24771",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flags Widget \u003c= 1.0.7 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "flags-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32479",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Five Star Business Profile and Schema \u003c= 2.1.6 - Subscriber+ Page Creation \u0026 Settings Update to Stored Cross-Site Scripting",
    "slug": "business-profile",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25060",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by Bit Form \u003c= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.17.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.4",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-13450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13450",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Beaf \u003c= 1.6.2 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "image-compare-block",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53461",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Community by PeepSo – Social Network, Membership, Registration, User Profiles \u003c 1.6.1 - Privilege Escalation",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10968",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "1003 Mortgage Application \u003c= 1.87 - Unauthenticated Full Path Disclosure",
    "slug": "1003-mortgage-application",
    "type": "plugin",
    "affected_version": "* - 1.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13536",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Page Generator Plugin – MPG \u003c= 3.3.19 - Authenticated (Administrator+) SQL Injection in projects_list and total_projects",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 3.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-33927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33927",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Store Locator Plus \u003c= 2311.17.01 - Unauthenticated Sensitive Information Exposure",
    "slug": "store-locator-le",
    "type": "plugin",
    "affected_version": "* - 2311.17.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2311.17.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43258",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Custom Post Type Attachment \u003c= 3.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pdf_attachment Shortcode",
    "slug": "custom-post-type-pdf-attachment",
    "type": "plugin",
    "affected_version": "* - 3.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4546",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BMo Expo \u003c= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bmo-expo",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30539",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link Shield \u003c= 0.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "link-shield",
    "type": "plugin",
    "affected_version": "* - 0.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5926",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Posts with Multiple Custom Groups (FPMCG) \u003c= 4.0 - Cross-Site Request Forgery",
    "slug": "featured-posts-with-multiple-custom-groups-fpmcg",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48031",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups \u003c= 1.3.5 - Missing Authorization to Authenticated (Contributor+) PHP Object Injection",
    "slug": "coupon-x-discount-pop-up",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12627",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Comparison Slider \u003c= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "comparison-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4422",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WCS QR Code Generator \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wcs-qr-code-generator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23864",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Builder \u003c= 1.9.8.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "contact-form-add",
    "type": "plugin",
    "affected_version": "* - 1.9.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24513",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multisite Content Copier/Updater Pro \u003c 2.1.2 - Reflected Cross-Site Scripting",
    "slug": "wp-multisite-content-copier-pro",
    "type": "plugin",
    "affected_version": "[*, 2.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0503",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKU Label Changer For WooCommerce \u003c= 3.0 - Missing Authorization",
    "slug": "woo-sku-label-changer",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29174",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mooberry Book Manager \u003c= 4.15.12 - Unauthenticated Information Exposure via Export Files",
    "slug": "mooberry-book-manager",
    "type": "plugin",
    "affected_version": "* - 4.15.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34368",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Anyfont \u003c= 2.2.3 - Cross-Site Scripting",
    "slug": "anyfont",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4515",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopLentor \u003c= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3345",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quantity Dynamic Pricing \u0026 Bulk Discounts for WooCommerce \u003c= 3.8.0 - Reflected Cross-Site Scripting",
    "slug": "wholesale-pricing-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9384",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FormLift for Infusionsoft Web Forms \u003c= 7.5.20 - Reflected Cross-Site Scripting",
    "slug": "formlift",
    "type": "plugin",
    "affected_version": "* - 7.5.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Masonry \u0026 Infinite Scroll \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-masonry-infinite-scroll",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5488",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackupBuddy \u003c 3.0 - Authentication Bypass",
    "slug": "backupbuddy",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-2741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2741",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Darcie \u003c= 1.1.5 - Reflected Cross-Site Scripting via JS split",
    "slug": "darcie",
    "type": "theme",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25961",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.13 - Missing Authorization to Settings Update in stopOptimizeAll",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1090",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.9 - Authenticated (Contributor+) Sensitive Information Exposure via sg_content_template",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8899",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Social proof testimonials and reviews by Repuso \u003c= 4.97 - Missing Authorization",
    "slug": "social-testimonials-and-reviews-widget",
    "type": "plugin",
    "affected_version": "* - 4.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.97",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46196",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Youzify – BuddyPress Community, User Profile, Social Network \u0026 Membership Plugin for WordPress \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8987",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Stripe \u003c= 1.1 - Unauthenticated Remote Code Execution",
    "slug": "easy-stripe",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49302",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pray For Me \u003c= 1.0.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "pray-for-me",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3966",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iframe forms \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframe Shortcode",
    "slug": "iframe-forms",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5073",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DMSGuestbook \u003c 1.9.0 - Cross-Site Scripting",
    "slug": "dmsguestbook",
    "type": "plugin",
    "affected_version": "[*, 1.9.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2008-0618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0618",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Upload Images \u003c= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "auto-upload-images",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49985",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10528",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Classified Listing \u003c= 3.1.16 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 3.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52386",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Plus Addons for Elementor PRO \u003c= 4.1.9 \u0026 The Plus Addons for Elementor \u003c= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4332",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "The Plus Addons for Elementor PRO \u003c= 4.1.9 \u0026 The Plus Addons for Elementor \u003c= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "4.0 - 4.1.9",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4332",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Video Gallery - Vimeo and YouTube Gallery \u003c 1.1.5 - Stored Cross-Site Scripting",
    "slug": "smart-grid-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24515",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Black Widgets For Elementor \u003c= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "black-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9388",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload – Contact Form 7 \u003c= 1.3.7.7 - Sensitive Information Exposure",
    "slug": "drag-and-drop-multiple-file-upload-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.3.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3717",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "PriPre \u003c= 0.4.11 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "pripre",
    "type": "plugin",
    "affected_version": "* - 0.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9454",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiSafepay plugin for WooCommerce \u003c= 4.15.0 - Arbitrary File Read",
    "slug": "multisafepay",
    "type": "plugin",
    "affected_version": "* - 4.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-33901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33901",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Elementor Header \u0026 Footer Builder \u003c= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2618",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Client Dash \u003c= 2.2.0 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "client-dash",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17071",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mark User as Spammer \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "mark-user-as-spammer",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10093",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MonsterInsights \u003c= 8.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-analytics-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 8.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0081",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Shortcodes \u003c= 1.6.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "synved-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.6.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0063",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.8.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-5650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5650",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goto - Tour \u0026 Travel WordPress Theme \u003c 2.1 - Reflected Cross-Site Scripting",
    "slug": "goto",
    "type": "theme",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24297",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured product by category name \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "featured-product-by-category-name",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51911",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seo Meta Tags \u003c= 1.4 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "seo-meta-tags",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31023",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Editable Table Simple Fast FrontEnd From Sql tables \u003c= 0.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "editable-table",
    "type": "plugin",
    "affected_version": "* - 0.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24898",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eRoom – Zoom Meetings \u0026 Webinar \u003c= 1.4.18 - Missing Authorization to Information Exposure",
    "slug": "eroom-zoom-meetings-webinar",
    "type": "plugin",
    "affected_version": "* - 1.4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3275",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ad-minister \u003c= 0.6 - Cross-Site Scripting",
    "slug": "ad-minister",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6993",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP EasyCart \u003c= 5.5.19 - Missing Authorization",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.5.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35667",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress GDPR \u003c= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion",
    "slug": "wordpress-gdpr",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11069",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58593",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Patreon WordPress \u003c= 1.9.0 - Protection Mechanism Bypass",
    "slug": "patreon-connect",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37430",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "bizcalendar-web \u003c= 1.1.0.34 - Authenticated (Administrator+) SQL Injection",
    "slug": "bizcalendar-web",
    "type": "plugin",
    "affected_version": "* - 1.1.0.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30843",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "FluentSMTP \u003c= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "fluent-smtp",
    "type": "plugin",
    "affected_version": "[*, 2.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24528",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HUSKY – Products Filter Professional for WooCommerce \u003c= 1.3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5039",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons for WPBakery Page Builder \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ht-mega-for-wpbakery",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53206",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Free MailClient FMC \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mailclient",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23703",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qubely – Advanced Gutenberg Blocks \u003c= 1.8.5 - Insufficient Authorization",
    "slug": "qubely",
    "type": "plugin",
    "affected_version": "[*, 1.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24916",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CMB2 \u003c= 2.10.1 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "cmb2",
    "type": "plugin",
    "affected_version": "* - 2.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1792",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Subscribe to Comments \u003c= 2.1.2 - Local File Includion",
    "slug": "subscribe-to-comments",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-10133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10133",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Timetics \u003c= 1.0.29 - Missing Authorization",
    "slug": "timetics",
    "type": "plugin",
    "affected_version": "* - 1.0.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30828",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "A1POST.BG Shipping for WooCommerce \u003c= 1.5 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "a1post-bg-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27012",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WTI Like Post \u003c 1.4.3 - SQL Injection",
    "slug": "wti-like-post",
    "type": "plugin",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9466",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.0.1 - PHP Object Injection",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-33900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33900",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sensei LMS – Online Courses, Quizzes, \u0026 Learning \u003c= 4.24.3 - Unauthenticated Information Exposure",
    "slug": "sensei-lms",
    "type": "plugin",
    "affected_version": "* - 4.24.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0466",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple 301 Redirects 2.0.0 - 2.0.3 - Unauthenticated Redirect Export",
    "slug": "simple-301-redirects",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.0.3",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24352",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H"
  },
  {
    "title": "Uncode \u003c= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description",
    "slug": "uncode",
    "type": "theme",
    "affected_version": "* - 2.9.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13667",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media from FTP Plugin \u003c 9.85 - Directory Traversal",
    "slug": "media-from-ftp",
    "type": "plugin",
    "affected_version": "[*, 9.85)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.85",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-5310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5310",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JetWidgets For Elementor \u003c= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL",
    "slug": "jetwidgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2507",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share, Social Login and Social Comments Plugin – Super Socializer \u003c= 7.13.68 - Authentication Bypass via Disqus OAuth provider",
    "slug": "super-socializer",
    "type": "plugin",
    "affected_version": "* - 7.13.68",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.13.68",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9946",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Table \u003c= 1.43 - Local File Inclusion",
    "slug": "wp-table",
    "type": "plugin",
    "affected_version": "* - 1.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.43",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2007-2483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-2483",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Download Manager \u003c= 3.2.70 - Insufficient Authorization to Information Disclosure",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1524",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Social Share Boost \u003c= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ssboost shortcode",
    "slug": "social-share-boost",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23688",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Sitemap Page \u003c= 1.6.6 - Admin+ Stored Cross Site Scripting",
    "slug": "wp-sitemap-page",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24715",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opening Hours \u003c= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-opening-hours",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4752",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Autoptimize \u003c= 2.8.3 - Stored Cross-Site Scripting",
    "slug": "autoptimize",
    "type": "plugin",
    "affected_version": "[*, 2.8.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24332",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post From Frontend \u003c= 1.0.0 - Cross-Site Request Forgery to Arbitrary Post Deletion",
    "slug": "post-from-frontend",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9689",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "10WebAnalytics \u003c= 1.2.12 - Missing Authorization via gawd_wd_bp_install_notice_status",
    "slug": "wd-google-analytics",
    "type": "plugin",
    "affected_version": "* - 1.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47807",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Terms of Use \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "terms-of-use-2",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31440",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StageShow \u003c 5.0.9 - Open Redirect",
    "slug": "stageshow",
    "type": "plugin",
    "affected_version": "[*, 5.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5461",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spoiler Block \u003c= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "spoiler-block",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32497",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.4 (Pro) \u0026 \u003c= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6244",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.4 (Pro) \u0026 \u003c= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6244",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "ARForms Form Builder \u003c= 1.7.1 - HTML Injection",
    "slug": "arforms-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54223",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP iCommerce – the first interactive ecommerce for wordpress \u003c= 1.1.1 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-icommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24402",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Amelia \u003c= 1.2.16 - Unauthenticated Insecure Direct Object Reference",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26965",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Page Builder Lite \u003c 2.0.6 - Authenticated Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "[*, 2.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24266",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ColorMag \u003c= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name",
    "slug": "colormag",
    "type": "theme",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget Countdown \u003c= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "widget-countdown",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24719",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.12 - Cross-Site Request Forgery in saveconfig function",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25707",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.23",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.15",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.10",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.22",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.34",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.34",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.31",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.28",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.24",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.1",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.19",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.18",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.4",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.14",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.32",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.31",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.6",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.7",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Cross-Site Request Forgery to Theme Image Change",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.2",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28040",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Change default login logo,url and title \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "change-default-login-logo-url-and-title",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31086",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Expander \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "video-expander",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52771",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fare Calculator \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "fare-calculator",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23982",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.13.2 - Information Disclosure via Debug Log",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44150",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.200 - Missing Authorization",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.200",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.200",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39552",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page Builder: Live Composer \u003c= 1.5.25 -  Authenticated (Author+) PHP Object Injection",
    "slug": "live-composer-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-52206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52206",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Popup Images \u003c= 1.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-popup",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24406",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Privyr CRM \u003c= 1.0.2 - Missing Authorization",
    "slug": "privy-crm-integration",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32224",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woobox \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woobox",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47675",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Testimonials \u003c= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "testimonial-free",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22269",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime \u003c= 3.3.2 - Improper Server-Side Checks to Booking Payment Bypass",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4252",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Conversador \u003c= 2.61 - Reflected Cross-Site Scripting",
    "slug": "conversador",
    "type": "plugin",
    "affected_version": "* - 2.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Youzify \u003c= 1.1.9 - SQL Injection",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1950",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Jet Footer Code \u003c= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "jet-footer-code",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54436",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.8.21 - Authenticated(Editor+) SQL Injection",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 2.8.22)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.22",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-43610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-43610",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Metronet Tag Manager \u003c 1.2.9 - Cross-Site Request Forgery",
    "slug": "metronet-tag-manager",
    "type": "plugin",
    "affected_version": "[*, 1.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-1000506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000506",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Seriously Simple Podcasting \u003c= 2.16.0 - Cross-Site Request Forgery",
    "slug": "seriously-simple-podcasting",
    "type": "plugin",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40132",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EmpikPlace for Woocommerce \u003c= 1.4.3 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "empik-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32568",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPBakery Visual Composer WHMCS Elements \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcode",
    "slug": "void-visual-whmcs-element",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10172",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accounting for WooCommerce \u003c=1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "accounting-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26929",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Files Download Delay \u003c= 1.0.6 - Missing Authorization to Settings Reset",
    "slug": "files-download-delay",
    "type": "plugin",
    "affected_version": "[*, 1.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1570",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47390",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Groups and Communities \u003c= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1408",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.60 - Arbitrary File Upload in File Manager",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.60",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-31090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31090",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Leyka \u003c= 3.31.9 - Unauthenticated Local File Inclusion",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "* - 3.31.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.31.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52805",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Ajax Chat \u003c= 20220115 - Cross-Site Request Forgery",
    "slug": "simple-ajax-chat",
    "type": "plugin",
    "affected_version": "* - 20220115",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20220115",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27850",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Cookie Bar \u003c= 2.0 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "cookie-bar",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-49836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49836",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iATS Online Forms \u003c= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter",
    "slug": "iats-online-forms",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9441",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Opal Membership \u003c= 1.2.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "opal-membership",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7649",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor Pro \u003c= 5.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_html_tag'",
    "slug": "essential-addons-elementor",
    "type": "plugin",
    "affected_version": "* - 5.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3645",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bot for Telegram on WooCommerce \u003c= 1.2.6 - Missing Authorization",
    "slug": "bot-for-telegram-on-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48268",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table of Contents Widget",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3106",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xpro Addons For Beaver Builder \u0026#8211; Lite \u003c= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xpro-addons-beaver-builder-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48232",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Project Status \u003c= 1.6 - Reflected Cross-Site Scripting",
    "slug": "project-status",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24558",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment and Event Booking Calendar for WordPress - Amelia \u003c 1.0.47 - Arbitrary Booking Update and Sensitive Data Exposure",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "[*, 1.0.47)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.47",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0720",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "DN Popup \u003c= 1.2.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "dn-popup",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7690",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Expired Title",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3489",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons PRO \u003c= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Mouse Cursor Module",
    "slug": "premium-addons-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2238",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5215",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c= 4.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7879",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "0mk Shortener \u003c= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "0mk-shortener",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2933",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Classified Listing – Classified ads \u0026 Business Directory Plugin \u003c= 4.0.1 - Reflected Cross-Site Scripting",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24745",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ThemeHunk \u003c= 1.1.1 - Missing Authorization",
    "slug": "themehunk-megamenu-plus",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30990",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Revolution Video Player \u003c= 2.9.2 - Reflected Cross-Site Scripting",
    "slug": "revolution_video_player",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31058",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads - Quota \u003c 1.2.5 - Cross-Site Scripting",
    "slug": "quota",
    "type": "theme",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9534",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CodeBard's Patron Button and Widgets for Patreon \u003c= 2.1.9 - Cross-Site Request Forgery",
    "slug": "patron-button-and-widgets-by-codebard",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47765",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nmedia WordPress Member Conversation \u003c 1.4 - Arbitrary File Upload",
    "slug": "wordpress-member-private-conversation",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-3577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3577",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Poll Maker \u003c= 3.2.0 - SQL Injection",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "[*, 3.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24483",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "cformsII \u003c 14.6.10 - SQL Injection",
    "slug": "cforms2",
    "type": "plugin",
    "affected_version": "[*, 14.6.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.6.10",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9333",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responder \u003c= 4.3.8 - Cross-Site Request Forgery",
    "slug": "responder",
    "type": "plugin",
    "affected_version": "* - 4.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58801",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tablesome Table Premium \u003c= 1.1.23 - Missing Authorization",
    "slug": "tablesome-premium",
    "type": "plugin",
    "affected_version": "* - 1.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30944",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "File Manager Pro – Filester \u003c=  1.8 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "filester",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4861",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Webico Slider Flatsome Addons \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wbc_image Shortcode",
    "slug": "webico-slider-flatsome-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5881",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Cron Manager \u003c= 2.4.1 - Subscriber+ Arbitrary Events/Schedules Creation/Deletion",
    "slug": "advanced-cron-manager",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25084",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Cron Manager \u003c= 2.4.1 - Subscriber+ Arbitrary Events/Schedules Creation/Deletion",
    "slug": "advanced-cron-manager-pro",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25084",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Opstore \u003c= 1.4.5 - Unauthenticated Local File Inclusion",
    "slug": "opstore",
    "type": "theme",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39387",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.7.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25020",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rozario \u003c= 1.4 - Missing Authorization",
    "slug": "rozario",
    "type": "theme",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31065",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Team Members \u003c= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "team-members",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1331",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Companion Sitemap Generator \u003c= 4.5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "companion-sitemap-generator",
    "type": "plugin",
    "affected_version": "* - 4.5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0066",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nice PayPal Button Lite \u003c= 1.3.5 - Cross-Site Request Forgery",
    "slug": "nice-paypal-button-lite",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22686",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spreadshop Plugin \u003c= 1.6.5 - Cross-Site Request Forgery",
    "slug": "spreadshop",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29426",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Gallery \u003c= 1.0.10 - Reflected Cross-Site Scripting",
    "slug": "video-slider-with-thumbnails",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2708",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscribe2 \u003c= 10.40 - Cross-Site Request Forgery",
    "slug": "subscribe2",
    "type": "plugin",
    "affected_version": "* - 10.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3407",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE \u003c= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Employee Directory – Staff Listing \u0026amp; Team Directory Plugin for WordPress \u003c= 4.5.3 - Unauthenticated PHP Object Injection",
    "slug": "employee-directory",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53243",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PAPERCITE \u003c= 0.5.18 - Missing Authorization",
    "slug": "papercite",
    "type": "plugin",
    "affected_version": "* - 0.5.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23849",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Limit Login Attempts Reloaded \u003c= 2.17.3 - Login Rate Limiting Bypass",
    "slug": "limit-login-attempts-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.17.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35590",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Recipe Card Blocks by WPZOOM \u003c= 2.8.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "recipe-card-blocks-by-wpzoom",
    "type": "plugin",
    "affected_version": "[*, 2.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24634",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SearchIQ – The Search Solution \u003c= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "searchiq",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13350",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GamiPress – Button \u003c= 1.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gamipress-button",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2460",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Max Mega Menu \u003c= 3.3. - Missing Authorization",
    "slug": "megamenu",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-28003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-28003",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JetElements For Elementor \u003c= 2.7.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.7.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39448",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.30",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.30",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.22",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.22",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.21",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.21",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.9",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.5",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.33",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.33",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.27",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.27",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.17",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.17",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.13",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.13",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.6",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.33",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.33",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.31",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.31",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.30",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.30",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.18",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.18",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.14",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.14",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Arbitrary User Meta Update",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.23",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.23",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4050",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Meta Data and Taxonomies Filter (MDTF) \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29906",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsivity \u003c= 0.0.6 - Reflected Cross-Site Scripting",
    "slug": "responsivity",
    "type": "plugin",
    "affected_version": "* - 0.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23548",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WE Blocks \u003c= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "we-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22529",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Plugin \u003c= 2.5 - Cross-Site Scripting",
    "slug": "ml-slider",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4846",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Members \u003c= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "members",
    "type": "plugin",
    "affected_version": "* - 3.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11008",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ELEX Product Feed for WooCommerce \u003c= 3.1.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "elex-product-feed",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47643",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Canto \u003c= 1.9.0 - Blind Server-Side Request Forgery via detail.php",
    "slug": "canto",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28976",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "UiCore Elements – Free Elementor widgets and templates \u003c= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "uicore-elements",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1054",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Post Notes \u003c= 1.7.5 - Subscriber+ Stored Cross-Site Scripting",
    "slug": "simple-post-notes",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2186",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Livemesh Addons for Beaver Builder \u003c= 3.6.1 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "addons-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38784",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DD Roles \u003c= 4.1 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "dd-roles",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23528",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Kit \u003c= 1.0.116 - Missing Authorization to Arbitrary Transient Update",
    "slug": "royal-elementor-kit",
    "type": "theme",
    "affected_version": "* - 1.0.116",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.116",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0835",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection",
    "slug": "inprosysmedia-likes-dislikes-post",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5287",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Plugins List \u003c= 2.5 - Authenticated (Author+) Stored Cross-Site Scripting via replace_plugin_list_tags",
    "slug": "plugins-list",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31232",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "include-file \u003c= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "include-file",
    "type": "plugin",
    "affected_version": "* - 1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30595",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AutomatorWP \u003c= 1.7.5 - Privilege Escalation",
    "slug": "automatorwp",
    "type": "plugin",
    "affected_version": "[*, 1.7.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24717",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Livemesh Addons for WPBakery Page Builder \u003c= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addons-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43320",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Stacker \u003c= 1.8.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-stacker",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5003",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_size",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "0.1.0 - 3.1.3",
    "from_version": "0.1.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24202",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Posts Webcam Recorder \u003c 3.2.4 - Cross-Site Scripting",
    "slug": "video-posts-webcam-recorder",
    "type": "plugin",
    "affected_version": "[*, 3.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Invoices \u0026 Packing Slips for WooCommerce \u003c= 3.7.6 - Authenticated (Shop Manager+) SQL Injection",
    "slug": "woocommerce-pdf-invoices-packing-slips",
    "type": "plugin",
    "affected_version": "* - 3.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22147",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FormCraft \u003c= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.php",
    "slug": "formcraft3",
    "type": "plugin",
    "affected_version": "* - 3.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13783",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Binary MLM Woocommerce \u003c= 2.0 - Reflected Cross-Site Scripting via 'page'",
    "slug": "woo-binary-mlm",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12384",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.12.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8801",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking \u003c= 3.7.1 - Cross-Site Request Forgery",
    "slug": "woo-ecommerce-tracking-for-google-and-facebook",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40561",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Analytify \u003c= 5.4.3 - Missing Authorization",
    "slug": "wp-analytify",
    "type": "plugin",
    "affected_version": "* - 5.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53814",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MJ Update History \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "mj-update-history",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32543",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MJ Contact us \u003c= 5.2.3 - Reflected Cross-Site Scripting",
    "slug": "mj-contact-us",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23885",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Hours Indicator \u003c= 2.3.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "business-hours-indicator",
    "type": "plugin",
    "affected_version": "[*, 2.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24593",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Credova_Financial \u003c= 2.5.0 - Cross-Site Request Forgery",
    "slug": "credova-financial",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47674",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-ViperGB \u003c= 1.6.1 - Cross-Site Request Forgery",
    "slug": "wp-vipergb",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4409",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Move Addons for Elementor \u003c= 1.3.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates",
    "slug": "move-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10360",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BC Menu Bar Cart Icon For WooCommerce By Binary Carpenter \u003c= 1.49.3 - Cross-Site Request Forgery",
    "slug": "bc-menu-cart-woo",
    "type": "plugin",
    "affected_version": "* - 1.49.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.49.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49855",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 5.0.8 - Missing Authorization",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 5.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53795",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Feed Them Social – for Twitter feed, Youtube and more \u003c= 2.9.9 - Cross-Site Request Forgery to Settings update",
    "slug": "feed-them-social",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2942",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Qr Code and Barcode Scanner Reader \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "qr-code-and-barcode-scanner-reader",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22819",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP jQuery DataTable \u003c= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-jquery-datatable",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56287",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Save \u0026 Import Image from URL \u003c= 0.7 - Reflected Cross-Site Scripting",
    "slug": "save-import-image-from-url",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23960",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobify - Job Board WordPress Theme \u003c= 4.2.3 - Missing Authorization",
    "slug": "jobify",
    "type": "theme",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52480",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Polls \u003c= 2.71 - SQL Injection",
    "slug": "wp-polls",
    "type": "plugin",
    "affected_version": "* - 2.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.71",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9352",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cool fade popup \u003c= 10.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "cool-fade-popup",
    "type": "plugin",
    "affected_version": "* - 10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30947",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Google Analytics by Monster Insights \u003c= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-analytics-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 8.14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23999",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category and Taxonomy Meta Fields \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-custom-taxonomy-meta",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9589",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Meta Data Manager \u003c=1.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "post-meta-data-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5425",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Calculated Fields Form \u003c= 5.2.45 - HTML Injection",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 5.2.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9940",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Black Widgets For Elementor \u003c= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "black-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22806",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 6.4.6.4 - Missing Authorization",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.4.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30515",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sticky Header Effects for Elementor \u003c= 2.1.3 - Missing Authorization",
    "slug": "sticky-header-effects-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58251",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor \u003c= 4.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "front-editor",
    "type": "plugin",
    "affected_version": "* - 4.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2967",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Database Backup \u003c 5.2 - Unauthenticated OS Command Injection",
    "slug": "wp-database-backup",
    "type": "plugin",
    "affected_version": "[*, 5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-25224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25224",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NEX-Forms – Ultimate Forms Plugin for WordPress \u003c= 9.1.6 - Authenticated (Admin+) SQL Injection",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 9.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10185",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.61 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4476",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Process Steps Template Designer \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "process-steps-template-designer",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4349",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Course Booking System \u003c= 6.1 - Missing Authorization",
    "slug": "course-booking-system",
    "type": "plugin",
    "affected_version": "* - 6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32253",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.5.2 -  Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2199",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Parallax Content Slider \u003c= 0.9.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-parallax-content-slider",
    "type": "plugin",
    "affected_version": "* - 0.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30599",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom post type templates for Elementor \u003c= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-post-type-templates-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.1.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-51683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51683",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom post type templates for Elementor \u003c= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-post-type-templates-for-elementor",
    "type": "plugin",
    "affected_version": "1.10.0 - 1.10.1",
    "from_version": "1.10.0",
    "from_inclusive": true,
    "to_version": "1.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51683",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Filled In \u003c= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "filled-in",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22628",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MemberPress \u003c= 1.11.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter",
    "slug": "memberpress",
    "type": "plugin",
    "affected_version": "* - 1.11.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5025",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Rocket – Social Sharing Plugin \u003c= 1.3.4 - Missing Authorization to Settings Update",
    "slug": "social-rocket",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9697",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "furikake \u003c= 0.1.0 - Open Redirect",
    "slug": "furikake",
    "type": "plugin",
    "affected_version": "* - 0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-1000434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000434",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CaPa Protect \u003c= 0.5.8.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "capa",
    "type": "plugin",
    "affected_version": "* - 0.5.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1832",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "7.0 - 7.0.4",
    "from_version": "7.0",
    "from_inclusive": true,
    "to_version": "7.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-24186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24186",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "byBrick Accordion \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bybrick-accordion",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31621",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wordpress Core \u003c 5.5 - Unauthorized Password Reset via Interception",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-8295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-8295",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Calendarista \u003c= 15.5.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "calendarista",
    "type": "plugin",
    "affected_version": "* - 15.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.5.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30240",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "HTTP to HTTPS link changer by Eyga.net \u003c= 0.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "https-links-in-content",
    "type": "plugin",
    "affected_version": "* - 0.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23677",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Call Now Icon Animate \u003c= 0.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "call-now-icon-animate",
    "type": "plugin",
    "affected_version": "* - 0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34187",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inline Tweet Sharer \u003c= 2.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "inline-tweet-sharer",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24005",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BA Book Everything \u003c= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ba-book-everything",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32598",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Peekaboo \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "peekaboo",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46505",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ads by datafeedr.com \u003c= 1.1.3 - Unauthenticated (Limited) Remote Code Execution",
    "slug": "ads-by-datafeedrcom",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5843",
    "auth_type": "Unauth",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Starbox – the Author Box for Humans \u003c= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "starbox",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7955",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58597",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Import Export for WooCommerce \u003c= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function",
    "slug": "product-import-export-for-woo",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1769",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Ads Manager \u003c= 2.5.94 - Arbitrary File Upload",
    "slug": "simple-ads-manager",
    "type": "plugin",
    "affected_version": "* - 2.5.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.94",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-2825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2825",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Sharing Plugin – Social Warfare \u003c= 4.4.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "social-warfare",
    "type": "plugin",
    "affected_version": "* - 4.4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1959",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PWA for WP \u0026 AMP \u003c= 1.7.32 - Arbitrary File Upload",
    "slug": "pwa-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.7.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.32",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4354",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Himer \u003c= 2.1.0 - Cross-Site Request Forgery to Group Leave",
    "slug": "himer",
    "type": "theme",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2233",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Icegram Express \u003c= 5.5.2 - Unauthenticated CSV Injection",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45810",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "VG WORT METIS \u003c= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update",
    "slug": "vgw-metis",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5812",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "3D FlipBook \u003c= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "interactive-3d-flipbook-powered-physics-engine",
    "type": "plugin",
    "affected_version": "* - 1.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4453",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sharebar \u003c= 1.2.1 - SQL Injection",
    "slug": "sharebar",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-6719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6719",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email download link \u003c= 3.7 - Unauthenticated Sensitive Information Exposure",
    "slug": "email-download-link",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36523",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "UK Address Postcode Validation \u003c= 3.9.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "uk-address-postcode-validation",
    "type": "plugin",
    "affected_version": "* - 3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57923",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Block Referer Spam \u003c= 1.1.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "block-referer-spam",
    "type": "plugin",
    "affected_version": "* - 1.1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9.4",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-32497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32497",
    "auth_type": "Privileged",
    "cvss_score": 3.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Naver Syndication V2 \u003c= 0.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "badr-naver-syndication",
    "type": "plugin",
    "affected_version": "* - 0.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26552",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GB Gallery Slideshow \u003c= 1.3 - Missing Authorization",
    "slug": "gb-gallery-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31732",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 1.14.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 1.14.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36656",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Icons \u003c= 1.0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "icon",
    "type": "plugin",
    "affected_version": "* - 1.0.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Activity Log \u003c= 1.6.5 - Unauthenticated Data Export to Sensitive Information Disclosure",
    "slug": "user-activity-log",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4269",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "XM-Backup \u003c= 0.9.1 - Cross-Site Request Forgery",
    "slug": "xm-backup",
    "type": "plugin",
    "affected_version": "* - 0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48109",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Related Posts \u003c= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-related-posts",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46227",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Abandoned Cart Recovery for WooCommerce by Autonami \u003c= 2.1.1 - Missing Authorization",
    "slug": "wp-marketing-automations",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2389",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "EU DSGVO Helper \u003c= 1.0.6.1 - Reflected Cross-Site Scripting",
    "slug": "dsgvo",
    "type": "plugin",
    "affected_version": "* - 1.0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23866",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP LOL Rotation \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "league-of-legends-rotation",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49437",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Bulk Delete \u003c= 1.3.6 - Missing Authorization",
    "slug": "wp-bulk-delete",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58192",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Chat App \u003c= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes",
    "slug": "wp-whatsapp",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1761",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flaming Forms \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "flaming-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7692",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "10Web Social Post Feed \u003c= 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "wd-facebook-feed",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2503",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SendPulse Email Marketing Newsletter \u003c= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sendpulse-email-marketing-newsletter",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22662",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popularis Extra \u003c= 1.2.6 - Reflected Cross-Site Scripting",
    "slug": "popularis-extra",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9353",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Editor \u003c= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Update",
    "slug": "wp-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3294",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Brutal AI \u003c 2.0.0 - Cross-Site Request Forgery to SQL Injection",
    "slug": "wpbrutalai",
    "type": "plugin",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-2601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2601",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CozyStay \u003c 1.7.1 - Unauthenticated PHP Object Injection",
    "slug": "cozystay",
    "type": "theme",
    "affected_version": "[*, 1.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-49507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49507",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CP Appointment Calendar \u003c= 1.1.5 - Unauthenticated SQL Injection",
    "slug": "cp-appointment-calendar",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-10099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10099",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Flipbox Builder \u003c= 1.5 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "flipbox-builder",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6152",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Coming Soon, Under Construction \u0026 Maintenance Mode By Dazzler \u003c= 2.1.2 - Maintenance Mode Bypass",
    "slug": "coming-soon-wp",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1181",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Website Monetization by MageNet \u003c= 1.0.29.1 - Cross-Site Request Forgery via admin_magenet_settings",
    "slug": "website-monetization-by-magenet",
    "type": "plugin",
    "affected_version": "* - 1.0.29.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.29.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22673",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Vitamin \u003c 1.1.0 - Directory Traversal",
    "slug": "vitamin",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-6651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6651",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BulletProof Security \u003c= 5.7 - Admin+ Stored Cross-Site Scripting",
    "slug": "bulletproof-security",
    "type": "plugin",
    "affected_version": "[*, 5.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0590",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SupportCandy \u003c= 3.1.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2719",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tidekey \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "tidekey",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30563",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eBay Product Feeds \u003c= 3.4.8 - Authenticated (Contributor+) Server Side Request Forgery",
    "slug": "ebay-feeds-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58977",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Keap Landing Pages \u003c= 1.4.2 - Cross-Site Request Forgery",
    "slug": "infusionsoft-landing-pages",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44241",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Travel Booking WordPress Theme \u003c 3.2.3 - Reflected Cross-Site Scripting",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "[*, 3.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-59012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59012",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SnapWidget Social Photo Feed Widget \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "snapwidget-wp-instagram-widget",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58241",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eDoc Easy Tables \u003c= 1.29 - Cross-Site Request Forgery to SQL Injection",
    "slug": "edoc-easy-tables",
    "type": "plugin",
    "affected_version": "* - 1.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53793",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Load More Posts \u003c= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "load-more-posts",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple Booking Calendar \u003c= 2.0.8.4 - Cross-Site Request Forgery",
    "slug": "wp-simple-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 2.0.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51525",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Futurio Extra \u003c= 1.9.0 - Cross-Site Request Forgery",
    "slug": "futurio-extra",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40201",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Weight Based Shipping \u003c= 5.4.1 - Cross-Site Request Forgery leading to Plugin Settings Changes",
    "slug": "weight-based-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46794",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Printus \u003c= 1.2.6 - Missing Authorization",
    "slug": "printus-cloud-printing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31830",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Button Generator – easily Button Builder \u003c= 2.3.8 - Cross-Site Request Forgery",
    "slug": "button-generation",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49155",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikRentCar Car Rental Management System \u003c= 1.3.0 - Authenticated (Admin+) Cross Site Scripting",
    "slug": "vikrentcar",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23998",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bring Fraktguiden for WooCommerce \u003c= 1.11.4 - Missing Authorization",
    "slug": "bring-fraktguiden-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.11.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39559",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Eyewear prescription form \u003c= 4.0.18 - Missing Authorization to Unauthenticated Arbitrary Options Update",
    "slug": "eyewear-prescription-form",
    "type": "plugin",
    "affected_version": "* - 4.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54239",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPB Show Core \u003c= 2.6 - Reflected Cross-Site Scripting",
    "slug": "wpb-show-core",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1956",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metaphor Widgets \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mtphr-widgets",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23816",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "1 Click WordPress Migration Plugin – 100% FREE for a limited time \u003c= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation",
    "slug": "1-click-migration",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13555",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4942",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form Widget – Contact Query, Contact Page, Form Maker, Query Table \u003c= 1.3.8 - Authenticated (Admin+) SQL Injection",
    "slug": "new-contact-form-widget",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17072",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Announcement \u0026 Notification Banner – Bulletin \u003c= 3.6.0 - Missing Authorization Checks",
    "slug": "bulletin-announcements",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2066",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Fastly \u003c= 1.2.28 - Cross-Site Request Forgery",
    "slug": "fastly",
    "type": "plugin",
    "affected_version": "* - 1.2.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58199",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP AdCenter – Ad Manager \u0026 Adsense Ads \u003c= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpadcenter_ad Shortcode",
    "slug": "wpadcenter",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10113",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Post Type Lockdown \u003c= 1.11 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "custom-post-type-lockdown",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23530",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Proposals \u003c= 2.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-proposals",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31837",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy US Sales Taxes Add-on for iThemes Exchange \u003c 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "exchange-addon-easy-us-sales-taxes",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9369",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kona Gallery Block \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kona-instagram-feed-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13400",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-ContactForm \u003c= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-contactform",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-0197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0197",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blaze Demo Importer \u003c= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install",
    "slug": "blaze-demo-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8446",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Floating Window Music Player \u003c= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "floating-window-music-player",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48104",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Checkout Field Editor (Checkout Manager) \u003c= 2.1.8 - Cross-Site Request Forgery",
    "slug": "woo-checkout-regsiter-field-editor",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31262",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All in One SEO Pack \u003c= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "* - 4.8.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2892",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CodePen Embedded Pens Shortcode \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "codepen-embedded-pen-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37960",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podcast Subscribe Buttons \u003c= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "podcast-subscribe-buttons",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5308",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Disable Admin Notices individually \u003c= 1.3.6 - Cross-Site Request Forgery",
    "slug": "disable-admin-notices",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52420",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Another Events Calendar \u003c= 1.7.0 - Reflected Cross-Site Scripting",
    "slug": "another-events-calendar",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26536",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2115",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "If Menu \u003c= 0.19.1 - Missing Authorization to License Key Update",
    "slug": "if-menu",
    "type": "plugin",
    "affected_version": "* - 0.19.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.19.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7894",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Database Backup for WordPress \u003c= 2.5.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-db-backup",
    "type": "plugin",
    "affected_version": "[*, 2.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1577",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP GoToWebinar \u003c= 14.46 - Missing Authorization",
    "slug": "wp-gotowebinar",
    "type": "plugin",
    "affected_version": "* - 14.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32804",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WP Pro Real Estate 7 \u003c 3.1.1 - Reflected Cross-Site Scripting",
    "slug": "realestate-7",
    "type": "theme",
    "affected_version": "[*, 3.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24387",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom WooCommerce Checkout Fields Editor \u003c= 1.3.1 - Missing Authorization",
    "slug": "add-fields-to-checkout-page-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33956",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Recall \u003c= 16.26.6 - Cross-Site Request Forgery",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35657",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-FB-AutoConnect \u003c= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-fb-autoconnect",
    "type": "plugin",
    "affected_version": "* - 4.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50022",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0585",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Duitku Payment Gateway \u003c= 2.11.6 - Missing Authorization via check_duitku_response",
    "slug": "duitku-social-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 2.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0631",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Table by WBW \u003c= 2.0.1 - Unauthenticated Remote Code Execution",
    "slug": "woo-product-tables",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6365",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shopping Cart \u0026 eCommerce Store \u003c 3.0.16 - Arbitrary File Upload",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "[*, 3.0.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9308",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Size Chart For WooCommerce \u003c= 1.1.5 - Cross-Site Request Forgery via get_save_option",
    "slug": "product-size-chart-for-woo",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48778",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Eventin \u003c= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39648",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Composite Products for WooCommerce \u003c= 7.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wpc-composite-products",
    "type": "plugin",
    "affected_version": "* - 7.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2838",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blocksy Companion \u003c= 1.8.67 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blocksy-companion",
    "type": "plugin",
    "affected_version": "[*, 1.8.68)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.68",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-23898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23898",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 6.2.0 - Incorrect Authorization Checks on REST API Endpoints",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "* - 6.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0775",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Blog2Social: Social Media Auto Post \u0026 Scheduler \u003c= 7.2.0 - Reflected Cross-Site Scripting",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "[*, 7.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-3936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3936",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Carousel Slider for Elementor \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-carousel-slider-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53749",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "weForms – Easy Drag \u0026 Drop Contact Form Builder For WordPress \u003c= 1.6.17 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "weforms",
    "type": "plugin",
    "affected_version": "* - 1.6.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50896",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Safe SVG \u003c= 2.2.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "safe-svg",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8378",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Twitter Mega Fan Box Widget  \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-twitter-mega-fan-box",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30553",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arlo \u003c= 6.0.3 - Unauthenticated Local File Inclusion",
    "slug": "arlo",
    "type": "theme",
    "affected_version": "* - 6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39475",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zendrop – Global Dropshipping \u003c= 1.0.0 - SQL Injection in setMetaData",
    "slug": "zendrop-dropshipping-and-fulfillment",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-25960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25960",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Project Manager \u003c= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10520",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Amazon Einzeltitellinks \u003c= 1.3.3 - Cross-Site Request Forgery to Arbitrary Settings Update",
    "slug": "amazon-einzeltitellinks",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1830",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.12.3 - Missing Authorization",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.12.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48045",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Small Package Quotes – Unishippers Edition \u003c= 2.4.9 - Reflected Cross-Site Scripting",
    "slug": "small-package-quotes-unishippers-edition",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26918",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share Buttons by Supsystic \u003c= 2.2.3 - Missing Authorization",
    "slug": "social-share-buttons-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27235",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "TI WooCommerce Wishlist \u003c= 2.9.2 - Unauthenticated Arbitrary File Upload",
    "slug": "ti-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47577",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BuddyForms \u003c= 2.8.12 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47377",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Umbrella: Update Backup Restore \u0026 Monitoring \u003c= 2.17.0 - Unauthenticated Local File Inclusion",
    "slug": "wp-health",
    "type": "plugin",
    "affected_version": "* - 2.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12209",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Page Visit Counter  \u003c= 5.0.8 - Unauthenticated Cross-Site Scripting",
    "slug": "advanced-page-visit-counter",
    "type": "plugin",
    "affected_version": "* - 5.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25086",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdRotate – Ad manager \u0026 AdSense Ads \u003c= 5.8.22 - Authenticated Stored Cross-Site Scripting via Group Names",
    "slug": "adrotate",
    "type": "plugin",
    "affected_version": "[*, 5.8.23)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.23",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0649",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Builder \u003c= 7.6.5 - Reflected Cross-Site Scripting",
    "slug": "themify-builder",
    "type": "plugin",
    "affected_version": "* - 7.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13319",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pretty Simple Popup Builder \u003c= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pretty-simple-popup-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39626",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Joli FAQ SEO – WordPress FAQ Plugin \u003c= 1.3.2 - Cross-Site Request Forgery",
    "slug": "joli-faq-seo",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4082",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Action Network \u003c= 1.4.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "wp-action-network",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12394",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register \u003c= 3.8.1.2 - Missing Authorization to Arbitrary User Deletion",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "* - 3.8.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4024",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Embed PDF Viewer \u003c= 2.3.1 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "embed-pdf-viewer",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56256",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Universal Video Player - Addon for WPBakery Page Builder \u003c= 3.2.1 - Reflected Cross-Site Scripting",
    "slug": "lbg_universal_video_player_addon_visual_composer",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53562",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CtyGrid Hyp3rL0cal Search WordPress Plugin \u003c= 0.1.1.1 - Reflected Cross-Site Scripting",
    "slug": "hyp3rl0cal-city-search",
    "type": "plugin",
    "affected_version": "* - 0.1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23695",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom fields shortcode \u003c= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "custom-fields-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6809",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.7 - 2.7.1",
    "from_version": "2.7",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.8 - 2.8.1",
    "from_version": "2.8",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "1.9 - 1.9.3",
    "from_version": "1.9",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.0 - 2.0.8",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.3 - 2.3.6",
    "from_version": "2.3",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.5 - 2.5.1",
    "from_version": "2.5",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.9 - 2.9.2",
    "from_version": "2.9",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.1 - 2.1.3",
    "from_version": "2.1",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.2 - 2.2.6",
    "from_version": "2.2",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.4 - 2.4.3",
    "from_version": "2.4",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 2.9.3 - Security Bypass",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.6 - 2.6.2",
    "from_version": "2.6",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0173",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slimstat Analytics \u003c= 4.9.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "* - 4.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4310",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Links/Problem Reporter \u003c= 2.6.0 - Reflected Cross-Site Scripting",
    "slug": "report-broken-links",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23834",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Inventory Manager \u003c= 2.1.0.13 - Cross-Site Request Forgery via delete_item",
    "slug": "wp-inventory-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2842",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All in One WP Migration \u003c= 7.89 - Unauthenticated PHP Object Injection",
    "slug": "all-in-one-wp-migration",
    "type": "plugin",
    "affected_version": "* - 7.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10942",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ajax Rating with Custom Login \u003c= 1.1 - Unauthenticated SQL Injection",
    "slug": "ajax-rating-with-custom-login",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49246",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Viala \u003c= 1.3.1 - Reflected Cross-Site Scripting",
    "slug": "viala",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44029",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myCred – Points, Rewards, Gamification, Ranks, Badges \u0026 Loyalty Plugin  \u003c= 2.4.3 - Missing Authorization",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "[*, 2.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1092",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Forms Ada \u003c= 1.0 - Reflected Cross-Site Scripting via 'p' parameter",
    "slug": "forms-ada-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27613",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Bar Remover \u003c= 1.0.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "admin-bar",
    "type": "plugin",
    "affected_version": "* - 1.0.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1716",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "StoreBiz \u003c= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "storebiz",
    "type": "theme",
    "affected_version": "* - 1.0.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26732",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slimstat Analytics \u003c 4.1.6.1 - Cross-Site Scripting",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "[*, 4.1.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9273",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simplebooklet PDF Viewer and Embedder \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simplebooklet",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13588",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Falang multilanguage \u003c= 1.3.65 - Unauthenticated PHP Object Injection",
    "slug": "falang",
    "type": "plugin",
    "affected_version": "* - 1.3.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.65",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58619",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ShortPixel Image Optimizer \u003c= 5.6.3 - Missing Authorization",
    "slug": "shortpixel-image-optimiser",
    "type": "plugin",
    "affected_version": "* - 5.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48044",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP VR \u003c= 8.3.14 - Missing Authorization to Plugin Version Downgrade",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6529",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CM On Demand Search And Replace \u003c= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cm-on-demand-search-and-replace",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31228",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "6Storage Rentals \u003c= 2.19.4 - Missing Authorization",
    "slug": "6storage-rentals",
    "type": "plugin",
    "affected_version": "* - 2.19.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.19.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32178",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MainWP Google Analytics Extension \u003c= 4.0.4 - Missing Authorization to Plugin Settings Change",
    "slug": "mainwp-google-analytics-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23652",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsmag \u003c 5.0 - Reflected Cross-Site Scripting",
    "slug": "newsmag",
    "type": "theme",
    "affected_version": "[*, 5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24304",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP MLM Unilevel \u003c= 4.0 - Unauthenticated Privilege Escalation",
    "slug": "wp-mlm",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Striking \u003c= 2.3.4 - Reflected Cross-Site Scripting",
    "slug": "striking-r",
    "type": "theme",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37267",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Me Now! \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bulk-me-now",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12708",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AppPresser \u003c= 4.3.0 - Cross-Site Request Forgery via force_logging_off()",
    "slug": "apppresser",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31374",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Add SVG Support for Media Uploader | inventivo \u003c= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "add-svg-support-for-media-uploader-inventivo",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7088",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Small Package Quotes – Purolator Edition \u003c= 3.6.4 - Unauthenticated SQL Injection",
    "slug": "small-package-quotes-purolator-edition",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13532",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "eCommerce Product Catalog \u003c= 3.0.38 Reflected Cross-Site Scripting",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "[*, 3.0.39)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.39",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24875",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Downloable by American Osteopathic Association \u003c= 0.1.0 - Unauthenticated Server-Side Request Forgery",
    "slug": "aoa-downloadable",
    "type": "plugin",
    "affected_version": "* - 0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13618",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Plugin \u003c= 1.6.2 - Missing Authorization and Sensitive Information Exposure",
    "slug": "download-plugin",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25059",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Easy Quotes \u003c= 1.2.4 - Missing Authorization",
    "slug": "easy-quotes",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58681",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow SE \u003c= 2.5.5 - Authenticated (Subscriber+) Cross-Site Scripting",
    "slug": "slideshow-se",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43461",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Elementor Addon \u003c= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag",
    "slug": "post-grid-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 2.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34789",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cryptocurrency Price Widget \u003c= 1.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "cryptocurrency-price-widget",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54308",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traveler \u003c 3.2.1 - Unauthenticated PHP Object Injection",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "[*, 3.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-26873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26873",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slider by BestWebSoft \u003c= 1.1.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "slider-bws",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31099",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "bib2html \u003c= 0.9.3 - Cross-Site Scripting",
    "slug": "bib2html",
    "type": "plugin",
    "affected_version": "* - 0.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-3870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3870",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Import Export for WooCommerce \u003c= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter",
    "slug": "product-import-export-for-woo",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1913",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RegistrationMagic \u003c= 5.3.2.0 - Reflected Cross-Site Scripting",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33947",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure",
    "slug": "miniorange-oauth-oidc-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 18.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure",
    "slug": "miniorange-oauth-oidc-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 40.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "40.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure",
    "slug": "miniorange-oauth-oidc-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 28.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "28.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure",
    "slug": "miniorange-oauth-oidc-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 48.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "48.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure",
    "slug": "miniorange-oauth-oidc-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 30.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "30.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure",
    "slug": "miniorange-oauth-oidc-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 38.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "38.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure",
    "slug": "miniorange-oauth-oidc-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 50.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "50.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Slider by 10Web – Responsive Image Slider \u003c= 1.2.54 - Reflected Cross-Site Scripting",
    "slug": "slider-wd",
    "type": "plugin",
    "affected_version": "* - 1.2.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.54",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32578",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paytium: Mollie payment forms \u0026 donations \u003c= 4.3.7 - Missing Authorization in 'paytium_sw_save_api_keys'",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7289",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 2.8 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-2431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2431",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WebinarPress \u003c= 1.33.27 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "wp-webinarsystem",
    "type": "plugin",
    "affected_version": "* - 1.33.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47635",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 13.1.4 - Unauthenticated Blind SQL Injection",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 13.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0513",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "About Rentals \u003c= 1.5 - Missing Authorization",
    "slug": "about-rentals",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36427",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Ogulo – 360° Tour \u003c= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter",
    "slug": "ogulo-360-tour",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9131",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Responsive Gallery Album \u003c= 1.4 - Missing Authorization",
    "slug": "ai-responsive-gallery-album",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23785",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Uncanny Toolkit for LearnDash \u003c= 3.6.4.3 - Open Redirect",
    "slug": "uncanny-learndash-toolkit",
    "type": "plugin",
    "affected_version": "[*, 3.6.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-34020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34020",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.3.3 \u0026 WordPress MU \u003c 1.3.2 - Remote Code Execution",
    "slug": "wpmu",
    "type": "core",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-5695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-5695",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.3.3 \u0026 WordPress MU \u003c 1.3.2 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-5695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-5695",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Emergency Password Reset \u003c= 9.0 - Cross-Site Request Forgery",
    "slug": "emergency-password-reset",
    "type": "plugin",
    "affected_version": "* - 9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57942",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Kanban Boards \u003c= 2.5.21 - Authenticated (Administrator+) Remote Code Execution",
    "slug": "kanban",
    "type": "plugin",
    "affected_version": "* - 2.5.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.21",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-40606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40606",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.30",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.18",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.10",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.20",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.11",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.30",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.27",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.24",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.19",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.2",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.3",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.28",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.27",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.15",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.14",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.6",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17674",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Remove slug from custom post type \u003c= 1.0.3 - Cross-Site Request Forgery",
    "slug": "remove-slug-from-custom-post-type",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44238",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Monster \u003c= 1.2.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "event-monster",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3720",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.4.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-40009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40009",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LocateAndFilter \u003c= 1.6.16 - Missing Authorization",
    "slug": "locateandfilter",
    "type": "plugin",
    "affected_version": "* - 1.6.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47457",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Strong Testimonials \u003c= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields",
    "slug": "strong-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Buying Buddy IDX CRM \u003c= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "buying-buddy-idx-crm",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50037",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Admin CSS \u003c= 2.0.1 - Unauthenticated Full Path Dislcosure",
    "slug": "add-admin-css",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6547",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "NOTICE BOARD BY TOWKIR \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "notice-board-by-towkir",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12816",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c 5.3.9 - Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "[*, 5.3.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-7479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7479",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fast Total Search \u003c= 1.68.232 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "fulltext-search",
    "type": "plugin",
    "affected_version": "* - 1.68.232",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.68.232",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-39663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39663",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Charitable \u003c= 1.7.0.13 - Authenticated(Contributor+) Stored Cross-Site Scripting",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "[*, 1.7.0.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-47816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47816",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Map Block – Gutenberg Map Block for Google Map and OpenStreet Map \u003c= 1.2.2 - Stored Cross-Site Scripting",
    "slug": "wp-map-block",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24643",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery, Images, Slider in Rbs Image Gallery \u003c= 3.2.9 - Missing Authorization",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45841",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Social Media Share Buttons \u0026 Social Sharing Icons \u003c= 2.8.5 - Information Exposure",
    "slug": "ultimate-social-media-icons",
    "type": "plugin",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5070",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Full Stripe Free \u003c= 8.2.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-full-stripe-free",
    "type": "plugin",
    "affected_version": "* - 8.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58789",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 3.2.5 - Reflected Cross-Site Scripting",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43971",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Course Manager \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-course-manager",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51658",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GoodBarber \u003c= 1.0.26 - Open Redirect",
    "slug": "goodbarber",
    "type": "plugin",
    "affected_version": "* - 1.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39523",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "List Last Changes \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "list-last-changes",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46238",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VoucherPress \u003c= 1.5.7 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "voucherpress",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58223",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EC Stars Rating \u003c= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ec-stars-rating",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53296",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Bank – Contact Form Builder for WordPress \u003c= 2.0.19 - Cross-Site Scripting",
    "slug": "contact-bank",
    "type": "plugin",
    "affected_version": "* - 2.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-3841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3841",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetBackup – WP Backup, Migrate \u0026 Restore \u003c= 1.4.0 - Sensitive Information Disclosure",
    "slug": "backup",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36668",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "B Slider - Slider for your block editor \u003c= 1.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "b-slider",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30432",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nitan \u003c= 2.9 - Unauthenticated Local File Inclusion",
    "slug": "snsnitan",
    "type": "theme",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-24768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24768",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SpatialMatch IDX \u003c= 3.0.9 - Reflected Cross-Site Scripting",
    "slug": "spatialmatch-free-lifestyle-search",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28921",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy Page Builder \u003c= 2.3.11 - Authenticated File Upload and Path Traversal",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-38346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38346",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cryptographp \u003c= 1.2 - Cross-Site Scripting",
    "slug": "cryptographp",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-0203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0203",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML5 SoundCloud Player \u003c= 2.8.0 - Authenticated (Author+) PHP Object Injection",
    "slug": "html5-soundcloud-player-with-playlist",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-52205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52205",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "s2Member (Pro) \u003c= 241114 - Unauthenticated Remote Code Execution",
    "slug": "s2member",
    "type": "plugin",
    "affected_version": "* - 241114",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "241114",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-51815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51815",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup More Popups \u003c= 2.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "popup-more",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32800",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebP Express \u003c= 0.14.10 - Authenticated Stored Cross-Site Scripting",
    "slug": "webp-express",
    "type": "plugin",
    "affected_version": "[*, 0.14.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.14.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15837",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPMasterToolKit \u003c= 1.13.1 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "wpmastertoolkit",
    "type": "plugin",
    "affected_version": "* - 1.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56248",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PWA — easy way to Progressive Web App \u003c= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "iworks-pwa",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8967",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Ajax Search \u003c= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yith-woocommerce-ajax-search",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7846",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime \u003c= 3.3.5 - Missing Authorization to Private Event Disclosure",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6447",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CMP – Coming Soon \u0026 Maintenance \u003c= 4.1.7 - Maintenance Mode Bypass",
    "slug": "cmp-coming-soon-maintenance",
    "type": "plugin",
    "affected_version": "* - 4.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2159",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Site Reviews \u003c= 6.5.1 - Missing Authorization",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "* - 6.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27625",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Slider by 10Web \u003c= 1.2.56 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "slider-wd",
    "type": "plugin",
    "affected_version": "* - 1.2.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.56",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6408",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customize Login Page \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "customize-login-page",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31034",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin \u003c= 4.2.152 - Cross-Site Request Forgery",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "[*, 4.2.153)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.153",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-35950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35950",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pin Locations on Map \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "pin-locations-on-map",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23584",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-OGP \u003c= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-ogp",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31437",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DPEPress \u003c= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dpepress",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4219",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Colibri WP \u003c= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation",
    "slug": "colibri-wp",
    "type": "theme",
    "affected_version": "* - 1.0.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.94",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1360",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ditty (formerly Ditty News Ticker) \u003c= 3.0.14 - Reflected Cross-Site Scripting",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "[*, 3.0.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0533",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.1.3 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38095",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Fancybox \u003c= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "advanced-fancybox",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54401",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goracash \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "goracash",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53458",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Silverlight Video Player \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "smooth-streaming-player",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53713",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.3.3 - Stored Cross-Site Scripting",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "[*, 4.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-9844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-9844",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 7.8 - Missing Authorization",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "* - 7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49996",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "W3 Total Cache \u003c= 0.9.4 - Cross-Site Request Forgery",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9414",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FS Poster \u003c= 6.5.8 - Missing Authorization",
    "slug": "fs-poster",
    "type": "plugin",
    "affected_version": "* - 6.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30960",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet \u003c= 3.2.0 - Cross-Site Request Forgery to Settings Reset",
    "slug": "paid-membership",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5937",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Animated Number Counters \u003c= 1.6 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "animated-number-counters",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24393",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Buddypress Humanity \u003c= 1.2 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "buddypress-humanity",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31033",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sparkling \u003c= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation",
    "slug": "sparkling",
    "type": "theme",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13423",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photos and Files Contest Gallery \u003c= 21.3.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 21.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30236",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Read More Login \u003c= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "read-more-login",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28989",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classima \u003c 2.1.11 - Reflected Cross-Site Scripting",
    "slug": "classified-core",
    "type": "plugin",
    "affected_version": "[*, 1.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classima \u003c 2.1.11 - Reflected Cross-Site Scripting",
    "slug": "classima",
    "type": "theme",
    "affected_version": "[*, 2.1.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classima \u003c 2.1.11 - Reflected Cross-Site Scripting",
    "slug": "classified-listing-pro",
    "type": "plugin",
    "affected_version": "[*, 2.0.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.20",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classima \u003c 2.1.11 - Reflected Cross-Site Scripting",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "[*, 2.2.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classima \u003c 2.1.11 - Reflected Cross-Site Scripting",
    "slug": "classified-listing-store",
    "type": "plugin",
    "affected_version": "[*, 1.4.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.20",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Noptin \u003c= 3.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "newsletter-optin-box",
    "type": "plugin",
    "affected_version": "* - 3.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49871",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 3.5.6 - Cross-Site Scripting",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "[*, 3.5.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18499",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enable SVG, WebP \u0026 ICO Upload \u003c= 1.1.1 - Authenticated  (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "enable-svg-webp-ico-upload",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2143",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordSpew \u003c= 3.71 - SQL Injection",
    "slug": "wordspew",
    "type": "plugin",
    "affected_version": "* - 3.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.71",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-0682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0682",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Frontend Admin by DynamiApps \u003c= 3.28.7 - Authenticated (Editor+) Arbitrary File Deletion",
    "slug": "acf-frontend-form-element",
    "type": "plugin",
    "affected_version": "* - 3.28.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.28.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49303",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "SecuPress Free \u003c= 2.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation",
    "slug": "secupress",
    "type": "plugin",
    "affected_version": "* - 2.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3452",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CleverNode Related Content \u003c= 1.1.5 - Reflected Cross-Site Scripting",
    "slug": "clevernode-related-content",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54329",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Clone Menu \u003c= 1.0.1 - Missing Authorization to Menu Clone",
    "slug": "clone-menu",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38395",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Login Log \u003c= 1.1.3 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "simple-login-log",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49438",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HitPay Payment Gateway for WooCommerce \u003c= 4.1.3 - Information Exposure via Log Files",
    "slug": "hitpay-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38747",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Google Plus Share and +1 Button \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "google-plus-share-and-plusone-button",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53723",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PowerFormBuilder \u003c= 1.0.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "power-forms-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-55983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55983",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Depicter Slider \u003c= 3.1.2 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "depicter",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43161",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Gallery Grid \u003c= 2.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "responsive-gallery-grid",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0060",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leopard - WordPress offload media \u003c= 2.0.36 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "leopard-wordpress-offload-media",
    "type": "plugin",
    "affected_version": "* - 2.0.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43256",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "소셜 공유 버튼 By 코스모스팜 \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cosmosfarm-share-buttons",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53745",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Atarim \u003c= 3.31 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "atarim-visual-collaboration",
    "type": "plugin",
    "affected_version": "* - 3.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37434",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Defender Security \u003c= 3.3.2 - Sensitive Information Disclosure",
    "slug": "defender-security",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-44581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44581",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Leyka \u003c= 3.31.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "* - 3.31.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.31.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26766",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "real.Kit \u003c= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "real-kit",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12697",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contests by Rewards Fuel \u003c= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "contests-from-rewards-fuel",
    "type": "plugin",
    "affected_version": "* - 2.0.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.65",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12513",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OrderConvo \u003c= 12.4 - Missing Authorization to Arbitrary File Upload",
    "slug": "admin-and-client-message-after-order-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 12.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33566",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YourChannel \u003c= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Reset",
    "slug": "yourchannel",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1871",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPC Smart Wishlist for WooCommerce \u003c= 2.9.3 - Reflected Cross-Site Scripting",
    "slug": "woo-smart-wishlist",
    "type": "plugin",
    "affected_version": "[*, 2.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0397",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Marketplace \u003c= 4.1.17 - Reflected Cross-Site Scripting",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43213",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RealHomes \u003c= 4.3.7 - Missing Authorization",
    "slug": "realhomes",
    "type": "theme",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-37885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37885",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Tabs \u0026 Accordion \u003c= 1.3.10 - Authenticated (Contributor+) Content Injection",
    "slug": "tabs",
    "type": "plugin",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40557",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TranslatePress \u003c= 2.10.2 - Unauthenticated PHP Object Injection",
    "slug": "translatepress-multilingual",
    "type": "plugin",
    "affected_version": "* - 2.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Coming Soon \u0026 Maintenance Mode Page \u003c= 1.57 - Cross-Site Request Forgery",
    "slug": "nifty-coming-soon-and-under-construction-page",
    "type": "plugin",
    "affected_version": "* - 1.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.57",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36707",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Filter by WBW \u003c= 2.5.0 - Missing Authorization via getListForTbl",
    "slug": "woo-product-filter",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50877",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Button Block \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "button-block",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54694",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Powerkit – Supercharge your WordPress Site \u003c= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "powerkit",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magical Addons For Elementor \u003c= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "magical-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51665",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Import Export for WooCommerce \u003c= 2.3.7 - Authenticated(Shop Manager+) Arbitrary File Upload via upload_import_file",
    "slug": "product-import-export-for-woo",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22152",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ABA PayWay Payment Gateway for WooCommerce \u003c= 2.1.4 - Reflected Cross-Site Scripting",
    "slug": "aba-payway-woocommerce-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32586",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Active Directory Integration / LDAP Integration \u003c= 4.1.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "ldap-login-for-intranet-sites",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2484",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Export and Import Users and Customers \u003c= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function",
    "slug": "users-customers-import-export-for-wp-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1970",
    "auth_type": "Privileged",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "WP Mail Log \u003c= 1.1.2 - Authenticated (Contributor+) SQL Injection via id",
    "slug": "wp-mail-log",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5674",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Meks Easy Ads Widget \u003c= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "meks-easy-ads-widget",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37548",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Travel Monster \u003c= 1.1.2 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "travel-monster",
    "type": "theme",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37272",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Login and Logout Redirect \u003c= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-login-and-logout-redirect",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31927",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Pack Elementor addon \u003c= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typing Letter Widget",
    "slug": "the-pack-addon",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8214",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.12.7 - Cross-Site Request Forgery",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4690",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 2.1.3 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2007-1897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1897",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0688",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Better Elementor Addons \u003c= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links",
    "slug": "better-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2280",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPFront User Role Editor \u003c= 3.2.0 - Reflected Cross-Site Scripting",
    "slug": "wpfront-user-role-editor",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24984",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Maps \u003c= 8.1.11 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "[*, 8.1.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24383",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Sticky Elements \u003c= 2.0.8 - Authenticated (Admin+) SQL Injection",
    "slug": "mystickyelements",
    "type": "plugin",
    "affected_version": "2.0.8",
    "from_version": "2.0.8",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0487",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP GoToWebinar \u003c= 15.6 - Missing Authorization",
    "slug": "wp-gotowebinar",
    "type": "plugin",
    "affected_version": "* - 15.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38695",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPtouch \u003c= 4.3.60 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wptouch",
    "type": "plugin",
    "affected_version": "* - 4.3.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49318",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.276",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.276",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "elfsight Contact Form widget \u003c= 2.3.1 - Unauthenticated Information Exposure",
    "slug": "elfsight-contact-form",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31045",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Email Subscribers by Icegram Express \u003c= 5.7.20 - Unauthenticated SQL Injection via hash",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.20",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4295",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP AutoKeyword \u003c= 1.0 - Unauthenticated SQL Injection",
    "slug": "wp-autokeyword",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31579",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Social Buttons \u003c= 2.1 - Admin+ Cross-Site Scripting",
    "slug": "wp-social-buttons",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0874",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "admin-css-mu",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "woosupply",
    "type": "plugin",
    "affected_version": "* - 1.2.2.",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2.",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "woovip",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "qards-free",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "confirm-data",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "wp-amo",
    "type": "plugin",
    "affected_version": "* - 4.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "theme-minifier",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "woovirtualwallet",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "phpfreechat",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "custom-login-admin-front-end-css-with-multisite-support",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "styles",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "wpopal-core-features",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "css-adder-by-agence-press",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CSSTidy - Server-Side Request Forgery",
    "slug": "amp-toolbox",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40700",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Product Labels For Woocommerce \u003c= 1.5.8 - Authenticated (Administrator+) SQL Injection",
    "slug": "aco-product-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53817",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \u003c= 1.27.8 - Authenticated (Contributor+) Path Traversal",
    "slug": "post-and-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.27.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52712",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "banner-manager \u003c= 16.04.19 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "banner-manager",
    "type": "plugin",
    "affected_version": "* - 16.04.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.04.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30565",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Exit Strategy \u003c= 1.55 - Information Exposure",
    "slug": "exit-strategy",
    "type": "plugin",
    "affected_version": "* - 1.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.55",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-10024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-10024",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Limit Login Attempts \u003c= 1.7.0 - Brute Force Bypass",
    "slug": "limit-login-attempts",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-10001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10001",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Piotnet Addons For Elementor Pro \u003c= 7.1.17 - Cross-Site Request Forgery",
    "slug": "piotnet-addons-for-elementor-pro",
    "type": "plugin",
    "affected_version": "* - 7.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33632",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Task Scheduler \u003c= 1.6.3 - Reflected Cross-Site Scripting",
    "slug": "task-scheduler",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Infographic Maker \u003c= 4.9.0 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "infographic-and-list-builder-ilist",
    "type": "plugin",
    "affected_version": "* - 4.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12415",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "SW Contact Form \u003c= 1.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "sw-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49612",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bird Feeder \u003c= 1.2.3 - Cross-Site Request Forgery",
    "slug": "bird-feeder",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11974",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bSecure \u0026#8211; Your Universal Checkout \u003c= 1.7.9 - Unauthenticated SQL Injection",
    "slug": "bsecure",
    "type": "plugin",
    "affected_version": "* - 1.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52830",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution",
    "slug": "copypress-rest-api",
    "type": "plugin",
    "affected_version": "1.1 - 1.2",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-8625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8625",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPListCal \u003c= 1.3.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wplistcal",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22535",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Media from FTP \u003c= 11.16 - Authenticated (Author+) Improper Privilege Management",
    "slug": "media-from-ftp",
    "type": "plugin",
    "affected_version": "* - 11.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4019",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "LinkedIn Lite \u003c= 1.0 - Unauthenticated Local File Inclusion",
    "slug": "linkedin-lite",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-23937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23937",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Fast Total Search \u003c= 1.79.262 - Missing Authorization",
    "slug": "fulltext-search",
    "type": "plugin",
    "affected_version": "* - 1.79.262",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.79.262",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30894",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Link Library \u003c= 7.5.13 - Cross-Site Request Forgery via action_admin_init",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.5.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24875",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Animate It \u003c= 2.3.5 - Cross-Site Request Forgery",
    "slug": "animate-it",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17386",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Multilingual \u0026 Multicurrency with WPML \u003c= 5.3.3.1 - Authenticated (Shop Manager+) SQL Injection",
    "slug": "woocommerce-multilingual",
    "type": "plugin",
    "affected_version": "* - 5.3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32602",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Donation Button \u003c= 4.0.0 - Missing Authorization",
    "slug": "donation-button",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4004",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Packlink PRO shipping module \u003c= 3.4.6 - Missing Authorization",
    "slug": "packlink-pro-shipping",
    "type": "plugin",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38740",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pretty file links \u003c= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pretty-file-links",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30551",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant Menu – Food Ordering System – Table Reservation \u003c= 2.3.0 - Missing Authorization on AJAX Actions",
    "slug": "menu-ordering-reservations",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2696",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "PostmarkApp Email Integrator \u003c= 2.4 - Missing Authorization",
    "slug": "postmarkapp-email-integrator",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31576",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "B Blocks \u003c= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function",
    "slug": "b-blocks",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-8059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8059",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hide My Site \u003c= 2.2 - Unauthenticated Information Exposure",
    "slug": "hide-my-site",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5880",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Edit Username \u003c= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-edit-username",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47528",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newspack Blocks \u003c= 3.0.8 - Authenticated (Contributor+) Arbitrary Directory Deletion",
    "slug": "newspack-blocks",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37423",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "LuckyWP Table of Contents \u003c= 2.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "luckywp-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9641",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Securimage-WP \u003c= 3.6.16 - Cross-Site Request Forgery",
    "slug": "securimage-wp",
    "type": "plugin",
    "affected_version": "* - 3.6.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35044",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors \u003c= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover",
    "slug": "publishpress-authors",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9215",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletters \u003c= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3107",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Themify Shortcodes \u003c= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themify-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39581",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.0.5 - Unauthenticated SQL Injection",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-4490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4490",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appsero Helper \u003c= 1.3.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "appsero-helper",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39377",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Business Directory Plugin \u003c= 6.3.9 - Missing Authorization via dispatch",
    "slug": "business-directory-plugin",
    "type": "plugin",
    "affected_version": "* - 6.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51516",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Admin UI Customize \u003c= 1.5.12 - Authenticated (Administrator+) Cross-Site Scripting",
    "slug": "wp-admin-ui-customize",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3824",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Food Store – Online Food Delivery \u0026 Pickup \u003c= 1.5.2 - Reflected Cross-Site Scripting",
    "slug": "food-store",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22314",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Forms for MailChimp \u003c= 6.8.7 - Reflected Cross-Site Scripting",
    "slug": "yikes-inc-easy-mailchimp-extender",
    "type": "plugin",
    "affected_version": "* - 6.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1324",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form and Calls To Action by vcita \u003c= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lead-capturing-call-to-actions-by-vcita",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11886",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncode Core \u003c= 2.8.8 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "uncode-core",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51500",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Timely All-in-One Events Calendar \u003c 1.6 - Cross-Site Scripting",
    "slug": "all-in-one-event-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-1835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-1835",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Newsletter \u003c= 8.0.6 - Cross-Site Request Forgery",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "* - 8.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31434",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CoziPress \u003c= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cozipress",
    "type": "theme",
    "affected_version": "* - 1.0.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38786",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Flow Plus \u003c= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wp-imageflow2",
    "type": "plugin",
    "affected_version": "* - 5.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58625",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime \u003c 3.2.0 - Reflected HTML Content Injection",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "[*, 3.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5238",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "hpb Dashboard \u003c= 1.3.1 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "hpbtool",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1542",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fast Custom Social Share by CodeBard \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "fast-custom-social-share-by-codebard",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34807",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 2.7.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2736",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Social Login \u003c= 2.8.2 - Cross-Site Request Forgery",
    "slug": "woo-social-login",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39472",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Leyka \u003c= 3.31.1 - Missing Authorization",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "* - 3.31.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.31.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35683",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.5.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2205",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kento Post View Counter \u003c= 2.8 - Stored Cross-Site Scripting",
    "slug": "kento-post-view-counter",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10981",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Google Maps \u003c= 1.11.7 - Cross-Site Request Forgery via AJAX action",
    "slug": "google-maps-easy",
    "type": "plugin",
    "affected_version": "* - 1.11.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2526",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Sprout Clients \u003c= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sprout-clients",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31797",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elite Video Player \u003c= 10.0.5 - Cross-Site Request Forgery",
    "slug": "elite-video-player",
    "type": "plugin",
    "affected_version": "* - 10.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30986",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP ERP \u003c= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.12.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0952",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEO Help \u003c= 6.6.1 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "seo-help",
    "type": "plugin",
    "affected_version": "* - 6.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32675",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rezdy Reloaded \u003c= 1.0.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "reloaded-rezdy",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23604",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow Gallery \u003c= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47376",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modal Portfolio \u003c= 1.7.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "modal-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13851",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ICS Calendar \u003c= 10.12.0.2 - Authenticated (Contributor+) Arbitrary File Read and Server-Side Request Forgery",
    "slug": "ics-calendar",
    "type": "plugin",
    "affected_version": "* - 10.12.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.12.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46784",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8978",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Groundhogg \u003c= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 2.7.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2715",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Video Playlist \u003c= 1.1.2 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "wp-video-playlist",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31581",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Cost Estimation \u0026 Payment Forms Builder \u003c= 10.1.75 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-estimation-form",
    "type": "plugin",
    "affected_version": "* - 10.1.75",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1.75",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30489",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Content Blocks (Custom Post Widget) \u003c= 3.3.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode",
    "slug": "custom-post-widget",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3564",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Internal Link Juicer \u003c= 2.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "internal-links",
    "type": "plugin",
    "affected_version": "* - 2.23.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.23.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0657",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Listamester \u003c= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "listamester",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13659",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.3.2 - Stored Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1208",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.6.33 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5530",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via media-playlists",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.4",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9032",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via media-playlists",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.2",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9032",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via media-playlists",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9032",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via media-playlists",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9032",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via media-playlists",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.4",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9032",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit Form – Contact Form Plugin \u003c= 2.13.10 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.13.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-47301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47301",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Database Backup – Unlimited Database \u0026 Files Backup by Backup for WP \u003c= 7.3 - Unauthenticated Database Back-Up Exposure",
    "slug": "wp-database-backup",
    "type": "plugin",
    "affected_version": "* - 7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12330",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "LIQUID BLOCKS \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "liquid-blocks",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52357",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-OliveCart \u003c= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-olivecart",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47435",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bricksable for Bricks Builder \u003c= 1.6.59 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bricksable",
    "type": "plugin",
    "affected_version": "* - 1.6.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51663",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin and Site Enhancements (ASE) \u003c= 7.6.9 - Password Protection Bypass",
    "slug": "admin-site-enhancements",
    "type": "plugin",
    "affected_version": "* - 7.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13688",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Duplicator \u003c= 1.5.9 - Full Path Disclosure",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6210",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ArtPlacer Widget \u003c= 2.21.1 - Missing Authorization to Widget Deletion",
    "slug": "artplacer-widget",
    "type": "plugin",
    "affected_version": "* - 2.21.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.21.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7268",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "GoZen Forms \u003c= 1.1.5 - Unauthenticated SQL Injection via emdedSc()",
    "slug": "gozen-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6783",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Typer Core \u003c= 1.9.6 - Authenticated (Contributor+) Post Disclosure",
    "slug": "typer-core",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12102",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BTEV \u003c= Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "bluetrait-event-viewer",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10677",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 3.8.2 - Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 3.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-6242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6242",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Rich Text Editor \u003c= 1.0.1 - Missing Authorization",
    "slug": "richtexteditor",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31736",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Motors - Events \u003c= 1.4.7 - Unauthenticated Local File Inclusion",
    "slug": "stm-motors-events",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47586",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ElementsKit Pro \u003c= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter",
    "slug": "elementskit",
    "type": "plugin",
    "affected_version": "* - 3.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0321",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Optimizer by 10web \u003c= 1.0.26 - Authenticated(Administator+) Directory Traversal",
    "slug": "image-optimizer-wd",
    "type": "plugin",
    "affected_version": "* - 1.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.26",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-2117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2117",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Landing Pages \u003c= 1.8.4 - Authenticated SQL Injection",
    "slug": "landing-pages",
    "type": "plugin",
    "affected_version": "[*, 1.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-4064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4064",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PilotPress \u003c= 2.0.30 - Authenticated(Subscriber+) Missing Authorization via multiple AJAX functions",
    "slug": "pilotpress",
    "type": "plugin",
    "affected_version": "* - 2.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23524",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
  },
  {
    "title": "Conversios \u003c= 7.0.7 - Authenticated (Subscriber+) SQL Injection via ee_syncProductCategory",
    "slug": "enhanced-e-commerce-for-woocommerce-store",
    "type": "plugin",
    "affected_version": "* - 7.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0786",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "async \u003c= 2.6.3 and 3-3.2.2 - Prototype Pollution",
    "slug": "insert-special-characters",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-43138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-43138",
    "auth_type": "Unauth",
    "cvss_score": 7.8,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c 3.2.5 - SQL Injection",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "[*, 3.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9330",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mikiurl Wordpress Eklentisi \u003c= 2.0 - Cross-Site Scripting",
    "slug": "mikiurl-wordpress-eklentisi",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9337",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coupon Referral Program \u003c= 1.8.3 - Sensitive Information Disclosure",
    "slug": "coupon-referral-program",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52190",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PlayerJS \u003c= 2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "playerjs",
    "type": "plugin",
    "affected_version": "* - 2.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27330",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kognetiks Chatbot for WordPress \u003c= 1.9.9 - Unauthenticated Arbitrary File Upload via chatbot_chatgpt_upload_file_to_assistant Function",
    "slug": "chatbot-chatgpt",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4560",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Task Scheduler \u003c= 1.6.3 - Authenticated (Admin+) Blind Server-Side Request Forgery",
    "slug": "task-scheduler",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10056",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directorist \u003c= 7.4.3 - Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3961",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple SEO \u003c= 2.0.25 - Cross-Site Request Forgery via multiple admin_post functions",
    "slug": "cds-simple-seo",
    "type": "plugin",
    "affected_version": "* - 2.0.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45269",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Backup Database \u003c= 4.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "backup-database",
    "type": "plugin",
    "affected_version": "* - 4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8702",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Service Finder Bookings \u003c= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'",
    "slug": "sf-booking",
    "type": "plugin",
    "affected_version": "* - 5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2470",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Element Pack Pro \u003c= 7.19.2 - Authenticated (Contributor+) Arbitrary File Read and PHAR Deserialization",
    "slug": "bdthemes-element-pack",
    "type": "plugin",
    "affected_version": "* - 7.19.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.19.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33568",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "RestroPress \u003c= 3.1.9.1 - Missing Authorization",
    "slug": "restropress",
    "type": "plugin",
    "affected_version": "* - 3.1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31877",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.31",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.29",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.28",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.3",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.4",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.25",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.21",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.11",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.20",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.15",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.12",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.31",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.28",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.19",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.16",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.3.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.7",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20042",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Settings \u003c= 3.0.1 - Cross-Site Request Forgery",
    "slug": "advanced-settings",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49865",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JupiterX Core \u003c= 3.3.5 - Unauthenticated Arbitrary File Upload",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-38388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38388",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HD Quiz \u003c= 1.8.3 - Stored Cross-Site Scripting",
    "slug": "hd-quiz",
    "type": "plugin",
    "affected_version": "[*, 1.8.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24571",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sign-up Sheets \u003c= 2.3.2 - Unauthenticated PHP Object Injection",
    "slug": "sign-up-sheets",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49393",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz Maker \u003c= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.5.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1079",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP AutoComplete Search \u003c= 1.0.4 - Unauthenticated SQL Injection",
    "slug": "wp-autosearch",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4297",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Push Notification for Post and BuddyPress \u003c= 2.11 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "push-notification-for-post-and-buddypress",
    "type": "plugin",
    "affected_version": "* - 2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23771",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Awesome Support – WordPress HelpDesk \u0026 Support Plugin \u003c= 6.3.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13567",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7369",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CP Contact Form with Paypal \u003c= 1.3.34 - Authenticated Feedback Submission",
    "slug": "cp-contact-form-with-paypal",
    "type": "plugin",
    "affected_version": "* - 1.3.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27460",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wbcom Designs – BuddyPress Group Reviews \u003c= 2.8.3 - Unauthorized AJAX Actions due to Nonce Bypass",
    "slug": "review-buddypress-groups",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2108",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.29 - Unauthenticated Limited File Read",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11738",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Wordapp \u003c= 1.6.0 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature",
    "slug": "wordapp",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2987",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers \u003c= 2.1.3 - Unauthenticated SQL Injection via 'id'",
    "slug": "popup-builder-block",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10862",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Pre-Orders \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woocommerce-pre-orders",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32793",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social comments by WpDevArt \u003c= 2.4.9 - Admin+ Stored Cross-Site Scripting",
    "slug": "comments-from-facebook",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0876",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy EU Value Added (VAT) Taxes \u003c 1.2.0 - Reflected Cross-Site Scripting",
    "slug": "exchange-addon-easy-eu-vat-taxes",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9368",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinyin Slugs \u003c= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "so-pinyin-slugs",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47511",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BSK PDF Manager \u003c= 3.1.1 - Admin+ SQL Injection",
    "slug": "bsk-pdf-manager",
    "type": "plugin",
    "affected_version": "[*, 3.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24860",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.1.2 - Incorrect Authorization for Contributor-level users",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-1762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-1762",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HT Contact Form Widget For Elementor Page Builder \u0026 Gutenberg Blocks \u0026 Form Builder. \u003c= 2.2.1 - Directory Traversal to Arbitrary File Move",
    "slug": "ht-contactform",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7360",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Pull This \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pull-this",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51838",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Table \u003c= 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "easy-table",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-20108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20108",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Edit Username \u003c= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "wp-edit-username",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47527",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Church Center \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "wp-church-center",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25157",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VigilanTor \u003c= 1.3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "vigilantor",
    "type": "plugin",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28695",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Plugin by FluentForm \u003c= 4.3.12 - CSV Injection",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 4.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3463",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Essential Addons for Elementor Lite \u003c= 5.0.8 - Reflected Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0683",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dtracker \u003c= 1.5 - Missing Authorization",
    "slug": "dtracker",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1002006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002006",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "SimplyRETS Real Estate IDX \u003c= 3.0.3 - Cross-Site Request Forgery",
    "slug": "simply-rets",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31010",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gameplan \u003c= 1.5.10 - Reflected Cross-Site Scripting",
    "slug": "gameplan",
    "type": "theme",
    "affected_version": "* - 1.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52418",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Invoices \u0026 Packing Slips for WooCommerce \u003c= 3.8.0 - Unauthenticated Server-Side Request Forgery",
    "slug": "woocommerce-pdf-invoices-packing-slips",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3047",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] \u003c= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "faq-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5704",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy PayPal Gift Certificate \u003c= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wpppgc_plugin_options",
    "slug": "paypal-gift-certificate",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9592",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library",
    "slug": "awesome-wp-image-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library",
    "slug": "wp-video-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library",
    "slug": "awesome-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library",
    "slug": "easy-image-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library",
    "slug": "woo-3d-viewer",
    "type": "plugin",
    "affected_version": "* - 1.8.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Snippets \u003c= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "post-snippets",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-25010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25010",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "weForms \u003c= 1.6.13 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "weforms",
    "type": "plugin",
    "affected_version": "* - 1.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2395",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 3.0.12 - Open Redirect",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 3.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-16174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16174",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sticky Radio Player \u003c= 3.4 - Reflected Cross-Site Scripting",
    "slug": "lbg-audio5-html5-shoutcast_sticky",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31426",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JNews - WordPress Newspaper Magazine Blog AMP Theme \u003c= 11.6.6 - Unauthorized User Registration",
    "slug": "jnews",
    "type": "theme",
    "affected_version": "* - 11.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8682",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page/Post Specific Social Share Buttons \u003c= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "pagepost-specific-social-share-buttons",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26580",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Location Picker at Checkout for WooCommerce \u003c= 1.8.9 - Missing Authorization via checkout_map_rules_order_ajax_handler",
    "slug": "map-location-picker-at-checkout-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Site Reviews \u003c= 7.2.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "* - 7.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1232",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Embedder \u003c= 4.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-embedder",
    "type": "plugin",
    "affected_version": "* - 4.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29141",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gtbabel \u003c= 6.6.8  - Unauthenticated Cookie Stealing",
    "slug": "gtbabel",
    "type": "plugin",
    "affected_version": "* - 6.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11638",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WD Instagram Feed Premium \u003c= 1.3.0 - Cross-Site Scripting",
    "slug": "wordpress-instagram-feed",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10301",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Portfolio Features for Phlox theme \u003c= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ' Grid Portfolios'",
    "slug": "auxin-portfolio",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3587",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mapplic Lite and Mapplic \u003c= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting",
    "slug": "mapplic-lite",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-10018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10018",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Mapplic Lite and Mapplic \u003c= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting",
    "slug": "mapplic",
    "type": "plugin",
    "affected_version": "[*, 6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-10018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10018",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Ticketmeo – Sell Tickets – Event Ticketing \u003c= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ploxel",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0507",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47488",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Album and Image Gallery with Lightbox – Flagallery Photo Portfolio \u003c 4.25 - Sensitive Data Exposure",
    "slug": "flash-album-gallery",
    "type": "plugin",
    "affected_version": "[*, 4.25)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.25",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-8491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8491",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Booking Package \u003c= 1.5.98 - Authorization Bypass to Arbitrary Password Reset",
    "slug": "booking-package",
    "type": "plugin",
    "affected_version": "[*, 1.5.99)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.99",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-37389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37389",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Integration for Contact Form 7 and Zoho CRM, Bigin \u003c= 1.2.2 - Cross-Site Request Forgery via settings_page function",
    "slug": "cf7-zoho",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25976",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TH Advance Product Search \u003c= 1.1.4 - Missing Authorization to Plugin Settings Reset",
    "slug": "th-advance-product-search",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38057",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcode Factory \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "shortcode-factory",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9321",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ClickWhale \u003c= 2.5.0 - Authenticated (Admin+) SQL injection",
    "slug": "clickwhale",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10002",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP ERP \u003c= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6666",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Feather Login Page 1.0.7 - 1.1.1 - Missing Authorization to Non-Arbitrary User Deletion",
    "slug": "feather-login-page",
    "type": "plugin",
    "affected_version": "1.0.7 - 1.1.1",
    "from_version": "1.0.7",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2547",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "DN Shipping by Weight for WooCommerce \u003c= 1.1.1 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "dn-shipping-by-weight",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11842",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Featured Image from URL (FIFU) \u003c= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields",
    "slug": "featured-image-from-url",
    "type": "plugin",
    "affected_version": "* - 5.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7400",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Activity Log Premium \u003c= 4.6.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-security-audit-log-premium",
    "type": "plugin",
    "affected_version": "* - 4.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2018",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Car Seller - Auto Classifieds Script \u003c= 2.1.0 - Unauthenticated SQL Injection",
    "slug": "cars-seller-auto-classifieds-script",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24285",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Jump Menu \u003c= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-jump-menu",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44479",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smash Balloon Social Post Feed \u003c= 4.2.1 - Cross-Site Request Forgery",
    "slug": "custom-facebook-feed",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31379",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stream \u003c= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "stream",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13879",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soundy Audio Playlist \u003c= 4.6 - Cross-Site Scripting",
    "slug": "soundy-audio-playlist",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-6001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6001",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Memberpress \u003c 1.12.0 - Reflected Cross-Site Scripting",
    "slug": "memberpress",
    "type": "plugin",
    "affected_version": "[*, 1.12.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-39407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39407",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uji Popup \u003c= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via uji_popup_code shortcode",
    "slug": "uji-popup",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23641",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Favorites \u003c= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "favorites",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2948",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mortgage Calculators WP \u003c 1.53 - Authenticated Stored Cross-Site Scripting",
    "slug": "mortgage-calculators-wp",
    "type": "plugin",
    "affected_version": "[*, 1.53)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.53",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24904",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode Addons \u003c= 3.2.5 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "shortcode-addons",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31114",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Sailthru Triggermail \u003c= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "sailthru-triggermail",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4290",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Full Width Banner Slider Wp \u003c= 1.1.7 - Reflected Cross-Site Scripting via search_term",
    "slug": "full-width-responsive-slider-wp",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24392",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CP Contact Form with PayPal \u003c= 1.3.01 - Cross-Site Scripting",
    "slug": "cp-contact-form-with-paypal",
    "type": "plugin",
    "affected_version": "[*, 1.3.02)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.02",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-14785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14785",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmbedPress \u003c= 3.9.1 - Reflected Cross-Site Scripting",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5750",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Pro \u003c= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ekit_btn_id'",
    "slug": "elementskit",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3598",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "E-namad \u0026amp; Shamed Logo Manager \u003c= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "e-namad-shamed-logo-manager",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57998",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Tables – Easiest Data Table Builder \u003c= 5.0.9 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "ninja-tables",
    "type": "plugin",
    "affected_version": "* - 5.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35635",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-Images.ai – IA Image Bank and Custom Image creation \u003c= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "all-images-ai",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13714",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Tools \u003c= 3.41 - Missing Authorization leading to Authenticated (Subscriber+) Authorization Bypass",
    "slug": "wptools",
    "type": "plugin",
    "affected_version": "* - 3.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.41",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43453",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Category Ajax Filter \u003c= 2.8.2 - Unauthenticated Local File Inclusion",
    "slug": "category-ajax-filter",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10871",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.94 - Unauthenticated Limited File Upload",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.94",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1567",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
  },
  {
    "title": "WP Responsive Tabs horizontal vertical and accordion Tabs \u003c= 1.1.17 - Authenticated (Contributor+) SQL Injection",
    "slug": "responsive-horizontal-vertical-and-accordion-tabs",
    "type": "plugin",
    "affected_version": "* - 1.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.17",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30497",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Spam protection, AntiSpam, FireWall by CleanTalk \u003c= 6.10 - Missing Authorization",
    "slug": "cleantalk-spam-protect",
    "type": "plugin",
    "affected_version": "* - 6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33996",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widget",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10266",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_meta",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0511",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Content Shortcode \u003c= 3.8.8 - Unauthorised Arbitrary Post Metadata Access",
    "slug": "custom-content-shortcode",
    "type": "plugin",
    "affected_version": "* - 3.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24824",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Coming Soon \u003c 1.1.19 - Stored Cross-Site Scripting",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "[*, 1.1.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5659",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infusionsoft Gravity Forms Add-on \u003c= 1.5.11 - Reflected Cross-Site Scripting",
    "slug": "infusionsoft",
    "type": "plugin",
    "affected_version": "[*, 1.5.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-1000139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000139",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flower Delivery by Florist One \u003c= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "flower-delivery-by-florist-one",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11769",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.3 - Missing Authorization in 'listPostsCategory'",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1026",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy WP SMTP \u003c= 1.5.1 - Authenticated (Admin+) Remote Code Execution",
    "slug": "easy-wp-smtp",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-42699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42699",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Seven Stars \u003c= 1.4.4 - Reflected Cross-Site Scripting",
    "slug": "sevenstars",
    "type": "theme",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31067",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elegant Custom Fonts \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "elegant-custom-fonts",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27436",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Float menu \u003c= 6.1.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "float-menu",
    "type": "plugin",
    "affected_version": "* - 6.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30912",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AnalyticsWP \u003c= 2.1.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "analyticswp",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39394",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Office Locator \u003c= 1.3.0 - Unauthenticated SQL Injection",
    "slug": "office-locator",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32665",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.1.10 - Unauthenticated SQL Injection",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-25700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25700",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "tarteaucitron.js – Cookies legislation \u0026 GDPR (WordPress plugin) \u003c= 1.6 - Cross-Site Scripting",
    "slug": "tarteaucitronjs",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2021-36889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36889",
    "auth_type": "Privileged",
    "cvss_score": 3.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Tab Ultimate \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "tabs-pro",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5667",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YourChannel \u003c= 1.2.4 - Cross-Site Request Forgery to Plugin Settings Change",
    "slug": "yourchannel",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1867",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Login rebuilder \u003c= 2.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "login-rebuilder",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2223",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download IP2Location Country Blocker \u003c= 2.38.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ip2location-country-blocker",
    "type": "plugin",
    "affected_version": "* - 2.38.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.38.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24731",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accordions – Multiple Accordions or FAQs Builder \u003c= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'notice' parameter",
    "slug": "accordions-or-faqs",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45082",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Trending/Popular Post Slider and Widget \u003c= 1.5.7 - Cross-Site Request Forgery via wtpsw_post_view_count",
    "slug": "wp-trending-post-slider-and-widget",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46846",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Frontend Dashboard \u003c= 2.2.4 - Authenticated (Subscriber+) Arbitrary Function Call",
    "slug": "frontend-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8268",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CBX Bookmark \u0026 Favorite \u003c= 1.7.20 - Authenticated (Administrator+) SQL Injection",
    "slug": "cbxwpbookmark",
    "type": "plugin",
    "affected_version": "* - 1.7.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.20",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32132",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.15",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.14",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.6",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.17",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.14",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.11",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.7",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.5",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.2",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.1",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.17",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetEngine \u003c= 3.7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-engine",
    "type": "plugin",
    "affected_version": "* - 3.7.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54688",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Notifications Center \u003c= 1.5.2 - Reflected Cross-Site Scripting",
    "slug": "notifications-center",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23741",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WoodMart \u003c= 7.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 7.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32239",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mapster WP Maps \u003c= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mapster-wp-maps",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10592",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post By Email \u003c= 1.0.4b - Unauthenticated Arbitrary File Upload via Email Attachments",
    "slug": "post-by-email",
    "type": "plugin",
    "affected_version": "* - 1.0.4b",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4b",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-9762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9762",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Opentracker Analytics \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "opentracker-analytics",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22361",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Directory Plugin \u003c= 6.4.3 - Authenticated (Author+) CSV Injection",
    "slug": "business-directory-plugin",
    "type": "plugin",
    "affected_version": "* - 6.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5527",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Pie Register – User Registration Forms \u003c 2.0.19 - Authenticated SQL Injection",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "[*, 2.0.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-7682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7682",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "BuddyPress Builder for Elementor – BuddyBuilder \u003c= 1.7.4 - Authenticated (Contributor+) Post Disclosure",
    "slug": "stax-buddy-builder",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10778",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "EmbedPress \u003c= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4282",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.59 - Insufficient Access Control to Template Import",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4704",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "flashy \u003c= 1.3 - Cross-Site Scripting",
    "slug": "flashy",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-0901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-0901",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WP Statistics \u003c= 13.1.5 - Unauthenticated Blind SQL Injection via IP",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 13.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-25149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25149",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Friends \u003c= 3.2.1 - Missing Authorization",
    "slug": "friends",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12028",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Support Plus Responsive Ticket System \u003c= 4.1 - Directory Traversal",
    "slug": "wp-support-plus-responsive-ticket-system",
    "type": "plugin",
    "affected_version": "[*, 4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-10390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10390",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Etsy Importer \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "etsy-importer",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder \u003c= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.13.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4671",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Debug Meta Data \u003c= 1.1.2 - Stored Cross-Site Scripting",
    "slug": "debug-meta-data",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-27356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-27356",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 5.7.49 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.49",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0671",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteNarrator Text-to-Speech Widget \u003c= 1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sitespeaker-widget",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57951",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modern Footnotes \u003c= 1.4.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "modern-footnotes",
    "type": "plugin",
    "affected_version": "* - 1.4.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50049",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Create custom forms for WordPress with a smart form plugin for smart businesses \u003c= 1.2.4 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "abcsubmit",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2801",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Attire \u003c= 2.0.6 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "attire",
    "type": "theme",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7435",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Stripe Donation and Payment Plugin \u003c= 3.2.3 - Missing Authorization",
    "slug": "wp-stripe-donation",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50459",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShopLentor – WooCommerce Builder for Elementor \u0026 Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \u003c= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2946",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DSGVO All in one for WP \u003c= 4.3 - Cross-Site Request Forgery",
    "slug": "dsgvo-all-in-one-for-wp",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27967",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ajax Archive Calendar \u003c= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ajax-archive-calendar",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46069",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 6.4.5 - Reflected Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48326",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Verse-O-Matic \u003c= 4.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "verse-o-matic",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24466",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Read and Understood \u003c 2.2 - Cross-Site Request Forgery",
    "slug": "read-and-understood",
    "type": "plugin",
    "affected_version": "[*, 2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-5669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5669",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Accessibility \u003c= 1.0.6 - Cross-Site Request Forgery",
    "slug": "accessibility",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24705",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ULeak Security \u0026 Monitoring Plugin \u003c= 1.2.3 - Stored Cross-Site Scripting",
    "slug": "uleak-security-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1557",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-in-One Addons for Elementor - WidgetKit \u003c= 2.3.9 - Contributor+ Stored Cross-Site Scripting",
    "slug": "widgetkit-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 2.3.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24267",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Docs \u003c= 2.1.3 - Reflected Cross-Site Scripting",
    "slug": "wp-docs",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35696",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UserHeat Plugin \u003c= 1.1.10 - Cross-Site Request Forgery",
    "slug": "userheat",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47553",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ParityPress \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "paritypress",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6661",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery \u003c= 2.1.15 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9229",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobmonster \u003c= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "noo-jobmonster",
    "type": "theme",
    "affected_version": "* - 4.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57887",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Contacts Manager \u003c= 2.2.4 - Unauthenticated SQL Injection",
    "slug": "wp-contacts-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1014",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Magazine Blocks \u003c= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magazine-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebToffee WP Backup and Migration \u003c= 1.5.3 - Unauthenticated Sensitive Information Exposure",
    "slug": "wp-migration-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24651",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FLX Dashboard Groups \u003c= 0.0.7 - Reflected Cross-Site Scripting",
    "slug": "flx-dashboard-groups",
    "type": "plugin",
    "affected_version": "* - 0.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23730",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Change Cart button Colors WooCommerce \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "wc-style",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52783",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Login Box \u003c= 2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-login-box",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0544",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Tweet Embed \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-tweet-embed",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23890",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WeedMaps Menu for WordPress \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via weedmaps_menu Shortcode",
    "slug": "weedmaps-menu-embed",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8623",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Entries \u003c= 1.2.9 - CSV Injection",
    "slug": "contact-form-entries",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3604",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletter Lite \u003c= 4.9.2 - Authenticated (Admin+) Command Injection",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4797",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AIcomments \u003c= 1.4.1 - Cross-Site Request Forgery",
    "slug": "aicomments",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54307",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Single Post Exporter \u003c= 1.1.1 - Cross-Site Request Forgery",
    "slug": "single-post-exporter",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24780",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Job Board Manager \u003c= 2.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "job-board-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60162",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Affiliate Links \u003c= 6.3 - Cross-Site Request Forgery via aalDeleteLink function",
    "slug": "wp-auto-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22689",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Login with phone number \u003c= 1.7.35 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "* - 1.7.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37429",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lenxel Core for Lenxel(LNX) LMS \u003c= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "lenxel-core",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9270",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BlockStrap Page Builder - Bootstrap Blocks \u003c= 0.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blockstrap-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 0.1.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30951",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jupiter X Core \u003c= 4.6.6 - Unauthenticated Arbitrary File Download",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 4.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3813",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP-Strava \u003c= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-strava",
    "type": "plugin",
    "affected_version": "* - 2.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10038",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jigoshop – Store Toolkit \u003c= 1.4.0 - Reflected Cross-Site Scripting",
    "slug": "jigoshop-store-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51712",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Blocks – WordPress Gutenberg Blocks \u003c= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-block-editor-addons",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12268",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.46.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.46.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3243",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Download Media Counter \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-download-media-counter",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58867",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Pricing Table WP \u003c= 1.1.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "easy-pricing-table-wp",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53450",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Realteo - Real Estate Plugin by Purethemes \u003c= 1.2.8 - Authentication Bypass via 'do_register_user'",
    "slug": "realteo",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2232",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LatePoint \u003c= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 5.1.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.94",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7038",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "Advanced Page Visit Counter \u003c= 8.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "advanced-page-visit-counter",
    "type": "plugin",
    "affected_version": "* - 8.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5529",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Saoshyant Page Builder \u003c= 3.8 - Missing Authorization",
    "slug": "saoshyant-page-builder",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22560",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cookie Notice \u0026 Consent Banner for GDPR \u0026 CCPA Compliance \u003c= 1.7.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "cookie-notice-and-consent-banner",
    "type": "plugin",
    "affected_version": "[*, 1.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24590",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Raise The Money \u003c= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "raise-the-money",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53321",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MJM Clinic \u003c= 1.1.22 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "mjm-clinic",
    "type": "plugin",
    "affected_version": "* - 1.1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29096",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OpenSheetMusicDisplay \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter",
    "slug": "opensheetmusicdisplay",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5235",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Google Maps \u003c= 1.11.18 - Authenticated (Author+) XML Entity Injection",
    "slug": "google-maps-easy",
    "type": "plugin",
    "affected_version": "* - 1.11.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32138",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "10Web Booster \u003c= 2.24.14 - Unauthenticated Arbitrary Option Deletion",
    "slug": "tenweb-speed-optimizer",
    "type": "plugin",
    "affected_version": "* - 2.24.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.24.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5559",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Freeio \u003c= 1.2.21 - Unauthenticated Privilege Escalation",
    "slug": "wp-freeio",
    "type": "plugin",
    "affected_version": "* - 1.2.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.21",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-11533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11533",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Geotagged Media \u003c= 0.3.0 - Reflected Cross-Site Scripting",
    "slug": "geotagged-media",
    "type": "plugin",
    "affected_version": "* - 0.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51694",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail Picker \u003c= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mail-picker",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53772",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar and Booking Calendar Pro \u003c= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "* - 3.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12077",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar and Booking Calendar Pro \u003c= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'",
    "slug": "booking-calendar-pro",
    "type": "plugin",
    "affected_version": "* - 11.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12077",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetThemeCore for Elementor \u003c= 2.2.0 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "jet-theme-core",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37497",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Commenter Emails \u003c= 2.6.1 - Unauthenticated CSV Injection",
    "slug": "commenter-emails",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45360",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Robots.txt optimization \u003c= 1.4.5 - Cross Site Request Forgery",
    "slug": "better-robots-txt",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25706",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Homepage Product Organizer for WooCommerce \u003c= 1.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "homepage-product-organizer-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-30998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-30998",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Paid Memberships Pro \u003c 2.3.3 - Authenticated SQL Injection",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "[*, 2.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-5579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5579",
    "auth_type": "Privileged",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Virtual Bot \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "virtual-bot",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22538",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Altair \u003c= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current",
    "slug": "altair",
    "type": "theme",
    "affected_version": "* - 5.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12922",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Clone any post type \u003c= 3.5 - Missing Authorization",
    "slug": "wp-clone-any-post-type",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31872",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cooked Pro \u003c 1.8.0 - Cross-Site Request Forgery",
    "slug": "cooked-pro",
    "type": "plugin",
    "affected_version": "[*, 1.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-49290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49290",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Loops \u0026 Logic \u003c= 4.1.4 - Reflected Cross-Site Scripting",
    "slug": "tangible-loops-and-logic",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47333",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LocalGrid \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "localgrid",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23678",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeoDirectory \u003c= 2.3.80 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.3.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.80",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50437",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coupon \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "coupon-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56235",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login with phone number \u003c= 1.6.93 - Missing Authorization",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "* - 1.6.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32832",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fami Sales Popup \u003c= 2.0.0 - Unauthenticated Local File Inclusion",
    "slug": "fami-sales-popup",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-25141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25141",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bold Page Builder \u003c= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via \"Price List\" Element",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 4.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2735",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Offsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function",
    "slug": "offsprout-page-builder",
    "type": "plugin",
    "affected_version": "2.2.1 - 2.15.2",
    "from_version": "2.2.1",
    "from_inclusive": true,
    "to_version": "2.15.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4672",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HUSKY – Products Filter for WooCommerce (formerly WOOF) \u003c= 1.3.5.2 - Authenticated (Subscriber+) Remote Code Execution",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32680",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "MIMO Woocommerce Order Tracking \u003c= 1.0.2 - Missing Authorization to Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mimo-woocommerce-order-tracking",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5768",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress User Extra Fields \u003c= 16.6 - Unauthenticated Arbitrary File Deletion",
    "slug": "wp-user-extra-fields",
    "type": "plugin",
    "affected_version": "* - 16.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11150",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Search Everything \u003c= 8.1.6 - SQL Injection",
    "slug": "search-everything",
    "type": "plugin",
    "affected_version": "* - 8.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-18571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18571",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NetInsight Analytics Implementation Plugin \u003c= 1.0.3 - Cross-Site Request Forgery",
    "slug": "netinsight-analytics-implementation-plugin",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52765",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pardakht Delkhah \u003c= 2.9.8 - Cross-Site Request Forgery to Form Setting Reset",
    "slug": "pardakht-delkhah",
    "type": "plugin",
    "affected_version": "* - 2.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6230",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Job Board \u003c= 2.4.4 - Reflected Cross-Site Scripting",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "[*, 2.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18498",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Front-end Editor \u003c 2.3 - Arbitrary File Upload",
    "slug": "front-end-editor",
    "type": "plugin",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-10019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10019",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FULL - Customer \u003c= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation",
    "slug": "full-customer",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4243",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Master Slider Pro \u003c= 3.6.5 - Reflected Cross-Site Scripting",
    "slug": "masterslider",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47508",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BSK Forms Blacklist \u003c= 3.9 - Cross-Site Request Forgery",
    "slug": "bsk-gravityforms-blacklist",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22347",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "ProfilePress \u003c= 4.3.2 - Authenticated (Admin+) PHP Object Injection",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45083",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Food Menu – Restaurant Menu \u0026 Online Ordering for WooCommerce \u003c= 5.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "tlp-food-menu",
    "type": "plugin",
    "affected_version": "* - 5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13415",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce – Product Importer  \u003c= 1.5.2 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-product-importer",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1546",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Proofreading \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "proofreading",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45772",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GRÜN spendino Spendenformular \u003c= 1.0.1 - Unauthenticated Arbitrary Options Update",
    "slug": "spendino",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP 2FA \u003c= 2.2.1 - Time-Based TOTP attack to Sensitive Information Exposure",
    "slug": "wp-2fa",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2891",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "HTML5 MP3 Player with Folder Feedburner \u003c= 2.8.0 - Authenticated (Author+) PHP Object Injection",
    "slug": "html5-mp3-player-with-mp3-folder-feedburner-playlist",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-52202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52202",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fusion \u003c= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fusion",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31549",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freesoul Deactivate Plugins \u003c= 2.1.3 - Cross-Site Request Forgery via eos_dp_pro_delete_transient",
    "slug": "freesoul-deactivate-plugins",
    "type": "plugin",
    "affected_version": "[*, 2.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-46188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46188",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Compfight \u003c 1.5 - Cross-Site Scrpting",
    "slug": "compfight",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-8622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8622",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RapidExpCart \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "rapidexpcart",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0520",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orbisius Simple Notice \u003c= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "orbisius-simple-notice",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24634",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StaffList \u003c= 3.1.2 - Authenticated SQL Injection",
    "slug": "stafflist",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1556",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DrawIt (draw.io) \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "drawit",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47831",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register \u003c= 3.0.9 - SQL Injection",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-10969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10969",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RSVP ME \u003c= 1.9.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "rsvp-me",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23480",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Data Access \u003c= 5.5.7 - Cross-Site Request Forgery",
    "slug": "wp-data-access",
    "type": "plugin",
    "affected_version": "* - 5.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43295",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "My AskAI \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "my-askai",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10179",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Edge \u003c= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name",
    "slug": "edge",
    "type": "theme",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34376",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetEngine \u003c= 3.7.1 - Authenticated (Contributor+) Server-Side Template Injection to Remote Code Execution",
    "slug": "jet-engine",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53194",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ra_qrcode \u003c= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ra-qrcode",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52345",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 3.3.5.8 - Reflected Cross-Site Scripting",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 3.3.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-4768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4768",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Getwid – Gutenberg Blocks \u003c= 2.0.2 - Improper Input Validation to Arbitrary Email Sending to Admin",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6042",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Send Users Email \u003c= 1.5.1 - Unauthenticated Information Exposure",
    "slug": "send-users-email",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38760",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) \u003c= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure",
    "slug": "xc-woo-google-cloud-print",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1284",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Use Any Font \u003c= 6.3.08 - Cross-Site Request Forgery",
    "slug": "use-any-font",
    "type": "plugin",
    "affected_version": "* - 6.3.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47305",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hide Dashboard Notifications \u003c= 1.2.3 - Cross-Site Request Forgery",
    "slug": "wp-hide-backed-notices",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33683",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPMobile.App \u003c= 11.50 - Reflected Cross-Site Scripting",
    "slug": "wpappninja",
    "type": "plugin",
    "affected_version": "* - 11.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47349",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advance Menu Manager \u003c= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change",
    "slug": "advance-menu-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54381",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inline Image Upload for BBPress \u003c= 1.1.18 - Cross-Site Request Forgery via hm_bbpui_admin_page",
    "slug": "image-upload-for-bbpress",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51668",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooMS \u003c= 9.12 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wooms",
    "type": "plugin",
    "affected_version": "* - 9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57956",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sender by BestWebSoft \u003c= 1.2.0 - Reflected Cross-Site Scripting",
    "slug": "sender",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18564",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MaxCoach \u003c= 3.2.5 - Unauthenticated Local File Inclusion",
    "slug": "maxcoach",
    "type": "theme",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58206",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Abandoned Cart Lite for WooCommerce \u003c= 5.15.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "woocommerce-abandoned-cart",
    "type": "plugin",
    "affected_version": "* - 5.15.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.15.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44986",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks for Gutenberg \u003c= 4.4.9 - Missing Authorization",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30467",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Google Map \u003c= 1.8.0 - Missing Authorization",
    "slug": "gmap-embed",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-45729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-45729",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WPCHURCH \u003c= 2.7.0 - Unauthenticated Local File Inclusion",
    "slug": "church-management",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32304",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking \u003c= 1.3.14 - Cross-Site Request Forgery",
    "slug": "easync-booking",
    "type": "plugin",
    "affected_version": "* - 1.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9450",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zegen - Church WordPress Theme \u003c= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Theme Options Updates",
    "slug": "zegen",
    "type": "theme",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2289",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPvivid \u003c= 0.9.94 - Missing Authorization",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.94",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4637",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ResAds \u003c 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "resads",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-7667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7667",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HL Twitter \u003c= 2014.1.18 - Cross-Site Request Forgery to Settings Update",
    "slug": "hl-twitter",
    "type": "plugin",
    "affected_version": "* - 2014.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2014.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3629",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ocean Extra \u003c= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5531",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal \u003c= 16.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read",
    "slug": "wp-malware-removal",
    "type": "plugin",
    "affected_version": "* - 16.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7772",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Foliopress WYSIWYG \u003c 2.6.8.5 - Cross-Site Scripting",
    "slug": "foliopress-wysiwyg",
    "type": "plugin",
    "affected_version": "[*, 2.6.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-1232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-1232",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Envira Photo Gallery \u003c= 1.8.14 - Missing Authorization",
    "slug": "envira-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 1.8.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43925",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPCRM - CRM for Contact form CF7 \u0026 WooCommerce \u003c= 3.2.0 - Reflected Cross-Site Scripting",
    "slug": "wpcrm",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24774",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cryptocurrency Widgets Pack \u003c= 2.0 - Unauthenticated SQL Injection",
    "slug": "cryptocurrency-widgets-pack",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4059",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BuddyForms \u003c= 2.8.8 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32830",
    "auth_type": "Unauth",
    "cvss_score": 9.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Ali2Woo Lite \u003c= 3.4.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ali2woo-lite",
    "type": "plugin",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37213",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP_Identicon \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "wp-identicon",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31468",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FG Joomla to WordPress \u003c= 4.20.2 - Sensitive Information Exposure",
    "slug": "fg-joomla-to-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.20.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.20.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32788",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SEOPress \u003c= 8.1.1 - Missing Authorization",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 8.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50456",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ChatBot \u003c= 4.2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting and Settings Reset",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24415",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 3.2.4 - Unauthenticated PHP Object Injection",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8145",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zeno Font Resizer \u003c= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "zeno-font-resizer",
    "type": "plugin",
    "affected_version": "* - 1.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25442",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InstaWP Connect \u003c= 0.1.0.9 - Authenticated (Subscriber+) SQL Injection",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-23507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23507",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All-in-One WP Migration and Backup \u003c= 7.86 - Unauthenticated Information Disclosure via Error Logs",
    "slug": "all-in-one-wp-migration",
    "type": "plugin",
    "affected_version": "* - 7.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8852",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GamiPress \u003c= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 7.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13496",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ELEX WooCommerce Dynamic Pricing and Discounts \u003c= 2.1.7 - Missing Authorization",
    "slug": "elex-woocommerce-dynamic-pricing-and-discounts",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12266",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.4.34)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.34",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24163",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sponsors \u003c= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-sponsors",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5662",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30422",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder \u003c= 3.7.4 - Missing Authorization",
    "slug": "wp-post-author",
    "type": "plugin",
    "affected_version": "* - 3.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34389",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nomupay Payment Processing Gateway \u003c= 7.1.5 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "totalprocessing-card-payments",
    "type": "plugin",
    "affected_version": "* - 7.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32209",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "One Click Upsell Funnel for WooCommerce \u003c= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode",
    "slug": "woo-one-click-upsell-funnel",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11938",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Csomagpontok és szállítási címkék WooCommerce hez \u003c= 1.9.0.2 - Cross-Site Request Forgery",
    "slug": "hungarian-pickup-points-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41685",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GD Rating System \u003c= 2.3 - Directory Traversal",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-5289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5289",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Accordion Shortcodes \u003c= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "accordion-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4781",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Auction Plugin \u003c= 3.7 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-auctions",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8857",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Google Maps \u003c= 1.11.15 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "google-maps-easy",
    "type": "plugin",
    "affected_version": "* - 1.11.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5219",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks – Page Builder Gutenberg Blocks, Patterns \u0026 Templates \u003c= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1664",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebwinkelKeur \u003c= 3.24 - Cross-Site Request Forgery",
    "slug": "webwinkelkeur",
    "type": "plugin",
    "affected_version": "[*, 3.25)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-36691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36691",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Point Maker \u003c= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "point-maker",
    "type": "plugin",
    "affected_version": "* - 0.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12815",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TemplatesNext ToolKit \u003c= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "templatesnext-toolkit",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22712",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": ".TUBE Video Curator \u003c= 1.1.9 - Reflected Cross-Site Scripting",
    "slug": "tube-video-curator",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23799",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "W3SPEEDSTER \u003c= 7.26 - Authenticated (Administrator+) Remote Code Execution",
    "slug": "w3speedster-wp",
    "type": "plugin",
    "affected_version": "* - 7.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8512",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Post Connector \u003c= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "post-connector",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28931",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Compliance \u003c= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gdpr-cookie-compliance",
    "type": "plugin",
    "affected_version": "* - 4.15.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1622",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SVG Images \u003c= 3.3 - Authenticated (author+) Stored Cross-Site Scripting via SVG",
    "slug": "wp-svg-images",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24386",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – Daylight Edition \u003c= 2.2.7 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "ltl-freight-quotes-daylight-edition",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58643",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gutenberg Blocks – ACF Blocks Suite \u003c= 2.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "acf-blocks",
    "type": "plugin",
    "affected_version": "* - 2.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Timetable and Event Schedule by MotoPress \u003c= 2.3.19 - Arbitrary User's Hashed Password/Email/Username Disclosure",
    "slug": "mp-timetable",
    "type": "plugin",
    "affected_version": "* - 2.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24585",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Image Carousel Shortcode \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "image-carousel-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51842",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBakery Page Builder Clipboard \u003c 4.5.8 - Arbitrary License Options Update",
    "slug": "vc_clipboard",
    "type": "plugin",
    "affected_version": "[*, 4.5.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24244",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Configure SMTP \u003c= 3.1 - Reflected Cross-Site Scripting",
    "slug": "configure-smtp",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27192",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AJAX Random Posts \u003c= 0.3.3 - Unauthenticated PHP Object Injection",
    "slug": "ajax-random-posts",
    "type": "plugin",
    "affected_version": "* - 0.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52409",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Send PDF for Contact Form 7 \u003c= 1.0.2.3 - Missing Authorization",
    "slug": "send-pdf-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3585",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Flexible PDF Coupons \u003c= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "flexible-coupons",
    "type": "plugin",
    "affected_version": "* - 1.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22825",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ERP \u003c= 1.13.2 - Reflected Cross-Site Scripting",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47640",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons PRO \u003c= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Messenger Chat Widget",
    "slug": "premium-addons-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1997",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Helper Premium \u003c= 4.2.0 - Reflected Cross-Site Scripting",
    "slug": "wp-helper-lite",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0448",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clearfy Cache \u003c= 2.2.4 - Missing Authorization",
    "slug": "clearfy",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43260",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Vikinger \u003c= 1.9.30 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger_user_meta_update_ajax'",
    "slug": "vikinger",
    "type": "theme",
    "affected_version": "* - 1.9.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.30",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2238",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bulk NoIndex \u0026 NoFollow Toolkit \u003c= 2.15 - Reflected Cross-Site Scripting",
    "slug": "bulk-noindex-nofollow-toolkit-by-mad-fish",
    "type": "plugin",
    "affected_version": "* - 2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8803",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM Memberships \u003c= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "crm-memberships",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27427",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Most And Least Read Posts Widget \u003c= 2.5.18 - Cross-Site Request Forgery via most_and_least_read_posts_options",
    "slug": "most-and-least-read-posts-widget",
    "type": "plugin",
    "affected_version": "* - 2.5.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49628",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MM-Breaking News \u003c= 0.7.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mm-breaking-news",
    "type": "plugin",
    "affected_version": "* - 0.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8054",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder Pro \u003c= 3.10.0 - Cross-Site Request Forgery",
    "slug": "profile-builder-pro",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22140",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Horoscope And Tarot \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "horoscope-and-tarot",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11337",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Rocket \u003c= 2.10.3 - Local File Inclusion",
    "slug": "wp-rocket",
    "type": "plugin",
    "affected_version": "[*, 2.10.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-11658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-11658",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "App Builder – Create Native Android \u0026 iOS Apps On The Flight \u003c= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-search",
    "slug": "app-builder",
    "type": "plugin",
    "affected_version": "* - 4.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7651",
    "auth_type": "Unauth",
    "cvss_score": 5.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.1.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0084",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yumpu E-Paper publishing \u003c= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yumpu-epaper-publishing",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12621",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More \u003c= 2.7.2.1 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-exporter",
    "type": "plugin",
    "affected_version": "* - 2.7.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8793",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection \u003c= 11.58 - Insufficient Authorization to Unauthenticated Blocklist Bypass",
    "slug": "stopbadbots",
    "type": "plugin",
    "affected_version": "* - 11.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9376",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
  },
  {
    "title": "Google Analyticator \u003c= 6.5.5 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "google-analyticator",
    "type": "plugin",
    "affected_version": "* - 6.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3425",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Discussion Board \u003c= 2.4.8 - Authenticated (Subscriber+) Content Injection",
    "slug": "wp-discussion-board",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39161",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Ultimate Recipe \u003c 3.12.7 - Stored Cross-Site Scripting",
    "slug": "wp-ultimate-recipe",
    "type": "plugin",
    "affected_version": "[*, 3.12.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15836",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integration for Contact Form 7 and Constant Contact \u003c= 1.1.5 - Cross-Site Request Forgery",
    "slug": "cf7-constant-contact",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35632",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SEO Plugin by Squirrly SEO \u003c= 12.4.03 - Authenticated (Contributor+) SQL Injection",
    "slug": "squirrly-seo",
    "type": "plugin",
    "affected_version": "* - 12.4.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.4.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22783",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Radio – Worldwide Online Radio Stations Directory for WordPress \u003c= 3.1.9 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Settings",
    "slug": "wp-radio",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1041",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Generator \u003c= 1.6.4 - Cross-Site Scripting",
    "slug": "page-generator",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2100",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "fMoblog \u003c= 2.1 - SQL Injection",
    "slug": "fmoblog",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2009-0968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-0968",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Activity Log – Monitor \u0026 Record User Changes \u003c= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context",
    "slug": "aryo-activity-log",
    "type": "plugin",
    "affected_version": "* - 2.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10788",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 5.4.8 - Reflected Cross-Site Scripting in Product XML Feeds Module",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "[*, 5.4.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25001",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DMSGuestbook \u003c= 1.8.0 - Directory Traversal",
    "slug": "dmsguestbook",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-0615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0615",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Wheel of Life: Coaching and Assessment Tool for Life Coach \u003c= 1.1.7 - Missing Authorization on Several AJAX Endpoints",
    "slug": "wheel-of-life",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3627",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Kundgenerator \u003c= 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "kundgenerator",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54319",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPMK PDF Generator \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "wpmk-pdf-generator",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58268",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Recaptcha – wp \u003c= 0.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "recaptcha-wp",
    "type": "plugin",
    "affected_version": "* - 0.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60177",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp Ultimate Review \u003c= 2.2.5 - Missing Authorization",
    "slug": "wp-ultimate-review",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32684",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iQ Block Country \u003c 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip",
    "slug": "iq-block-country",
    "type": "plugin",
    "affected_version": "[*, 1.2.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0246",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Church Admin \u003c= 4.1.32 - Cross-Site Request Forgery",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.1.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34828",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgets",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4944",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Workbox Video from Vimeo \u0026 Youtube \u003c= 3.2.2 - Reflected Cross-Site Scripting",
    "slug": "workbox-video-from-vimeo-youtube-plugin",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32534",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "mTouch Quiz \u003c= 3.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mtouch-quiz",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2410",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Material Design for Contact Form 7 \u003c= 2.6.4 - Missing Authorization to Arbitrary Settings Update",
    "slug": "material-design-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0404",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Users Control \u003c= 1.0.16 - Unauthenticated Local File Inclusion",
    "slug": "users-control",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-44015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44015",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Button contact VR \u003c= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "button-contact-vr",
    "type": "plugin",
    "affected_version": "* - 4.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43347",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Countdown Timer \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "countdown-time",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26938",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Duplicator – WordPress Migration Plugin \u003c= 1.4.7 - Sensitive Information Disclosure",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2552",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Insert or Embed Articulate Content into WordPress \u003c= 4.3000000023 - Authenticated (Author+) Stored Cross-Site Scripting via Code Injection",
    "slug": "insert-or-embed-articulate-content-into-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.3000000023",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3000000023",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0756",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajax Content Filter \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "ajax-content-filter",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51717",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Planyo online reservation system \u003c= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "planyo-online-reservation-system",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31811",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Monolit \u003c= 2.0.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "monolit",
    "type": "theme",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25041",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple User Listing \u003c= 1.9.2 - Reflected Cross-Site Scripting via as",
    "slug": "simple-user-listing",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32298",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) \u003c= 3.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1730",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Sliderby10Web \u003c= 1.2.52 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "slider-wd",
    "type": "plugin",
    "affected_version": "* - 1.2.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4197",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Table Builder – WordPress Table Plugin \u003c= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-table-builder",
    "type": "plugin",
    "affected_version": "* - 2.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8604",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfect Images \u003c= 5.2.2 - Cross-Site Scripting",
    "slug": "wp-retina-2x",
    "type": "plugin",
    "affected_version": "[*, 5.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20983",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KP Fastest Tawk.to Chat \u003c= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "kp-fastest-tawk-to-chat",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49175",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery, Images, Slider in Rbs Image Gallery \u003c= 3.2.19 - Cross-Site Request Forgery to Post Creation and Limited Data Loss",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5343",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "myEASYbackup \u003c 1.0.9 - Directory Traversal",
    "slug": "myeasybackup",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-0898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-0898",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Site Chat on Telegram \u003c= 1.0.4 - Unauthenticated PHP Object Injection",
    "slug": "site-chat-on-telegram",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30949",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LayoutBoxx \u003c= 0.3.1 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "layoutboxx",
    "type": "plugin",
    "affected_version": "* - 0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2802",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "flowpaper \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "flowpaper-lite-pdf-flipbook",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5200",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Attachments for WooCommerce \u003c= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "order-attachments-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13638",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Webba Booking \u003c= 6.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "webba-booking-lite",
    "type": "plugin",
    "affected_version": "* - 6.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54729",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PPWP – Password Protect Pages \u003c= 1.9.10 - Authenticated (Subscriber+) Content Exposure via REST API",
    "slug": "password-protect-page",
    "type": "plugin",
    "affected_version": "* - 1.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5998",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Gradient Text Widget for Elementor \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gradient-text-widget-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31346",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Post Shortcode \u003c= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "related-post-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22276",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Animated Rotating Words \u003c= 5.4 - Cross-Site Request Forgery via save_admin_options",
    "slug": "css3-rotating-words",
    "type": "plugin",
    "affected_version": "* - 5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47187",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP eStore \u003c= 8.5.4 - Reflected Cross-Site Scripting via Customer Editing",
    "slug": "wp-cart-for-digital-products",
    "type": "plugin",
    "affected_version": "* - 8.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6074",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "360 Photo Spheres \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "360-sphere-images",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4588",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extensions for Elementor \u003c= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget",
    "slug": "extensions-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4868",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TK Google Fonts GDPR Compliant \u003c= 2.2.11 - Missing Authorization to Font Addition",
    "slug": "tk-google-fonts",
    "type": "plugin",
    "affected_version": "* - 2.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5823",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Theme My Login \u003c= 7.1.6 - Missing Authorization to Notice Dismissal",
    "slug": "theme-my-login",
    "type": "plugin",
    "affected_version": "* - 7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32525",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JSP Store Locator \u003c= 1.0 - Cross-Site Request Forgery to Store Deletion",
    "slug": "jsp-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12301",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Goods \u003c= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-goods",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51574",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageMagick Engine \u003c= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization",
    "slug": "imagemagick-engine",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3568",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Reroute Email \u003c= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via Email Subject",
    "slug": "wp-reroute-email",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3168",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NEX-Forms \u003c= 7.8.7 Authorization Bypass",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 7.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34676",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Splashing Images \u003c 2.1.1 - Cross-Site Scripting",
    "slug": "wp-splashing-images",
    "type": "plugin",
    "affected_version": "[*, 2.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-6194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6194",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CouponXxL \u003c= 3.0.0 - Unauthenticated PHP Object Injection",
    "slug": "couponxxl",
    "type": "theme",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-52725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52725",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WBW Currency Switcher \u003c= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "woo-currency",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2575",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Shortcodes \u0026 Templates For The Events Calendar \u003c= 2.3.1 - Authenticated (Contributor+) SQL Injection via shortcode",
    "slug": "template-events-calendar",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-52142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52142",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "oEmbed Gist \u003c= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "oembed-gist",
    "type": "plugin",
    "affected_version": "* - 4.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52194",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quote Comments \u003c= 3.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "quote-comments",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25156",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Builder \u003c= 1.2.2 - Missing Authorization",
    "slug": "visual-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46488",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Strong Testimonials \u003c= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification",
    "slug": "strong-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6491",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Traveler \u003c= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "* - 3.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1771",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Sliding Login/Dashboard Panel \u003c= 2.1.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-sliding-logindashboard-panel",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5928",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Generate PDF using Contact Form 7 \u003c= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion",
    "slug": "generate-pdf-using-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6317",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 3.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5482",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Weaver Xtreme Theme Support \u003c= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode",
    "slug": "weaverx-theme-support",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4939",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HotStar – Multi-Purpose Business Theme \u003c= 1.4 - Missing Authorization",
    "slug": "hotstar",
    "type": "theme",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31071",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpDataTables (Premium) \u003c= 3.4 - SQL Injection",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-26754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-26754",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tailored Tools \u003c= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tailored-tools",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52503",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Timeline \u003c= 4.4.2 - SQL Injection",
    "slug": "content_timeline",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14507",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Carousel, Slider, Gallery by WP Carousel \u003c= 2.6.8 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-carousel-free",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4002",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tainacan \u003c= 0.21.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "tainacan",
    "type": "plugin",
    "affected_version": "* - 0.21.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.21.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-34794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34794",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tabs – Responsive Tabs with WooCommerce Product Tab Extension \u003c= 3.6.0 - Authenticated (Admin+) Arbitrary Options Update",
    "slug": "vc-tabs",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36375",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dreamstime Stock Photos \u003c= 4.1 - Reflected Cross-Site Scripting",
    "slug": "dreamstime-stock-photos",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25090",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woffice Core \u003c= 5.4.21 - Cross-Site Request Forgery to User Registration Approval",
    "slug": "woffice-core",
    "type": "plugin",
    "affected_version": "* - 5.4.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2797",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 4.1.0 - Cross-Site Request Forgery",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-32289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-32289",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.8.2 - Contributor Users Can Publish Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-0165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0165",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.8.2 - Contributor Users Can Publish Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.1",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0165",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.8.2 - Contributor Users Can Publish Posts",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.1",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0165",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.12.10 - Cross-Site Request Forgery",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 2.12.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0588",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive Plus \u003c= 3.2.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "responsive-add-ons",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49856",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Real Media Library: Media Library Folder \u0026 File Manager \u003c= 4.18.28 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "real-media-library-lite",
    "type": "plugin",
    "affected_version": "* - 4.18.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.18.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0285",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Word Freshener \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "word-freshener",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23577",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShortPixel Image Optimizer \u003c= 6.3.4 - Authenticated (Contributor+) Settings Import/Export",
    "slug": "shortpixel-image-optimiser",
    "type": "plugin",
    "affected_version": "* - 6.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11378",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form \u0026 Content Restriction Social Sites Login \u003c= 1.7.9 - Authentication Bypass via WordPress.com OAuth provider",
    "slug": "pie-register-social-site",
    "type": "plugin",
    "affected_version": "* - 1.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11293",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletters \u003c= 4.9.5 - Information Exposure via Log files",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32953",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Alt Manager \u003c= 1.6.1 - Missing Authorization",
    "slug": "alt-manager",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50373",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Helpie FAQ \u003c= 1.9.8 - Reflected Cross-Site Scripting",
    "slug": "helpie-faq",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1891",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ERP \u003c= 1.12.3 - Authenticated (Administrator+) SQL Injection via 'type'",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "[*, 1.12.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-2744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2744",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lana Downloads Manager \u003c= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "lana-downloads-manager",
    "type": "plugin",
    "affected_version": "* - 1.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7387",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add RSS \u003c= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "add-rss",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23895",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset",
    "slug": "th-variation-swatches",
    "type": "plugin",
    "affected_version": "1.0.8 - 1.3.2",
    "from_version": "1.0.8",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13511",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.0.17 - Privilege Escalation",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4278",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Beauty Contact Popup Form \u003c= 6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "beauty-contact-popup-form",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53325",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Notely \u003c= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "notely",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60149",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CubeWP Forms \u003c= 1.1.5 - Missing Authorization",
    "slug": "cubewp-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49880",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lordicon Animated Icons \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lordicon-interactive-icons",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30519",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapSVG Lite \u003c 3.3.0 - Cross-Site Request Forgery",
    "slug": "mapsvg-lite-interactive-vector-maps",
    "type": "plugin",
    "affected_version": "[*, 3.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-1000003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1000003",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "cformsII \u003c= 14.13.2 - Cross-Site Scripting",
    "slug": "cforms2",
    "type": "plugin",
    "affected_version": "* - 14.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "News Announcement Scroll \u003c= 8.8.8 - Authenticated (Admininstrator+) Stored Cross-Site Scripting",
    "slug": "news-announcement-scroll",
    "type": "plugin",
    "affected_version": "* - 8.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40694",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spoki \u003c= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "spoki",
    "type": "plugin",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50026",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Checker | Finder \u003c= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgery",
    "slug": "broken-link-finder",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12121",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "RS-Members \u003c= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "rs-members",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49219",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PluginPass \u003c= 0.9.10 - Unauthenticated Arbitrary File Deletion",
    "slug": "pluginpass-pro-plugintheme-licensing",
    "type": "plugin",
    "affected_version": "* - 0.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54291",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "EG-Series \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "eg-series",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4126",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel Engine \u003c= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 6.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5282",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Missing Authorization to Cache Deletion",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1375",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WCP Contact Form \u003c= 3.1.0 - Missing Authorization",
    "slug": "wcp-contact-form",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32519",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "NHR Options Table Manager \u003c= 1.1.2 - Authenticated (Admin+) PHP Object Injection",
    "slug": "nhrrob-options-table-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27301",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Attendance Manager \u003c= 0.5.6 - Cross-site Request Forgery",
    "slug": "attendance-manager",
    "type": "plugin",
    "affected_version": "* - 0.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-5971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5971",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MultiLoca - WooCommerce Multi Locations Inventory Management \u003c= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'",
    "slug": "WooCommerce-Multi-Locations-Inventory-Management",
    "type": "plugin",
    "affected_version": "* - 4.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-9054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9054",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woo Manage Fraud Orders \u003c= 2.6.1 - Unauthenticated Information Exposure via Log Files",
    "slug": "woo-manage-fraud-orders",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10544",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Portfolio \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-portfolio",
    "type": "theme",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33537",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Workreap \u003c= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover",
    "slug": "workreap",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13446",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IdeaPush \u003c= 8.66 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ideapush",
    "type": "plugin",
    "affected_version": "* - 8.66",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.66",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44041",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Product Reviews \u003c= 1.3.8 - Reflected Cross-Site Scripting",
    "slug": "edd-product-reviews",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9526",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Active Products Tables for WooCommerce. Use constructor to create tables \u003c= 1.0.6.6 - Reflected Cross-Site Scripting",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0864",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Simple Shipping \u003c= 2.1.3 - Cross-Site Scripting",
    "slug": "simple-shipping-edd",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9527",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Table Manager \u003c= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-table-manager",
    "type": "plugin",
    "affected_version": "[*, 3.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-47602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47602",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Animated Rotating Words \u003c= 5.4 - Missing Authorization via save_admin_options",
    "slug": "css3-rotating-words",
    "type": "plugin",
    "affected_version": "* - 5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47187",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FriendStore for WooCommerce \u003c= 1.4.2 - Reflected Cross-Site Scripting",
    "slug": "friendstore-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51784",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Progress Tracker \u003c= 0.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "progress-tracker",
    "type": "plugin",
    "affected_version": "* - 0.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23892",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bloglo \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bloglo",
    "type": "theme",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35715",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Prayer \u003c= 2.0.9 - Cross-Site Request Forgery to Email Settings Update",
    "slug": "wp-prayer",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3406",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Aphorismus \u003c= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "aphorismus",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54429",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Online Users Stats \u003c= 1.0.0 - Authenticated (Editor+) SQL Injection via table_name Parameter",
    "slug": "wp-online-users-stats",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4964",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Post Thumbnail Editor \u003c= 2.4.8 - Sensitive Information Exposure",
    "slug": "post-thumbnail-editor",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24845",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "TimelineJS3 \u003c 3.7.0 - Stored Cross-Site Scripting",
    "slug": "knight-lab-timelinejs",
    "type": "plugin",
    "affected_version": "[*, 3.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-15092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-15092",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Twitter LiveBlog \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "twitter-liveblog",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9398",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Carousel Slider \u003c= 2.2.10 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "carousel-slider",
    "type": "plugin",
    "affected_version": "* - 2.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4372",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IdeaPush \u003c= 8.72 - Missing Authorization",
    "slug": "ideapush",
    "type": "plugin",
    "affected_version": "* - 8.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24607",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Chauffeur Taxi Booking System for WordPress \u003c= 6.9 - Authentication Bypass",
    "slug": "chauffeur-booking-system",
    "type": "plugin",
    "affected_version": "* - 6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32692",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "WooCommerce PDF Vouchers \u003c 4.9.9 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-pdf-vouchers",
    "type": "plugin",
    "affected_version": "[*, 4.9.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-56265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56265",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Access Manager \u003c= 6.6.1 - Authenticated Information Disclosure",
    "slug": "advanced-access-manager",
    "type": "plugin",
    "affected_version": "* - 6.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-35934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35934",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Call Now Accessibility Button \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "accessibility-help-button",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2635",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "REVE Chat \u003c= 6.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "revechat",
    "type": "plugin",
    "affected_version": "* - 6.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Property Listings \u003c= 3.5.2 - Authenticated(Contributor+) SQL Injection via Shortcode",
    "slug": "easy-property-listings",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1893",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SiteSuperCharger \u003c= 5.1.10 - Unauthenticated SQL Injection",
    "slug": "sitesupercharger",
    "type": "plugin",
    "affected_version": "* - 5.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0771",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Anih - Creative Agency WordPress Theme \u003c= 2024 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "anih",
    "type": "theme",
    "affected_version": "* - 2024",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9775",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant Menu by MotoPress \u003c= 2.4.1 - Admin+ Stored Cross Site Scripting",
    "slug": "mp-restaurant-menu",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24722",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Browser Address Bar Color \u003c= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "browser-address-bar-color",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30577",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WowAddons \u003c= 1.0.17 - Missing Authorization",
    "slug": "product-addons",
    "type": "plugin",
    "affected_version": "* - 1.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57958",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.101",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.101",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7624",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Photoxhibit \u003c= 2.1.8 - Reflected Cross-Site Scripting via gid",
    "slug": "photoxhibit",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000143",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Tickets and Registration \u003c= 5.19.1.1 - Missing Authorization to Ticket Deletion",
    "slug": "event-tickets",
    "type": "plugin",
    "affected_version": "* - 5.19.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.19.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1402",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Coming Soon Page – Responsive Coming Soon \u0026 Maintenance Mode \u003c= 1.1.18 - Cross-Site Request Forgery",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-5658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5658",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Permalink Manager Lite \u003c= 2.2.20 - Missing Authorization",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41781",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Web Accessibility By accessiBe \u003c= 2.5 - Reflected Cross-Site Scripting",
    "slug": "accessibe",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26981",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Body Class \u003c= 0.6.0 - Cross-Site Request Forgery",
    "slug": "wp-custom-body-class",
    "type": "plugin",
    "affected_version": "* - 0.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-6030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6030",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SVGator – Add Animated SVG Easily \u003c= 1.2.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "svgator",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4271",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OSM Map Widget for Elementor \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL",
    "slug": "osm-map-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8619",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TheGem \u003c 5.8.1.1 - Improper Authentication",
    "slug": "thegem",
    "type": "theme",
    "affected_version": "[*, 5.8.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-32238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32238",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "12 Step Meeting List \u003c= 3.14.24 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "12-step-meeting-list",
    "type": "plugin",
    "affected_version": "* - 3.14.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46641",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.6.3 - Authenticated SQL Injection",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.6.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24889",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LWS Cleaner \u003c= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file'",
    "slug": "lws-cleaner",
    "type": "plugin",
    "affected_version": "* - 2.4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8575",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1235",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c= 8.0.10 - Stored Cross-Site Scripting",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "[*, 8.0.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-25115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25115",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Document Block – Upload \u0026 Embed Docs \u003c= 1.1.0 - Missing Authorization",
    "slug": "document",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22696",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPML \u003c 3.1.8 - Authorization Bypass",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "[*, 3.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-2792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2792",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "AnyWhere Elementor Pro \u003c= 2.29 - Missing Authorization",
    "slug": "anywhere-elementor-pro",
    "type": "theme",
    "affected_version": "* - 2.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31046",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Game Review Block \u003c= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter",
    "slug": "game-review-block",
    "type": "plugin",
    "affected_version": "* - 4.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5923",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SimplyRETS Real Estate IDX \u003c= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simply-rets",
    "type": "plugin",
    "affected_version": "* - 2.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12491",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UiPress lite \u003c= 3.4.06 - Authenticated (Administrator+) SQL Injection",
    "slug": "uipress-lite",
    "type": "plugin",
    "affected_version": "* - 3.4.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.06",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-38788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38788",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Viet Nam Affiliate \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "viet-nam-affiliate",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34417",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 4.6.4 - Missing Authorization",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 4.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4446",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "RumbleTalk Live Group Chat – HTML5 \u003c= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rumbletalk-chat-a-chat-with-themes",
    "type": "plugin",
    "affected_version": "* - 6.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Ultra \u003c= 7.3.5 - Missing Authorization",
    "slug": "themify-ultra",
    "type": "theme",
    "affected_version": "* - 7.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46148",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Amelia \u003c= 1.1.5 \u0026 Amelia (Pro) \u003c= 7.5.1  - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "amelia",
    "type": "plugin",
    "affected_version": "* - 7.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6225",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amelia \u003c= 1.1.5 \u0026 Amelia (Pro) \u003c= 7.5.1  - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6225",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StreamWeasels YouTube Integration \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed Shortcode",
    "slug": "streamweasels-youtube-integration",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10185",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.93 - Reflected Cross-Site Scripting",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29792",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bitcoin Satoshi Tools \u003c= 1.7.0 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "simple-bitcoin-faucets",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3024",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orders Tracking for WooCommerce \u003c= 1.2.10 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "woo-orders-tracking",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4039",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Post Carousel Slider for Elementor \u003c= 1.7.0 - Missing Authorization",
    "slug": "post-carousel-slider-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57955",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Case Theme User \u003c 1.0.4 - Unauthenticated Local File Inclusion",
    "slug": "case-theme-user",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-5804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5804",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Nginx Cache Purge Preload \u003c= 2.1.1 - Authenticated (Administrator+) Remote Code Execution",
    "slug": "fastcgi-cache-purge-and-preload-nginx",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6213",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contextual Related Posts \u003c= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute",
    "slug": "contextual-related-posts",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0252",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thumbs Rating \u003c= 5.1.0 - Unauthenticated Insecure Direct Object Reference",
    "slug": "thumbs-rating",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31095",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Maintenance Mode \u003c= 3.0.1 - Information Exposure",
    "slug": "hkdev-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1478",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Classified Listing \u003c= 4.2.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52715",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Crisp \u003c= 0.44 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "crisp",
    "type": "plugin",
    "affected_version": "* - 0.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27963",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integration for Contact Form 7 and Zoho CRM, Bigin \u003c= 1.2.3 - Authenticated (Admin+) SQL Injection",
    "slug": "cf7-zoho",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2527",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Accept Stripe Payments \u003c= 2.0.79 - Unauthenticated Content Injection",
    "slug": "stripe-payments",
    "type": "plugin",
    "affected_version": "* - 2.0.79",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.79",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48285",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Breeze \u003c= 2.2.13 - Missing Authorization",
    "slug": "breeze",
    "type": "plugin",
    "affected_version": "* - 2.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23999",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "File Provider \u003c= 1.2.3 - Cross-Site Request Forgery to Item Deletion",
    "slug": "file-provider",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4580",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 4.5.97 - Authenticated (Administrator+) Arbitrary File Download",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 4.5.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.97",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2981",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "JetWidgets For Elementor \u003c= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "jetwidgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10323",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donations Made Easy – Smart Donations \u003c= 4.0.12 - Missing Authorization",
    "slug": "smart-donations",
    "type": "plugin",
    "affected_version": "* - 4.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38475",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSV 360 View \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rsv-360-view",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51906",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZM Gallery \u003c= 1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "zm-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10940",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin \u003c= 2.3.9 - Unauthenticated SQL Injection",
    "slug": "jobwp",
    "type": "plugin",
    "affected_version": "* - 2.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2010",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.33.3 - Cross-Site Request Forgery to plugin installation",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.33.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.33.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4246",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "QuBotChat \u003c= 1.1.5 - Unauthenticated Self-Based Cross-Site Scripting",
    "slug": "qubotchat",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2399",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReviewX \u003c= 1.6.21 - Missing Authorization",
    "slug": "reviewx",
    "type": "plugin",
    "affected_version": "* - 1.6.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33921",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "InfiniteWP Client \u003c= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading",
    "slug": "iwp-client",
    "type": "plugin",
    "affected_version": "* - 1.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10585",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.7 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "[*, 1.5.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1407",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "One Click Close Comments \u003c= 2.7.1 - Unauthenticated Full Path Disclosure",
    "slug": "one-click-close-comments",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6546",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "VK Poster Group \u003c= 2.0.3 - Reflected Cross-Site Scripting via vkp_repost",
    "slug": "vk-poster-group",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24932",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Database Backup \u003c= 4.3 - Cross-Site Scripting",
    "slug": "wp-database-backup",
    "type": "plugin",
    "affected_version": "[*, 4.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10875",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CozyStay \u003c= 1.7.0 and TinySalt \u003c= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler",
    "slug": "tinysalt",
    "type": "theme",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13410",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CozyStay \u003c= 1.7.0 and TinySalt \u003c= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler",
    "slug": "cozystay",
    "type": "theme",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13410",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz Tool Lite \u003c= 2.3.15 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "quiz-tool-lite",
    "type": "plugin",
    "affected_version": "* - 2.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24701",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Annual Archive \u003c= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "anual-archive",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0178",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Ban \u003c= 1.69 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-ban",
    "type": "plugin",
    "affected_version": "* - 1.69",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.69",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4260",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links \u0026 Link Pages \u003c= 2.4.1 - Reflected Cross-Site Scripting",
    "slug": "clickwhale",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11327",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Source Control \u003c= 2.17.0 - Sensitive Information Exposure via Log File",
    "slug": "image-source-control-isc",
    "type": "plugin",
    "affected_version": "* - 2.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52187",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ShopCred \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shopcred",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31829",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AuMenu \u003c= 1.1.5 - Reflected Cross-Site Scripting",
    "slug": "aumenu",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23728",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DELUCKS SEO \u003c= 2.5.4 - Missing Authorization",
    "slug": "delucks-seo",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30538",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IdeaPush \u003c= 8.57 - Missing Authorization",
    "slug": "ideapush",
    "type": "plugin",
    "affected_version": "* - 8.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.57",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48774",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sunny Search \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "fast-search-powered-by-solr",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32595",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GP Premium \u003c= 2.4.0 - Reflected Cross-Site Scripting",
    "slug": "gp-premium",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3469",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 5.12.0 - Cross-Site Request Forgery",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 5.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41136",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gutentor \u003c= 3.5.2 - Missing Authorization",
    "slug": "gutentor",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58680",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "QuoteMedia Tools \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quotemedia-tools",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23644",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Coming Soon \u0026 Maintenance \u003c= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Template Name Update",
    "slug": "ultimate-coming-soon",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9705",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Page Numbers \u003c= 0.5 - Cross-Site Request Forgery via wp_page_numbers_settings",
    "slug": "wp-page-numbers",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27623",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stripe Payments For WooCommerce by Checkout \u003c= 1.9.1 - Unauthenticated Insecure Direct Object Reference",
    "slug": "checkout-plugins-stripe-woo",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43315",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "History Log by click5 \u003c= 1.0.13 - Unauthenticated SQL Injection",
    "slug": "history-log-by-click5",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31531",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ShopApper \u003c= 0.4.53 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "mobile-app-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 0.4.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32638",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Robo Gallery \u003c= 3.2.15 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3499",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Product Tabs for WooCommerce \u003c= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection",
    "slug": "yikes-inc-easy-custom-woocommerce-product-tabs",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11465",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Updater by BestWebSoft \u003c= 1.34 - Reflected Cross-Site Scripting",
    "slug": "updater",
    "type": "plugin",
    "affected_version": "* - 1.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18565",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InstaWP Connect – 1-click WP Staging \u0026 Migration \u003c= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.38",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4898",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blog-in-Blog \u003c= 1.1.1 - Authenticated (Editor+) Local File Inclusion via Shortcode",
    "slug": "blog-in-blog",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2435",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DL Verification \u003c= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "dl-verification",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6798",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EO4WP \u003c= 1.0.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fw-integration-for-emailoctopus",
    "type": "plugin",
    "affected_version": "* - 1.0.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30763",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YourChannel \u003c= 1.2.3 - Missing Authorization to Plugin Cache Reset",
    "slug": "yourchannel",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1868",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WOOCS – WooCommerce Currency Switcher \u003c= 1.4.2 - Missing Authorization",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43297",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery - GT3 Image Gallery \u0026 Gutenberg Block Gallery \u003c= 2.7.7.21 - Authenticated (Author+) Cross-Site Scripting",
    "slug": "gt3-photo-video-gallery",
    "type": "plugin",
    "affected_version": "* - 2.7.7.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4035",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Peter’s Custom Anti-Spam \u003c= 3.2.2 - Reflected Cross-Site Scripting",
    "slug": "peters-custom-anti-spam-image",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45759",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bitcoin / AltCoin Payment Gateway for WooCommerce \u003c= 1.7.6 - Unauthenticated SQL Injection",
    "slug": "woo-altcoin-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26535",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "gee Search Plus, improved WordPress search \u003c= 1.4.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gsearch-plus",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34560",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soledad \u003c= 8.4.5 - Missing Authorization",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31367",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Highlight \u003c= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "highlight",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56297",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Supertext Translation and Proofreading \u003c= 4.25 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "polylang-supertext",
    "type": "plugin",
    "affected_version": "* - 4.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47639",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "XT Event Widget for Social Events \u003c= 1.1.7 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "xt-facebook-events",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47531",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Hover Effects for Elementor with Lightbox and Flipbox \u003c= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parameters",
    "slug": "image-hover-effects-with-carousel",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5001",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spirit Framework \u003c= 1.2.14 - Authentication Bypass to Account Takeover and Privilege Escalation",
    "slug": "spirit-framework",
    "type": "plugin",
    "affected_version": "* - 1.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.14",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6388",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CZ Loan Management \u003c= 1.1 - Unauthenticated SQL Injection",
    "slug": "cz-loan-management",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5975",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "BBCode Deluxe \u003c= 2020.08.01.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bbcode-deluxe",
    "type": "plugin",
    "affected_version": "* - 2020.08.01.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2020.08.01.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46479",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8102",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WooCommerce Product Recommendations \u003c 2.3.0 - Cross-Site Request Forgery",
    "slug": "woocommerce-product-recommendations",
    "type": "plugin",
    "affected_version": "[*, 2.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-32744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32744",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SurveyJS \u003c= 1.12.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "surveyjs",
    "type": "plugin",
    "affected_version": "* - 1.12.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3815",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Remove Footer Credit \u003c= 1.0.10 - Admin+ Stored Cross-Site Scripting",
    "slug": "remove-footer-credit",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25050",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fixed HTML Toolbar \u003c= 1.0.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "fixed-html-toolbar",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32540",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MC4WP \u003c= 4.9.9 - Missing Authorization via listen",
    "slug": "mailchimp-for-wp",
    "type": "plugin",
    "affected_version": "* - 4.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51682",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Master Slider - Responsive Touch Slider \u003c= 3.9.10 - Cross-Site Request Forgery via process_bulk_action",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6326",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Autocomplete Location field Contact Form 7 \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "autocomplete-location-field-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5005",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Pug: Author Box \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "social-pug-author-box",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22706",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Hour Booking \u003c= 1.4.23 - Missing Authorization to Double Booking",
    "slug": "appointment-hour-booking",
    "type": "plugin",
    "affected_version": "* - 1.4.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45649",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive video embed \u003c= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-video-embed",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5475",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PostmarkApp Email Integrator \u003c= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "postmarkapp-email-integrator",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31617",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Internal Links Manager \u003c= 2.5.2 - Missing Authorization",
    "slug": "seo-automated-link-building",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24679",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP EasyCart \u003c= 5.4.10 - Authenticated (Administrator+) SQL Injection via 'orderby'",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3023",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IP2Location Country Blocker \u003c= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function",
    "slug": "ip2location-country-blocker",
    "type": "plugin",
    "affected_version": "* - 2.38.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.38.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1361",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Category Featured Images Extended \u003c= 1.52 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "category-featured-images-extended",
    "type": "plugin",
    "affected_version": "* - 1.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57920",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress \u0026 WooCommerce \u003c= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12566",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Abandoned Cart Lite for WooCommerce \u003c 5.2.0 and Abandoned Cart Pro for WooCommerce \u003c 7.13.0 - Stored Cross-Site Scripting",
    "slug": "woocommerce-abandoned-cart-pro",
    "type": "plugin",
    "affected_version": "* - 7.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-25152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25152",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Abandoned Cart Lite for WooCommerce \u003c 5.2.0 and Abandoned Cart Pro for WooCommerce \u003c 7.13.0 - Stored Cross-Site Scripting",
    "slug": "woocommerce-abandoned-cart",
    "type": "plugin",
    "affected_version": "[*, 5.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-25152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25152",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Duplicate Page or Post \u003c= 1.5.0 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "duplicate-page-or-post",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25075",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c 2.7.1 - Arbitrary File Upload",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "[*, 2.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9339",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
  },
  {
    "title": "WP Map Route Planner \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-map-route-planner",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32621",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bitcoin / AltCoin Payment Gateway for WooCommerce \u003c= 1.7.6 - Reflected Cross-Site Scripting",
    "slug": "woo-altcoin-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26541",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Contact \u003c= 1.0 - Cross-Site Scripting",
    "slug": "wp-contact-sidebar-widget",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4583",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Domain For Sale \u003c= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter",
    "slug": "domain-for-sale",
    "type": "plugin",
    "affected_version": "* - 3.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5239",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPack Addons for Elementor \u003c= 2.7.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1411",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Professional Contact Form \u003c= 1.0.0 - Cross-Site Request Forgery to Test Email Sending",
    "slug": "professional-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9944",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Relevant – Related, Featured, Latest, and Popular Posts by BestWebSoft \u003c= 1.0.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "relevant",
    "type": "plugin",
    "affected_version": "[*, 1.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9384",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeproDev CF7 Database \u003c= 2.0.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "pepro-cf7-database",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31573",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooFramework Tweaks \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "wooframework-tweaks",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10113",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MDC YouTube Downloader \u003c 2.1.1 - Directory Traversal",
    "slug": "mdc-youtube-downloader",
    "type": "plugin",
    "affected_version": "[*, 2.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-5469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5469",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "tencentcloud-cos \u003c= 1.0.7 - Missing Authorization via AJAX actions",
    "slug": "tencentcloud-cos",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29433",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c 2.2.3 - Unauthenticated Parameter Manipulation",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-10363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10363",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WPMasterToolKit (WPMTK) – All in one plugin \u003c= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write",
    "slug": "wpmastertoolkit",
    "type": "plugin",
    "affected_version": "* - 1.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3300",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Foodbakery Sticky Cart \u003c= 3.2 - Unauthenticated PHP Object Injection",
    "slug": "foodbakery-sticky-cart",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39356",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Checklist \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "checklist",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31538",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wide Banner \u003c= 1.0.4 - Missing Authorization",
    "slug": "wide-banner",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58919",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JavaScript Logic \u003c= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "javascript-logic",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8090",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Child Theme Generator \u003c= 1.1.1 - Missing Authorization to Unauthenticated Child Theme Creation/Activation",
    "slug": "wp-child-theme-generator",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3610",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "ImageMagick Engine \u003c= 1.7.10 - Authenticated (Administrator+) Remote Code Execution",
    "slug": "imagemagick-engine",
    "type": "plugin",
    "affected_version": "* - 1.7.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6486",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Members Membership Plugin \u003c= 3.4.8 - Missing Authorization to Sensitive Information Exposure",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6733",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Featured Image Plus \u003c= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Featured Image Update",
    "slug": "featured-image-plus",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4431",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Table of Contents \u003c= 2.0.67.1 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "easy-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 2.0.67.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.67.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7082",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Api2Cart Bridge Connector \u003c= 1.1.0 - Arbitrary Code Execution",
    "slug": "api2cart-bridge-connector",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-42497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42497",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sliced Invoices \u003c 3.8.4 - Authenticated SQL Injection",
    "slug": "sliced-invoices",
    "type": "plugin",
    "affected_version": "[*, 3.8.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-20625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-20625",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Grey Opaque \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button Shortcode",
    "slug": "grey-opaque",
    "type": "theme",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5966",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "amr shortcodes \u003c= 1.7 - Reflected Cross-Site Scripting",
    "slug": "amr-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52464",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Search Analytics \u003c= 1.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "search-analytics",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47587",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Support Ticket System \u003c= 17.7 - Unauthenticated Arbitrary File Upload",
    "slug": "woocommerce-support-ticket-system",
    "type": "plugin",
    "affected_version": "* - 17.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10627",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rename wp-login.php \u003c= 2.6.0 - Cross-Site Request Forgery \u0026 Unauthenticated Settings Change",
    "slug": "rename-wp-login",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1732",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ActiveDEMAND \u003c= 0.2.43 - Cross-Site Request Forgery",
    "slug": "activedemand",
    "type": "plugin",
    "affected_version": "* - 0.2.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35638",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Free Google Maps \u003c= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-map",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22329",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackWPup \u003c= 4.0.1 - Authenticated (Administrator+) Directory Traversal",
    "slug": "backwpup",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5504",
    "auth_type": "Privileged",
    "cvss_score": 8.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H"
  },
  {
    "title": "WholesaleX \u003c= 1.3.1 - Sensitive Information Exposure via export_users",
    "slug": "wholesalex",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30233",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Plain Post \u003c= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "plain-post",
    "type": "theme",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54349",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wordTube \u003c= 1.43 - Directory Traversal and File Inclusion",
    "slug": "wordtube",
    "type": "plugin",
    "affected_version": "* - 1.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.43",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2007-2482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-2482",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Print Science Designer \u003c= 1.3.155 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "print-science-designer",
    "type": "plugin",
    "affected_version": "* - 1.3.155",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.155",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46465",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "JetCompareWishlist \u003c= 1.5.9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "jet-compare-wishlist",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22279",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "X Addons for Elementor \u003c= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "x-addons-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48132",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API – Create Native Android \u0026 iOS Apps On The Cloud \u003c= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creation",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.17.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.17.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4683",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "App Builder – Create Native Android \u0026 iOS Apps On The Flight \u003c= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP",
    "slug": "app-builder",
    "type": "plugin",
    "affected_version": "* - 5.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9302",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom WP Store Locator \u003c= 1.4.7 - Reflected Cross-Site SCripting",
    "slug": "custom-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24676",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XforWooCommerce \u003c= 2.0.2 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "xforwoocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-33628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33628",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Directory Kit \u003c= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2279",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Tutor LMS Elementor Addons \u003c= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation",
    "slug": "tutor-lms-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10897",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sola Support Ticket \u003c= 3.18 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "sola-support-tickets",
    "type": "plugin",
    "affected_version": "* - 3.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25997",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Exit Box Lite \u003c= 1.06 - Full Path Dislcosure",
    "slug": "wordpress-exit-box-lite",
    "type": "plugin",
    "affected_version": "1.06",
    "from_version": "1.06",
    "from_inclusive": true,
    "to_version": "1.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-10030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-10030",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce \u003c= 8.5.2 - Missing Authorization to Private/Draft Product Disclosure",
    "slug": "post-new",
    "type": "plugin",
    "affected_version": "[*, 8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-1310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1310",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Psychological tests \u0026 quizzes \u003c= 0.21.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-testing",
    "type": "plugin",
    "affected_version": "* - 0.21.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.21.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36867",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Notifier \u003c= 1.2.0 - Cross-Site Scripting",
    "slug": "event-notifier",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18576",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom 404 Pro \u003c= 3.2.7 - Reflected Cross-Site Scripting",
    "slug": "custom-404-pro",
    "type": "plugin",
    "affected_version": "[*, 3.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15838",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Post Dripper Extension \u003c= 4.0.4 - Missing Authorization to Arbitrary Page/Post Deletion",
    "slug": "mainwp-post-dripper-extension",
    "type": "plugin",
    "affected_version": "4.0.4",
    "from_version": "4.0.4",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23661",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "PowerBI Embed Reports \u003c= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embed-power-bi-reports",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11901",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Limit Max IPs Per User \u003c= 1.5 - Reflected Cross-Site Scripting",
    "slug": "limit-max-ips-per-user",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31455",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KB Support – WordPress Help Desk \u003c= 1.5.5 - Multiple Unauthenticated Stored Cross-Site Scripting",
    "slug": "kb-support",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27852",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Thumbnail Slider With Lightbox \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Image Title",
    "slug": "wp-responsive-slider-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5621",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FlightLog \u003c= 3.0.2 - Authenticated (Editor+) SQL Injection",
    "slug": "flightlog",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24336",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VR Calendar \u003c= 2.3.1 - Unauthenticated Remote Code Execution",
    "slug": "vr-calendar-sync",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-2314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2314",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Store Locator Plus \u003c= 5.12.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "store-locator-le",
    "type": "plugin",
    "affected_version": "* - 5.12.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24290",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Showcase Ultimate \u003c= 1.4.4 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "logo-showcase-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32499",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "miniOrange Discord Integration \u003c= 2.2.2 - Unauthenticated Local File Inclusion",
    "slug": "miniorange-discord-integration",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47672",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Schreikasten \u003c= 0.14.18 - Authenticated (Author+) SQL Injection",
    "slug": "schreikasten",
    "type": "plugin",
    "affected_version": "* - 0.14.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.14.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24630",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post-Plugin Library \u003c= 2.6.2.1 - Reflected Cross-Site Scripting",
    "slug": "post-plugin-library",
    "type": "plugin",
    "affected_version": "* - 2.6.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31085",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photography \u003c= 7.5.2 - Unauthenticated PHP Object Injection",
    "slug": "photography",
    "type": "theme",
    "affected_version": "* - 7.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47579",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Cross-Site Request Forgery via ajax_save_folder_order",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0730",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Custom Coming Soon \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "custom-coming-soon",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23836",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM On Demand Search And Replace \u003c= 1.5.2 - Cross-Site Request Forgery",
    "slug": "cm-on-demand-search-and-replace",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54728",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Testimonial Slider \u003c= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "testimonial",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1746",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GD Rating System \u003c= 3.5.0 - Unauthenticated Stored Cross-Site Scripting via IP",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25093",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "JobSearch \u003c= 2.5.4 - Missing Authorization",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43928",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lightview Plus \u003c= 3.1.3 - Reflected Cross-Site Scripting",
    "slug": "lightview-plus",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28890",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plotly \u003c= 1.0.2 - Stored Cross-Site Scripting",
    "slug": "wp-plotly",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9347",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Auction  \u003c= 4.2.5 - Cross-Site Request Forgery",
    "slug": "ultimate-auction",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37543",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CMS Tree Page View \u003c 0.8.9 - Cross-Site Scripting",
    "slug": "cms-tree-page-view",
    "type": "plugin",
    "affected_version": "[*, 0.8.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-1834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-1834",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeoDataSource Country Region DropDown \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "geodatasource-country-region-dropdown",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12474",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Security \u0026 Membership \u003c= 1.5.15 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "contexture-page-security",
    "type": "plugin",
    "affected_version": "* - 1.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1088",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Regenerate post permalink \u003c= 1.0.3 - Cross-Site Request Forgery",
    "slug": "regenerate-post-permalinks",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33681",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Print Science Designer \u003c= 1.3.152 - Unauthenticated PHP Object Injection",
    "slug": "print-science-designer",
    "type": "plugin",
    "affected_version": "* - 1.3.152",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.152",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12312",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Big Post Shipping for WooCommerce \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woo-bigpost-shipping",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10191",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Katerio - Magazine \u003c= 1.5.1 - Unauthenticated Local File Inclusion",
    "slug": "katerio",
    "type": "theme",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52810",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Radio – Worldwide Online Radio Stations Directory for WordPress \u003c= 3.1.9 - Cross-Site Request Forgery",
    "slug": "wp-radio",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms \u003c= 1.1.1 - Unauthenticated PHP Object Injection via verify_field_val Function",
    "slug": "integration-for-contact-form-7-and-google-sheets",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7697",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BNS Featured Category \u003c= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bns-featured-category",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5538",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Patreon WordPress \u003c= 1.9.1 - Missing Authorization",
    "slug": "patreon-connect",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24588",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 17.0.4 - Authenticated (Author+) SQL Injection",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 17.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36394",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woocommerce Vietnam Checkout \u003c= 2.0.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "woo-vietnam-checkout",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5325",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Product Sync \u003c= 8.6 - Unauthenticated SQL Injection",
    "slug": "sync-wc-google",
    "type": "plugin",
    "affected_version": "* - 8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31599",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "XML for Google Merchant Center \u003c= 3.0.11 - Reflected Cross-Site Scripting",
    "slug": "xml-for-google-merchant-center",
    "type": "plugin",
    "affected_version": "* - 3.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13406",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calendarista Basic Edition \u003c= 3.0.5 - Missing Authorization",
    "slug": "calendarista-basic-edition",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30534",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PDF Generator for WordPress \u003c= 1.5.4 - Missing Authorization",
    "slug": "pdf-generator-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58978",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Ajax Chat – Add a Fast, Secure Chat Box \u003c= 20240318 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-ajax-chat",
    "type": "plugin",
    "affected_version": "* - 20240318",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20240318",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2470",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider by 10Web \u003c= 1.2.58 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "slider-wd",
    "type": "plugin",
    "affected_version": "* - 1.2.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8283",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MWW Disclaimer Buttons \u003c= 3.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mww-disclaimer-buttons",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32428",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins \u003c= 2.32 - Authenticated (Admin+) SQL Injection",
    "slug": "reportattacks",
    "type": "plugin",
    "affected_version": "* - 2.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2250",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "iFrame \u003c= 3.0 - Reflected Cross-Site Scripting",
    "slug": "iframe",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-6738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6738",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 14.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 14.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2194",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Share Buttons with Floating Sidebar \u003c= 4.1 - Stored Cross-Site Scripting",
    "slug": "custom-share-buttons-with-floating-sidebar",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1717",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fintelligence Calculator \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fintelligence-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9859",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.93 - Unauthenticated IP Spoofing",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32786",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10322",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Felan Framework \u003c= 1.1.4 - Hardcoded Credentials",
    "slug": "felan-framework",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-10850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10850",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Feed Them Social – for Twitter feed, Youtube and more \u003c= 2.9.9 - Reflected Cross-Site Scripting",
    "slug": "feed-them-social",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2383",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Gift Cards for WooCommerce \u003c= 2.1.1 - Cross-Site Request Forgery Bypass",
    "slug": "woo-gift-cards-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4391",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "KB Support \u003c= 1.5.88 - Missing Authorization to Sensitive Data Exposure",
    "slug": "kb-support",
    "type": "plugin",
    "affected_version": "* - 1.5.88",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.88",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37890",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP GPX Maps \u003c 1.1.23 - Arbitrary File Upload",
    "slug": "wp-gpx-maps",
    "type": "plugin",
    "affected_version": "[*, 1.1.23)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.23",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-6649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6649",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Pay Counter \u003c 2.731 - PHP Object Injection",
    "slug": "post-pay-counter",
    "type": "plugin",
    "affected_version": "[*, 2.731)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.731",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-18583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18583",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hello Elementor \u003c= 3.0.0 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "hello-elementor",
    "type": "theme",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31289",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Options Editor \u003c= 1.1 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "wp-options-editor",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23797",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Square \u003c= 3.8.1 - Missing Authorization via multiple AJAX actions",
    "slug": "woocommerce-square",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35876",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MX Time Zone Clocks \u003c= 3.4 - Contributor+ Cross-Site Scripting",
    "slug": "mx-time-zone-clocks",
    "type": "plugin",
    "affected_version": "[*, 3.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24671",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CP Reservation Calendar \u003c 1.1.7 - SQL Injection",
    "slug": "cp-reservation-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-7235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7235",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mighty Addons for Elementor \u003c= 1.9.3 - Reflected Cross-Site Scripting",
    "slug": "mighty-addons",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24846",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Builder CP \u003c= 1.2.41 - Authenticated (Contributor+) SQL Injection",
    "slug": "cp-easy-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24672",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP-Members Membership \u003c= 3.4.7.3 - Missing Authorization to Settings Update",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.4.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2869",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ToolBar to Share \u003c= 2.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "toolbar-to-share",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1918",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.11.16 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.11.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54013",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyBookTable Bookstore \u003c= 3.3.3 - Cross-Site Request Forgery",
    "slug": "mybooktable",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48331",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Yougler Blogger Profile Page \u003c= v1.01 - Cross-Site Request Forgery to Settings Update",
    "slug": "yougler-blogger-profile-page",
    "type": "plugin",
    "affected_version": "* - v1.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "v1.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6062",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BaiduXZH Submit(百度熊掌号) \u003c= 1.4.6 - Reflected Cross-Site Scripting",
    "slug": "i3geek-baiduxzh",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49063",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blix \u003c= 0.9.1, Blixed \u003c= 1.0, BlixKrieg \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "blixed",
    "type": "theme",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4014",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blix \u003c= 0.9.1, Blixed \u003c= 1.0, BlixKrieg \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "blixkrieg",
    "type": "theme",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4014",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blix \u003c= 0.9.1, Blixed \u003c= 1.0, BlixKrieg \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "blix",
    "type": "theme",
    "affected_version": "* - 0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4014",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Source Control \u003c= 2.29.0 - Reflected Cross-Site Scripting",
    "slug": "image-source-control-isc",
    "type": "plugin",
    "affected_version": "* - 2.29.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.29.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22711",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category Icon \u003c= 1.0.1 - Authenticated (Author+) Arbitrary File Download",
    "slug": "category-icon",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31825",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Responsive Tabs horizontal vertical and accordion Tabs \u003c= 1.1.15 - Reflected Cross-Site Scripting",
    "slug": "responsive-horizontal-vertical-and-accordion-tabs",
    "type": "plugin",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2184",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.2 - Missing Authorization in 'startProcess' to Arbitrary Redirect via 'update_link_redirect' task",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0876",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Vimeography: Vimeo Video Gallery WordPress Plugin \u003c= 2.4.1 - Cross-Site Request Forgery",
    "slug": "vimeography",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35770",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Asgaros Forum \u003c= 2.7.0 - Insufficient Authorization to Authenticated (Admin+) Arbitrary File Upload",
    "slug": "asgaros-forum",
    "type": "plugin",
    "affected_version": "[*, 2.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5604",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "15Zine | Magazine Newspaper Blog News WordPress Theme \u003c 3.3.0 - Reflected Cross-Site Scripting",
    "slug": "15zine",
    "type": "theme",
    "affected_version": "[*, 3.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36510",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Futurio Extra \u003c= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget",
    "slug": "futurio-extra",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5646",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Builder CP \u003c= 1.2.31 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cp-easy-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2567",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Favicon My Blog \u003c= 1.0.2 - Cross-Site Request Forgery",
    "slug": "favicon-my-blog",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53722",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WCP Contact Form \u003c= 3.1.0 - Reflected Cross-Site Scripting via tab parameter",
    "slug": "wcp-contact-form",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22703",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Bootstrap Elements for Elementor \u003c= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "ultimate-bootstrap-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10329",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Basic Elements \u003c= 5.2.15 - Cross-Site Request Forgery via wpbe_save_settings",
    "slug": "wp-basic-elements",
    "type": "plugin",
    "affected_version": "* - 5.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47139",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "B Slider - Gutenberg Slider Block for WP \u003c= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "b-slider",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8676",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles \u0026 User Role Editor \u003c= 3.11.7 - Missing Authorization to Unauthenticated Media Upload",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6366",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Draw Attention \u003c= 2.0.11 - Missing Authorization to Arbitrary Post Featured Image Modification",
    "slug": "draw-attention",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2764",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Apollo13 Framework Extensions \u003c= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "apollo13-framework-extensions",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24880",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fusion Builder \u003c= 3.11.1 - Missing Authorization",
    "slug": "fusion-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39310",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Build App Online \u003c= 1.0.23 - Cross-Site Request Forgery",
    "slug": "build-app-online",
    "type": "plugin",
    "affected_version": "* - 1.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53249",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPCal.io – Easy Meeting Scheduler \u003c= 0.9.5.8 - Cross-Site Request Forgery",
    "slug": "wpcal",
    "type": "plugin",
    "affected_version": "* - 0.9.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32795",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AFI – The Easiest Integration Plugin \u003c= 1.99.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-form-integration",
    "type": "plugin",
    "affected_version": "* - 1.99.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.99.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13123",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hostel \u003c= 1.1.5.5 - Reflected Cross-Site Scripting",
    "slug": "hostel",
    "type": "plugin",
    "affected_version": "* - 1.1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31102",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "360 Product Rotation \u003c= 1.5.8 - Reflected Cross-Site Scripting",
    "slug": "360-product-rotation",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13823",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Blocks \u003c= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31077",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spider Facebook \u003c= 1.0.15 - Reflected Cross-Site Scripting",
    "slug": "spider-facebook",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46090",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AGP Font Awesome Collection \u003c= 3.2.4 - Reflected Cross-Site Scripting",
    "slug": "agp-font-awesome-collection",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30481",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting in Theme Preview",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.7",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting in Theme Preview",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.6",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting in Theme Preview",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.6",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting in Theme Preview",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.3",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting in Theme Preview",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting in Theme Preview",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.9",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Scripting in Theme Preview",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.9",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infility Global \u003c= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update",
    "slug": "infility-global",
    "type": "plugin",
    "affected_version": "* - 2.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11496",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WishList Member X \u003c= 3.25.1 - Authenticated (Subscriber+) Remote Code Execution",
    "slug": "wishlist-member-x",
    "type": "plugin",
    "affected_version": "* - 3.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37109",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "MultiParcels Shipping For WooCommerce \u003c= 1.14.12 - Authenticated(Subscriber+) SQL Injection via id",
    "slug": "multiparcels-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.14.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2843",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin \u003c= 3.1.1 - Directory Traversal",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "[*, 3.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-8606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8606",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "URLYar \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "urlyar",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10133",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ebook Store \u003c= 5.8008 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.8008",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8008",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49862",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "L Squared Hub WP \u003c= 1.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "l-squared-hub-wp-virtual-device",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51820",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Org Chart \u003c= 2.3.4 - Missing Authorization",
    "slug": "simple-org-chart",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40603",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Houzez \u003c= 4.0.4 - Missing Authorization",
    "slug": "houzez",
    "type": "theme",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53997",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Free Woocommerce Product Table View \u003c= 1.78 - Missing Authorization",
    "slug": "free-product-table-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.78",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.78",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31757",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Masteriyo - LMS \u003c= 1.7.2 - Unauthenticated Privilege Escalation",
    "slug": "learning-management-system",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-24882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24882",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Master Slider \u003c= 3.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58025",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RJ Quickcharts \u003c= 0.6.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "rj-quickcharts",
    "type": "plugin",
    "affected_version": "* - 0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31024",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Gallery – Image and Video Gallery with Thumbnails \u003c 1.2.1 - SQL Injection",
    "slug": "gallery-album",
    "type": "plugin",
    "affected_version": "[*, 1.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-14125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14125",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sermon Browser \u003c= 0.45.15 - Multiple Cross-Site Scripting",
    "slug": "sermon-browser",
    "type": "plugin",
    "affected_version": "* - 0.45.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.45.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10897",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mins To Read \u003c= 1.2.2 - Cross-Site Request Forgery  to Stored Cross-Site Scripting",
    "slug": "mins-to-read",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53765",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Page Access Restriction \u003c= 1.0.32 - Cross-Site Request Forgery",
    "slug": "simple-page-access-restriction",
    "type": "plugin",
    "affected_version": "* - 1.0.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58202",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Email Reminders \u003c= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "email-reminders",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56292",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TubePress.NET \u003c= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "tubepressnet",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11712",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CoSchool LMS \u003c= 1.4.3 - Unauthenticated PHP Object Injection",
    "slug": "coschool",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30973",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Add Multiple Marker \u003c= 1.2 - Missing Authorization Checks to Settings Update",
    "slug": "add-multiple-marker",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45081",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Salesmate Add-On for Gravity Forms \u003c= 2.0.3 - Unauthenticated SQL Injection",
    "slug": "gf-salesmate-add-on",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31551",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Cloud SAML SSO \u003c= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action",
    "slug": "cloud-sso-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 1.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7040",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Awesome Hooks \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "awesome-hooks",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23539",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobSearch \u003c= 2.5.3 - Cross-Site Request Forgery",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43930",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GetResponse Forms by Optin Cat \u003c= 2.5.7 - Reflected Cross-Site Scripting",
    "slug": "getresponse",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8740",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iMember360 3.8.012 - 3.9.001 - Missing Authorization",
    "slug": "imember360",
    "type": "plugin",
    "affected_version": "[3.8.012, 3.9.001)",
    "from_version": "3.8.012",
    "from_inclusive": true,
    "to_version": "3.9.001",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-3849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3849",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "HT Event \u003c= 1.4.6 - Reflected Cross-Site Scripting",
    "slug": "ht-event",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24624",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.6.1 - HTML File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-5738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5738",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zita Elementor Site Library \u003c= 1.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "zita-site-library",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37420",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "So-Called Air Quotes \u003c= 0.1 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "so-called-air-quotes",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2803",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP All Import Pro \u003c= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File",
    "slug": "wp-all-import-pro",
    "type": "plugin",
    "affected_version": "* - 4.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9664",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Email Artillery (MASS EMAIL) \u003c= 4.1 - Arbitrary File Upload",
    "slug": "email-artillery",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24490",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Roadmap \u003c= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-roadmap",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41128",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JupiterX Core \u003c= 4.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 4.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47475",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar and Notification \u003c= 4.0.3 - Authentication Bypass",
    "slug": "booking-calendar-and-notification",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31381",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventON \u003c= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4388",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Count per Day \u003c= 3.4 - Cross-Site Request Forgery",
    "slug": "count-per-day",
    "type": "plugin",
    "affected_version": "[*, 3.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-5533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5533",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPLMS Learning Management System for WordPress, WordPress LMS \u003c= 1.8.4.1 - Privilege Escalation",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "* - 1.8.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-10139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10139",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Search Meter \u003c= 2.13.2 - Remote Code Execution",
    "slug": "search-meter",
    "type": "plugin",
    "affected_version": "[*, 2.13.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-11548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11548",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "KB Support \u003c= 1.6.0 - Missing Authorization",
    "slug": "kb-support",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33589",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Advanced Text Widget \u003c= 2.0.1 - Cross-Site Scripting",
    "slug": "advanced-text-widget",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-4618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4618",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Captcha.eu \u003c= 1.0.60 - Reflected Cross-Site Scripting",
    "slug": "captcha-eu",
    "type": "plugin",
    "affected_version": "* - 1.0.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53579",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Pricing With Discount Rules for WooCommerce \u003c= 4.5.9 - Authenticated (Shop Manager+) Arbitrary Code Execution",
    "slug": "aco-woo-dynamic-pricing",
    "type": "plugin",
    "affected_version": "* - 4.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47588",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \u003c= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-jltma-wrapper-link Element",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6282",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Youtube Channel Pagination \u003c= 1.0 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "advanced-youtube-channel-pagination",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28693",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Multiple Addresses \u003c= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "woocommerce-multiple-addresses",
    "type": "plugin",
    "affected_version": "* - 1.0.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4335",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Inline Related Posts \u003c= 3.3.1 - Cross-Site Request Forgery",
    "slug": "intelly-related-posts",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31426",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AntiSpam for Contact Form 7 \u003c= 0.6.0 - Reflected Cross-Site Scripting",
    "slug": "cf7-antispam",
    "type": "plugin",
    "affected_version": "* - 0.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27961",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UserPro \u003c= 4.9.17 - Authentication Bypass",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "[*, 4.9.17.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.17.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-16562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16562",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPMovieLibrary \u003c= 2.1.4.8 - Reflected Cross-Site Scripting",
    "slug": "wpmovielibrary",
    "type": "plugin",
    "affected_version": "* - 2.1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13624",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directory \u0026 Listing \u003c 1.6.0 - Reflected Cross-Site Scripting",
    "slug": "bello",
    "type": "theme",
    "affected_version": "[*, 1.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 4.1.5 -  Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-31280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31280",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Arconix Shortcodes \u003c= 2.1.15 - Reflected Cross-Site Scripting",
    "slug": "arconix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24621",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Use-your-Drive | Google Drive plugin for WordPress \u003c= 3.3.1- Unauthenticated Stored Cross-Site Scripting via File Metadata",
    "slug": "use-your-drive",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7050",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subresource Integrity (SRI) Manager \u003c= 0.4.0 - Missing Authorization",
    "slug": "wp-sri",
    "type": "plugin",
    "affected_version": "* - 0.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57936",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Tools Việt Nam \u003c= 0.3.17 - Reflected Cross-Site Scripting",
    "slug": "affiliate-tools-viet-nam",
    "type": "plugin",
    "affected_version": "* - 0.3.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23759",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ketchup Restaurant Reservations \u003c= 1.0.0 - Unauthenticated SQL Injection",
    "slug": "ketchup-restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-2754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2754",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event List \u003c= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "eventlist",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6366",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Divi \u003c= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "Divi",
    "type": "theme",
    "affected_version": "* - 4.23.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.23.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6744",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App \u003c= 0.8.8.8 - Unauthenticated SQL Injection",
    "slug": "yournewsapp",
    "type": "plugin",
    "affected_version": "* - 0.8.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9200",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ND Shortcodes \u003c= 6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "nd-shortcodes",
    "type": "plugin",
    "affected_version": "* - 6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4623",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Mobile \u003c= 1.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-mobile",
    "type": "theme",
    "affected_version": "* - 1.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37949",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amazon Showcase WordPress Plugin \u003c= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "amazon-showcase-wordpress-widget",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39431",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress \u003c= 1.9.1 - Stored Cross-Site Scripting",
    "slug": "buddypress",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-1888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-1888",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51415",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Poll, Survey, Questionnaire and Voting system \u003c= 1.5.2 - Unauthenticated Blind SQL Injection",
    "slug": "polls-widget",
    "type": "plugin",
    "affected_version": "[*, 1.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24442",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.5.4 - Cross-Site Request Forgery",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34557",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lexicata \u003c= 1.0.16 - Reflected Cross-Site Scripting",
    "slug": "lexicata",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12069",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AnyComment \u003c= 0.3.4 - Open Redirect via redirect parameter",
    "slug": "anycomment",
    "type": "plugin",
    "affected_version": "[*, 0.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24838",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Replicate Post \u003c= 4.0.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-replicate-post",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2237",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Filterable Portfolio \u003c= 1.0.22 - Server-Side Request Forgery",
    "slug": "responsive-filterable-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51785",
    "auth_type": "Privileged",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP ALL Export Pro \u003c= 1.7.8 - Authenticated Remote Code Execution",
    "slug": "wp-all-export-pro",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3394",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FooGallery \u003c= 2.0.34 - Stored Cross-Site Scripting",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "[*, 2.0.35)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.35",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24357",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Random Banner \u003c 2.0 - Cross-Site Scripting",
    "slug": "random-banner",
    "type": "plugin",
    "affected_version": "[*, 2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-4847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4847",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Information Reel \u003c= 10.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "information-reel",
    "type": "plugin",
    "affected_version": "* - 10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5429",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Parallaxer \u003c= 1.00 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "parallaxer-lite-parallax-effects-on-images",
    "type": "plugin",
    "affected_version": "* - 1.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51848",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LifterLMS \u003c= 8.0.0 - Reflected Cross-Site Scripting",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "* - 8.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13619",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Database Cleaner \u003c= 3.0.3 - Reflected Cross-Site Scripting",
    "slug": "advanced-database-cleaner",
    "type": "plugin",
    "affected_version": "[*, 3.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24921",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Font Awesome 4 Menus \u003c= 4.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "font-awesome-4-menus",
    "type": "plugin",
    "affected_version": "* - 4.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cube Portfolio \u003c= 1.16.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "cubeportfolio",
    "type": "plugin",
    "affected_version": "* - 1.16.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52823",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "m1.DownloadList \u003c= 0.23 - Authenticated (Contributor+) Sensitive Information Disclosure",
    "slug": "m1downloadlist",
    "type": "plugin",
    "affected_version": "* - 0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32164",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Notification \u003c= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-notification",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13866",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Show/Hide Shortcode \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "showhide-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24687",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brilliance \u003c= 1.3.1 - Reflected Cross-Site Scripting",
    "slug": "brilliance",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28171",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shipping with Venipak for WooCommerce \u003c= 1.22.4 - Reflected Cross-Site Scripting",
    "slug": "wc-venipak-shipping",
    "type": "plugin",
    "affected_version": "* - 1.22.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24553",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Collapse-O-Matic \u003c= 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jquery-collapse-o-matic",
    "type": "plugin",
    "affected_version": "* - 1.8.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40669",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SoJ Soundslides \u003c= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "soj-soundslides",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2249",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Perelink Pro \u003c= 2.1.4 - Cross-Site Request Forgery to Settings Update",
    "slug": "perelink",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37990",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SendGrid \u003c= 1.11.8 - Authorization Bypass",
    "slug": "sendgrid-email-delivery-simplified",
    "type": "plugin",
    "affected_version": "* - 1.11.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34629",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Essential Real Estate \u003c= 5.1.8 - Cross-Site Request Forgery",
    "slug": "essential-real-estate",
    "type": "plugin",
    "affected_version": "* - 5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24698",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin \u003c= 3.71 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "real3d-flipbook-lite",
    "type": "plugin",
    "affected_version": "* - 3.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34561",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GD Rating System \u003c= 2.3 - Cross-Site Scripting",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5293",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Get The Table \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter",
    "slug": "wp-get-the-table",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6387",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inline Related Posts \u003c= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "intelly-related-posts",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47604",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nextgen Gallery \u003c= 3.59 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2744",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Recurring Payments \u003c= 2.3 - Cross-Site Scripting",
    "slug": "edd-recurring-payments",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9525",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magazine Elite \u003c= 1.2.4 - Unauthenticated Local File Inclusion",
    "slug": "magazine-elite",
    "type": "theme",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53244",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz And Survey Master \u003c= 8.0.10 - Cross-Site Request Forgery to Quiz Restoration",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26524",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Chartbeat \u003c= 2.0.7 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "chartbeat",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53250",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "World Prayer Time \u003c= 2.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "world-prayer-time",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50534",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Laposta WooCommerce \u003c= 1.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "laposta-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49434",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetTabs \u003c= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-tabs",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53984",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Spell Check \u003c= 9.12 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-spell-check",
    "type": "plugin",
    "affected_version": "* - 9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2658",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Editor by Pixo \u003c= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via download Parameter",
    "slug": "image-editor-by-pixo",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5588",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ActiveDEMAND \u003c= 0.2.27 - Missing Authorization Checks",
    "slug": "activedemand",
    "type": "plugin",
    "affected_version": "* - 0.2.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.27",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-36296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36296",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tigris Flexplatform \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tigris-flexplatform",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51819",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kevin's \u003c= 2.0.0 - Cross-Site Request Forgery",
    "slug": "kevins-plugin",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53712",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Awesome Twitter Feeds \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "awesome-twitter-feeds",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23451",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Divi Carousel Lite \u003c= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel Widgets",
    "slug": "wow-carousel-for-divi-lite",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0350",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Password Protected \u003c= 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "password-protected",
    "type": "plugin",
    "affected_version": "* - 2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0656",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPS Hide Login \u003c= 1.9.11 - Hidden Login Page Location Disclosure",
    "slug": "wps-hide-login",
    "type": "plugin",
    "affected_version": "* - 1.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.11",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-49748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49748",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Compact WP Audio Player \u003c= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "compact-wp-audio-player",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4542",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments by Startbit \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "facebook-comment-by-vivacity",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5295",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Auto Poster \u003c= 5.3.15 - Cross-Site Request Forgery",
    "slug": "social-auto-poster",
    "type": "plugin",
    "affected_version": "* - 5.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49272",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DSGVO Youtube \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dsgvo-youtube",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26982",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.5.1.8 - SQL Injection",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1002000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1002000",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Structured Content \u003c= 1.5.3 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "structured-content",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-49819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49819",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rollbar \u003c= 2.7.1 - Cross-Site Request Forgery",
    "slug": "rollbar",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32250",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Beaver Builder Addons by WPZOOM \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget",
    "slug": "wpzoom-addons-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2186",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fancier Author Box by ThematoSoup \u003c= 1.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "fancier-author-box",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3833",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xserver Migrator \u003c= 1.6.2 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "xserver-migrator",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-33913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33913",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Preloader by WordPress Monsters \u003c= 1.2.3 - Reflected Cross-Site Scripting",
    "slug": "preloader-sws",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56022",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Embedder \u003c= 1.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "video-embedder",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31458",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Faculty Staff and Student Directory Plugin – Campus Directory \u003c= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "campus-directory",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5532",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Connector to CiviCRM with CiviMcRestFace \u003c= 1.0.8 - Reflected Cross-Site Scripting",
    "slug": "connector-civicrm-mcrestface",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32551",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support Board for WordPress \u003c= 1.2.3 - Cross-Site Scripting",
    "slug": "supportboard",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-18373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-18373",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 4.5.9 - Authenticated Arbitrary File Download",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 4.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2222",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "TPG Redirect \u003c= 1.0.7 - Cross-Site Request Forgery",
    "slug": "tpg-redirect",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32093",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Travelfic Toolkit \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "travelfic-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39585",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export All Post Meta \u003c= 1.2.1 - Missing Authorization",
    "slug": "export-all-post-meta",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31856",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Active Directory Integration / LDAP Integration \u003c= 4.1.10 - LDAP Passback",
    "slug": "ldap-login-for-intranet-sites",
    "type": "plugin",
    "affected_version": "* - 4.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.10",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-4506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4506",
    "auth_type": "Privileged",
    "cvss_score": 2.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AlT Report \u003c= 1.12.0 - Reflected Cross-Site Scripting",
    "slug": "alt-report",
    "type": "plugin",
    "affected_version": "* - 1.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23432",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Local Pickup for WooCommerce \u003c= 1.6.2 - Missing Authorization",
    "slug": "advanced-local-pickup-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31283",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Donation Forms by Charitable – Donations Plugin \u0026 Fundraising Platform for WordPress \u003c= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "* - 1.8.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1.14",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8791",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light \u003c= 2.4.37 - Unauthenticated Privilege Escalation",
    "slug": "excel-like-price-change-for-woocommerce-and-wp-e-commerce-light",
    "type": "plugin",
    "affected_version": "* - 2.4.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.37",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48129",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Breeze \u003c= 2.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "breeze",
    "type": "plugin",
    "affected_version": "* - 2.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50431",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schema \u0026 Structured Data for WP \u0026 AMP \u003c= 1.35 - Unauthenticated Sensitive Information Exposure",
    "slug": "schema-and-structured-data-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49683",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Waymark \u003c= 1.5.2 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "waymark",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32487",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Jobs \u003c 1.7 - Cross-Site Scripting",
    "slug": "wp-jobs",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-14751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14751",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Connections Business Directory \u003c= 9.6 - Authenticated CSV Injection",
    "slug": "connections",
    "type": "plugin",
    "affected_version": "* - 9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36503",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Taxonomy Import \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "wp-taxonomy-import",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2669",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Chessboard \u003c= 3.07.00 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embed-chessboard",
    "type": "plugin",
    "affected_version": "* - 3.07.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.07.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32177",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Active Products Tables for WooCommerce \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1916",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerFolio \u003c= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "portfolio-elementor",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57932",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login with phone number \u003c= 1.7.34 - Insecure Password Reset Mechanism",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "* - 1.7.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6125",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MyCurator Content Curation \u003c= 3.78 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "mycurator",
    "type": "plugin",
    "affected_version": "* - 3.78",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.78",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51668",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate WordPress Auction Plugin \u003c= 4.2.9 - Missing Authorization to Arbitrary Post Deletion",
    "slug": "ultimate-auction",
    "type": "plugin",
    "affected_version": "* - 4.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0958",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Cool Tag Cloud \u003c= 2.25 - Contributor+ Stored Cross-Site Scripting",
    "slug": "cool-tag-cloud",
    "type": "plugin",
    "affected_version": "* - 2.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24682",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Contact Us Form \u003c= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ai-contact-us",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24386",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery \u003c= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode",
    "slug": "new-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1896",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gs-books-showcase",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11766",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bstone Demo Importer \u003c= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "bstone-demo-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50481",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.6.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-38708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38708",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate WP Mail \u003c= 1.3.4 - Cross-Site Request Forgery",
    "slug": "ultimate-wp-mail",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47466",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Travel Map \u003c= 0.1 - Cross-Site Request Forgery",
    "slug": "simple-travel-map",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53715",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.47.0 - Reflected Cross-Site Scripting via 's'",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.47.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.47.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3731",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZoomSounds - WordPress Wave Audio Player with Playlist \u003c= 6.45 - Directory Traversal",
    "slug": "dzs-zoomsounds",
    "type": "plugin",
    "affected_version": "* - 6.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.45",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39316",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Polls CP \u003c 1.0.1 - Cross-Site Scripting",
    "slug": "cp-polls",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-10395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10395",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EasyMe Connect \u003c= 3.0.3 - Cross-Site Request Forgery",
    "slug": "easyme-connect",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47609",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cinza Grid \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Skin Content Field",
    "slug": "cinza-grid",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11824",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Templates \u003c= 1.3 - HTML Injection",
    "slug": "email-templates",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-25150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25150",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bosa Elementor Addons and Templates for WooCommerce \u003c= 1.0.12 - Missing Authorization",
    "slug": "bosa-elementor-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35724",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple HTML Sitemap \u003c= 2.2 - Reflected Cross-Site Scripting via id",
    "slug": "wp-simple-html-sitemap",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46627",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "10Web Map Builder for Google Maps \u003c= 1.0.72 - Unauthenticated SQL Injection via Multiple Parameters",
    "slug": "wd-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.0.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.72",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-0037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0037",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7044",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tourfic \u003c= 2.11.15 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "tourfic",
    "type": "plugin",
    "affected_version": "* - 2.11.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-29135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29135",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sweet Energy Efficiency \u003c= 1.0.6 - Cross-Site Request Forgery",
    "slug": "sweet-energy-efficiency",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58262",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AcyMailing SMTP Newsletter \u003c 7.5.0 - Open Redirect",
    "slug": "acymailing",
    "type": "plugin",
    "affected_version": "[*, 7.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24288",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quietly Insights \u003c= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "quietly-insights",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54378",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pixel Cat – Conversion Pixel Manager \u003c= 3.0.5 - Reflected Cross-Site Scripting",
    "slug": "facebook-conversion-pixel",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8544",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "guzzlehttp/psr7 \u003c= 1.84 and 2.0.0-2.1.0 - Improper Input Validation",
    "slug": "insert-special-characters",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-24775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-24775",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.6 - Missing Authorization",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47361",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Frontend File Manager \u003c= 21.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "* - 21.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3125",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Schedulicity - Easy Online Scheduling \u003c= 2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "schedulicity-online-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 2.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0491",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetProductGallery \u003c= 2.2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-woo-product-gallery",
    "type": "plugin",
    "affected_version": "* - 2.2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54749",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gestion de tarifs \u003c= 1.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "gestion-tarifs",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7662",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "TOCHAT.BE \u003c= 1.3.4 - Cross-Site Request Forgery",
    "slug": "tochat-be",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57915",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gallery PhotoBlocks \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "photoblocks-grid-gallery",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58610",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event post \u003c= 5.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "event-post",
    "type": "plugin",
    "affected_version": "* - 5.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49179",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coronavirus (COVID-19) Notice Message \u003c= 1.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "coronavirus-covid-19-notice-message",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0629",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy!Appointments \u003c= 1.3.2 - Information Disclosure",
    "slug": "easyappointments",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14936",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Flipkart Importer \u003c= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-flipkart-importer",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54432",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram Engage \u003c= 3.1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 3.1.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13486",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eewee admin custom \u003c= 1.8.2.4 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "eewee-admincustom",
    "type": "plugin",
    "affected_version": "* - 1.8.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54248",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Job Portal \u003c= 2.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28534",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom TinyMCE Shortcode Button \u003c= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "custom-tinymce-shortcode-button",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1217",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Login with phone number \u003c= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "* - 1.7.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.49",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6482",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Roles at Registration \u003c= 0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-roles-at-registration",
    "type": "plugin",
    "affected_version": "* - 0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27609",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 1.9.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24455",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Distance Based Shipping Calculator \u003c= 2.0.22 - Missing Authorization",
    "slug": "distance-based-shipping-calculator",
    "type": "plugin",
    "affected_version": "* - 2.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26765",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPLMS \u003c= 1.9.9 - Unauthenticated Arbitrary File Upload",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56046",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ninja Tables Pro \u003c= 5.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ninja-tables-pro",
    "type": "plugin",
    "affected_version": "* - 5.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39534",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management \u003c= 93.2.0 - Authenticated (Support staff+) SQL Injection",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 93.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "93.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49898",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Product Enquiry for WooCommerce \u003c= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry_detail.php",
    "slug": "enquiry-quotation-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.33.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.33.33",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8922",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Meks Flexible Shortcodes \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meks-flexible-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49855",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Apollo \u003c= 3.6.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "lbg-audio7_html5_full_width_sticky_pro",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32245",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Betheme \u003c= 26.6.2 - Missing Authorization to Theme Settings Update",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 26.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45352",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Binary MLM Plan \u003c= 3.0 - Unauthenticated Limited Privilege Escalation",
    "slug": "binary-mlm-plan",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10038",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Drive Folder Embedder \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameter",
    "slug": "drive-folder-embeder",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6546",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MD Custom content after or before of post \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "md-custom-content",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23463",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Health Check \u0026 Troubleshooting \u003c= 1.5.1 - Cross-Site Request Forgery via health_check_troubleshoot_get_captures",
    "slug": "health-check",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47161",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Bold Page Builder \u003c= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7100",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UiPress lite | Effortless custom dashboards, admin themes and pages \u003c= 3.5.04 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "uipress-lite",
    "type": "plugin",
    "affected_version": "* - 3.5.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.04",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1309",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SW Product Bundles \u003c= 2.0.15 - Missing Authorization",
    "slug": "sw-product-bundles",
    "type": "plugin",
    "affected_version": "* - 2.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36519",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.13",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.12",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.10",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.8",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.36",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.31",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.17",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.6",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.2 - 6.2.3",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.3 - 6.3.2",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.39",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.8",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.4 - 6.4.2",
    "from_version": "6.4",
    "from_inclusive": true,
    "to_version": "6.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.32",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.30",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.27",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.23",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.24",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.20",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.14",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.1 - 6.1.4",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.27",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.19",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.4.3 - Authenticated(Administrator+) PHP File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.16",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-14028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14028",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LTL Freight Quotes – Worldwide Express Edition \u003c= 5.0.20 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-worldwide-express-edition",
    "type": "plugin",
    "affected_version": "* - 5.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24664",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ad Inserter \u003c= 2.7.25 - Authenticated (Admin+) PHP Object Injection",
    "slug": "ad-inserter",
    "type": "plugin",
    "affected_version": "* - 2.7.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1549",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lifeline Donation \u003c= 1.2.6 - Authentication Bypass",
    "slug": "lifeline-donation",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5432",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Library Viewer \u003c= 2.0.6 - Open Redirect via 'redirect_to'",
    "slug": "library-viewer",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32101",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Revi.io \u003c= 5.7.3 - Reflected Cross-Site Scripting",
    "slug": "revi-io-customer-and-product-reviews",
    "type": "plugin",
    "affected_version": "* - 5.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54299",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thumbs Rating \u003c= 5.0.0 - Race Condition",
    "slug": "thumbs-rating",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45809",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "jCarousel \u003c= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "jcarousel-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54437",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lenxel Core \u003c= 1.2.5 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "lenxel-core",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-53790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARI Fancy Lightbox \u003c= 1.3.17 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ari-fancy-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.3.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47310",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sassy Social Share 3.3.23 - Object Injection",
    "slug": "sassy-social-share",
    "type": "plugin",
    "affected_version": "3.3.23",
    "from_version": "3.3.23",
    "from_inclusive": true,
    "to_version": "3.3.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39321",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Import – Ultimate CSV XML Importer for WordPress \u003c= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 7.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10058",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Realteo \u003c= 1.2.3 - Reflected Cross-Site Scripting",
    "slug": "realteo",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24237",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Online Order for Clover \u003c= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "clover-online-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29115",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Content Creator \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "bulk-content-creator",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27311",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Foodbakery \u003c= 4.8 - Reflected Cross-Site Scripting",
    "slug": "wp-foodbakery",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13010",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ibtana – Ecommerce Product Addons \u003c= 0.4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ibtana-ecommerce-product-addons",
    "type": "plugin",
    "affected_version": "* - 0.4.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58786",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems Attribute",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5418",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPide \u003c= 2.6 - Authenticated (Administrator+) Arbitrary File Read",
    "slug": "wpide",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-35235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-35235",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple add pages or posts \u003c= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-add-pages-or-posts",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13850",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by Ays \u003c= 5.7.0 - Authenticated (Administrator+) HTML Injection",
    "slug": "gallery-photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 5.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-37442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37442",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Waiting List \u003c= 2.6.0 - Cross-Site Request forgery via 'save_mail_status'",
    "slug": "yith-woocommerce-waiting-list",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36506",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form \u0026 SMTP Plugin for WordPress by PirateForms \u003c= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pirate-forms",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11272",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CashBill.pl - Płatności WooCommerce \u003c= 3.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cashbill-payment-method",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53455",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Live Chat from ClickDesk – Live Chat – Help Desk Plugin for Websites \u003c= 2.0 - Cross-Site Scripting",
    "slug": "clickdesk-live-support-chat-plugin",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-5181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5181",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPSchoolPress \u003c= 2.2.4 - Authenticated(Teacher+) SQL Injection via ClassID",
    "slug": "wpschoolpress",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4776",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SV Proven Expert \u003c= 2.0.06 - Cross-Site Request Forgery",
    "slug": "sv-provenexpert",
    "type": "plugin",
    "affected_version": "* - 2.0.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58010",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Login With Ajax \u003c= 4.1 - Missing Authorization",
    "slug": "login-with-ajax",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49859",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function",
    "slug": "rccp-free",
    "type": "plugin",
    "affected_version": "1.5 - 1.6.8",
    "from_version": "1.5",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7955",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u0026 WordPress MU \u003c 2.8.1 - Username Enumeration",
    "slug": "wpmu",
    "type": "core",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-2336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2336",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u0026 WordPress MU \u003c 2.8.1 - Username Enumeration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-2336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2336",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Meteor Website Speed Optimization Addon \u003c= 3.4.3 - Unauthenticated Full Path Disclosure",
    "slug": "wp-meteor",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6553",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com \u003c= 3.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "shoutcast-and-icecast-html5-web-radio-player-by-yesstreaming-com",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23854",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Master \u003c= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusion",
    "slug": "ajax-filter-posts",
    "type": "plugin",
    "affected_version": "* - 3.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11642",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[6.1, 6.1.2)",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.3, 4.3.31)",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.31",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.4, 4.4.30)",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.30",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.5, 4.5.29)",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.29",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.2, 5.2.18)",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.3, 5.3.15)",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.5, 5.5.12)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.7, 5.7.9)",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.8, 5.8.7)",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.1.38)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.38",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.6, 4.6.26)",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.26",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.8, 4.8.22)",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.22",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.9, 4.9.23)",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.23",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.9, 5.9.6)",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[6.0, 6.0.4)",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.4, 5.4.13)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.7, 4.7.26)",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.26",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.0, 5.0.19)",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.1, 5.1.16)",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[6.2, 6.2.1)",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.2, 4.2.35)",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.35",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.2.1 - Directory Traversal",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.6, 5.6.11)",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Publish to Schedule \u003c= 4.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "publish-to-schedule",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26519",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XT Ajax Add To Cart for WooCommerce \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "xt-woo-ajax-add-to-cart",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8716",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 2.81 - Authenticated Cross-Site Scripting",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "[*, 2.82)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.82",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-11731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11731",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Option Tree \u003c= 2.7.2 - Object Injection Bypass",
    "slug": "option-tree",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15321",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP GDPR \u003c= 2.1.1 - Missing Authorization Checks",
    "slug": "wp-gdpr-core",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36697",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Widgetize Pages Light \u003c= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "widgetize-pages-light",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30995",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Delivery Date for WooCommerce \u003c= 3.20.0 - Reflected Cross-Site Scripting via 'orddd_lite_custom_startdate' and 'orddd_lite_custom_enddate'",
    "slug": "order-delivery-date-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41874",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magic Action Box \u003c= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "magic-action-box",
    "type": "plugin",
    "affected_version": "* - 2.17.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5231",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cards \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "wp-cards",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Alma – Pay in installments or later for WooCommerce \u003c= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "alma-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50369",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dropdown and scrollable Text \u003c= 2.0 Reflected Cross-Site Scripting",
    "slug": "dropdown-and-scrollable-text",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38353",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReDi Restaurant Reservation \u003c= 21.0307 - Stored Cross-Site Scripting",
    "slug": "redi-restaurant-reservation",
    "type": "plugin",
    "affected_version": "* - 21.0307",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.0307",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24299",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cakifo 1.0 - 1.6.1 - Cross-Site Scripting",
    "slug": "cakifo",
    "type": "theme",
    "affected_version": "1.0 - 1.6.1",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-3903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3903",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiveSync for WordPress \u003c= 1.0 - Cross-Site Request Forgery to Arbitrary Settings Update",
    "slug": "livesync",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1712",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Powie's pLinks PagePeeker \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "plinks",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23641",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jazz Popups \u003c= 1.8.7 - Reflected Cross-Site Scripting via 'wpjazzpopup_switchonoff'",
    "slug": "jazz-popups",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32965",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.0 - 1.0.6",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6742",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.1 - 1.1.1",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6742",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.3 - 1.3.1",
    "from_version": "1.3",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6742",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.4 - 1.4.4",
    "from_version": "1.4",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6742",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.6 - 1.6.4",
    "from_version": "1.6",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6742",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.2 - 1.2.4",
    "from_version": "1.2",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6742",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.5",
    "from_version": "1.5",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6742",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.7 - 1.7.3",
    "from_version": "1.7",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6742",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "0.0 - 0.0.13",
    "from_version": "0.0",
    "from_inclusive": true,
    "to_version": "0.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6742",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SoundSt SEO Search \u003c= 1.2.3 - Reflected Cross-Site Scripting",
    "slug": "soundst-seo-search",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49058",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.3.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2298",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Watu Quiz \u003c= 3.4.1 - Sensitive Information Disclosure",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0872",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan \u003c= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table Truncation",
    "slug": "antihacker",
    "type": "plugin",
    "affected_version": "* - 4.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1861",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier \u003c= 2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Clocking In/Out",
    "slug": "aio-time-clock-lite",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6833",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ai Image Alt Text Generator for WP \u003c= 1.1.5 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "ai-image-alt-text-generator-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32228",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Theme Blvd Responsive Google Maps \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "theme-blvd-responsive-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22698",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AP Custom Testimonial \u003c= 1.4.7 - SQL Injection",
    "slug": "ap-custom-testimonial",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23911",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Maspik \u003c= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log Export",
    "slug": "contact-forms-anti-spam",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9979",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor \u003c= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3245",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Track The Click \u003c= 0.3.11 - Authenticated (Author+) SQL Injection via 'stats' REST Endpoint",
    "slug": "track-the-click",
    "type": "plugin",
    "affected_version": "* - 0.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5041",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Right Click Disable OR Ban \u003c= 1.1.17 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "right-click-disable-or-ban",
    "type": "plugin",
    "affected_version": "* - 1.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39548",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARI Stream Quiz \u003c= 1.3.2 - Authenticated(Contributor+) Content Injection",
    "slug": "ari-stream-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47513",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rockhoist Badges \u003c= 1.2.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "rockhoist-badges",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Engine \u003c= 2.1.4 - Authenticated (Editor+) Server-Side Request Forgery",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29090",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chative Live chat and Chatbot \u003c= 1.1 - Cross-Site Request Forgery via add_chative_widget_action Function",
    "slug": "chative-live-chat-and-chatbot",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12541",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "MainWP Boilerplate Extension \u003c= 4.1 - Missing Authorization to Plugin Settings Change",
    "slug": "boilerplate-extension",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23745",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Analytify \u003c= 5.5.0 - Missing Authorization",
    "slug": "wp-analytify",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26773",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple File List \u003c= 4.4.12 - Cross-Site Request Forgery to Page Creation",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "* - 4.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3208",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Directory Listings WordPress plugin – uListing \u003c= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1657",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Motors \u003c= 1.4.71 - Unauthenticated Local File Inclusion",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.71",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32654",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Export WP Page to Static HTML/CSS \u003c= 2.1.9 - Cross-Site Request Forgery via Multiple AJAX Actions",
    "slug": "export-wp-page-to-static-html",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31077",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI ChatBot for WordPress – WPBot \u003c= 6.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 6.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0329",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZM Ajax Login \u0026 Register \u003c= 2.0.2 - Authentication Bypass",
    "slug": "zm-ajax-login-register",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2027",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page View Count 2.8.0 - 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update",
    "slug": "page-views-count",
    "type": "plugin",
    "affected_version": "2.8.0 - 2.8.4",
    "from_version": "2.8.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2816",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Filebird \u003c= 5.1.4 - Missing Authorization via resAdminPermissionsCheck",
    "slug": "filebird",
    "type": "plugin",
    "affected_version": "* - 5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25966",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Materialis Companion \u003c= 1.3.41 - Authenticated (Contributor+) Store Cross-Site Scripting via materialis_contact_form Shortcode",
    "slug": "materialis-companion",
    "type": "plugin",
    "affected_version": "* - 1.3.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4707",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Protector \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "image-protector",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2026",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adminer \u003c= 1.4.5 - Security Bypass to Database Login",
    "slug": "adminer",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-20066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20066",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate 410 Gone Status Code \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-410",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3677",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print Invoice \u0026 Delivery Notes for WooCommerce \u003c= 4.7.1 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-delivery-notes",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0479",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.3.1 - Cross-Site Request Forgery via Multiple Functions",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33314",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Call me Now \u003c= 1.0.5 - Cross-Site Request Forgery",
    "slug": "call-me-now",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23745",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1038",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "SMS Alert Order Notifications – WooCommerce \u003c= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode",
    "slug": "sms-alert",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3878",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pet Manager \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pet-manager",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3918",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Squirrly SEO - Advanced Pack \u003c= 2.3.8 - Authenticated(Administrator+) SQL Injection",
    "slug": "squirrly-seo-pack",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50854",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "XO Slider \u003c= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xo-liteslider",
    "type": "plugin",
    "affected_version": "* - 3.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8324",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Starter Templates — Elementor, WordPress \u0026 Beaver Builder Templates \u003c= 3.1.20 - Cross-Site Request Forgery in add_to_favorite",
    "slug": "astra-sites",
    "type": "plugin",
    "affected_version": "* - 3.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46851",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Social Share \u003c= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-social-share",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37551",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetPopup \u003c= 2.0.11 - Missing Authorization",
    "slug": "jet-popup",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26944",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.1 - Missing Authorization via multiple functions",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6007",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "oik \u003c= 4.15.2 - Reflected Cross-Site Scripting",
    "slug": "oik",
    "type": "plugin",
    "affected_version": "* - 4.15.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54670",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tweet Blender \u003c= 4.0.1 - Cross-Site Scripting",
    "slug": "tweet-blender",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-6342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6342",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11816",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WoodMart \u003c= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 8.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6743",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Header Images \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "custom-header-images",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46636",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Curated Search \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "curated-search",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23502",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AcuGIS Leaflet Maps \u003c= 5.1.1.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "mapfig-premium-leaflet-map-maker",
    "type": "plugin",
    "affected_version": "* - 5.1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27278",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SV100 Companion \u003c= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Update",
    "slug": "sv100-companion",
    "type": "plugin",
    "affected_version": "* - 2.0.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.02",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12155",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Login as User or Customer \u003c= 3.2 - Privilege Escalation",
    "slug": "login-as-customer-or-user",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4305",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Hotel Booking \u003c= 2.1.0 - Unauthenticated SQL Injection",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3605",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "MasterStudy LMS WordPress Plugin – for Online Courses and Education \u003c= 3.3.8 - Missing Authorization",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3942",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Royal Elementor Addons and Template \u003c= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1001",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9059",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.2.3 \u0026 WordPress MU \u003c 1.2.5a - SQL Injection",
    "slug": "wpmu",
    "type": "core",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2007-4894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4894",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.2.3 \u0026 WordPress MU \u003c 1.2.5a - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2007-4894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4894",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Recall \u003c= 16.26.11 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9771",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Easy Post Types \u003c= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "easy-post-types",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10079",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 1.5.2 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 1.5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2005-2612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2005-2612",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ebook Downloader \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ebook-downloader",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31894",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mime Types Extended \u003c= 0.11 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "mime-types-extended",
    "type": "plugin",
    "affected_version": "0.11",
    "from_version": "0.11",
    "from_inclusive": true,
    "to_version": "0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4759",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Gift Cards for WooCommerce \u003c= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Function",
    "slug": "woo-gift-cards-lite",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5103",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Demo Importer Plus \u003c= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "demo-importer-plus",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9172",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soledad \u003c= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout'",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8142",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Store Kit Elementor Addons \u003c= 2.4.0 - Unauthenticated PHP Object Injection",
    "slug": "ultimate-store-kit",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39588",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Team Builder For WPBakery Page Builder(Formerly Visual Composer) \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "team-builder-for-wpbakery-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13591",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Call Now PHT Blog \u003c= 2.4.1 - Cross-Site Request Forgery",
    "slug": "call-now-coccoc-pht-blog",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46492",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSS Filter \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "rss-filter",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26562",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF 2 Post \u003c= 2.4.0 - Authenticated (Subscriber+) Remote Code Execution",
    "slug": "pdf2post",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32583",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced iFrame \u003c= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 2023.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2023.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4775",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calendar_plugin \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "calendar-plugin",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34667",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.15",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.7",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.6",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.5",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.17",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.14",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.14",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.11",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.2",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.1",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 -  Arbitrary Page Modification",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.17",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1001000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1001000",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
  },
  {
    "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles \u0026 User Role Editor \u003c= 3.11.8 - Authentication Bypass",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6695",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MF Gig Calendar \u003c=1.2.1 - Authenticated(Contributor+) SQL Injection",
    "slug": "mf-gig-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-50842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50842",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Google Map Plugin \u003c= 3.1.1 - Cross-Site Scripting",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "[*, 3.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10878",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Social Bookmarking \u003c= 3.6 - Cross-Site Request Forgery",
    "slug": "wp-social-bookmarking",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39422",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HotStar – Multi-Purpose Business Theme \u003c= 1.4 - Unauthenticated PHP Object Injection",
    "slug": "hotstar",
    "type": "theme",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31069",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Uncode Core \u003c= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias",
    "slug": "uncode-core",
    "type": "plugin",
    "affected_version": "* - 2.9.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13689",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "RSVP and Event Management \u003c= 2.7.13 - Missing Authorization",
    "slug": "rsvp",
    "type": "plugin",
    "affected_version": "* - 2.7.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12711",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Addons, Widgets and Enhancements – Stax \u003c= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stax-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3064",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.974",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.974",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3887",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Tools \u003c= 3.42 - Missing Authorization to Select Plugin Installation",
    "slug": "wptools",
    "type": "plugin",
    "affected_version": "* - 3.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3881",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Ads.txt Admin \u003c= 1.3 - Cross-Site Request Forgery",
    "slug": "ads-txt-admin",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32448",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slider \u0026 Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel \u003c= 3.2.1- Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "depicter",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4633",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Live Chat Support Pro \u003c= 8.0.06 - Remote Code Execution via unrestricted file upload",
    "slug": "wp-live-chat-support-pro",
    "type": "plugin",
    "affected_version": "* - 8.0.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.06",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-12426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12426",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.1.1 - Denial of Service",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2011-4957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4957",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "BlockWheels \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blockwheels",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Music Player for Elementor \u003c= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter",
    "slug": "music-player-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5340",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.93 - Cross-Site Request Forgery",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34373",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.9.5 - Reflected Cross-Site Scripting",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35718",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NEX-Forms \u003c= 8.7.15 - Authenticated (Admin+) SQL Injection",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.7.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.7.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10862",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Jazz Popups \u003c= 1.8.7 - Cross-Site Request Forgery",
    "slug": "jazz-popups",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32966",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Editorial Calendar \u003c= 3.7.12 - Authenticated (Contributor+) Insecure Direct Object Reference",
    "slug": "editorial-calendar",
    "type": "plugin",
    "affected_version": "* - 3.7.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36520",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Yoo Slider plugin \u003c= 2.0.0 - Cross-Site Request Forgery",
    "slug": "yoo-slider",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27846",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Page Builder \u003c= 1.2.3 - Insecure Default to Unauthorized Page Editing",
    "slug": "wp-pagebuilder",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24207",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Category Icon \u003c= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "category-icon",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8915",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rank Math SEO \u003c= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.40",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-11515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11515",
    "auth_type": "Unauth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H"
  },
  {
    "title": "BNE Gallery Extended \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode",
    "slug": "bne-gallery-extended",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11119",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Register Profile With Shortcode \u003c= 3.6.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wp-register-profile-with-shortcode",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4593",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced File Manager \u003c= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "file-manager-advanced",
    "type": "plugin",
    "affected_version": "* - 5.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8126",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Podcast Feed Player Widget and Shortcode \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "podcast-feed-player-widget",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53300",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Circle Image Slider With Lightbox 1.0 - Cross-Site Request Forgery",
    "slug": "circle-image-slider-with-lightbox",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10130",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LadiApp \u003c= 4.4 - Missing Authorization via ladiflow_save_hook()",
    "slug": "ladipage",
    "type": "plugin",
    "affected_version": "4.3",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4626",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 5.2.1.0 - Authentication Bypass",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2499",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Awesome Filterable Portfolio \u003c= 1.9.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "awesome-filterable-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40193",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) \u003c= 1.1.8 - Insecure Direct Object Reference to Sensitive Information Exposure via UA_Template Shortcode",
    "slug": "ultraaddons-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10696",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetWooBuilder \u003c= 2.1.18 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "jet-woo-builder",
    "type": "plugin",
    "affected_version": "* - 2.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31016",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Download Manager \u003c 2.5.9 - Stored Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 2.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-7319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7319",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega \u003c= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38706",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Gravityforms \u003c= 2.4.8 - Information Exposure",
    "slug": "gravityforms",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-13764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13764",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Custom Field For WP Job Manager \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "custom-field-for-wp-job-manager",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37980",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC MyParcel Belgium \u003c= 4.5.5-beta - Reflected Cross-Site Scripting",
    "slug": "wc-myparcel-belgium",
    "type": "plugin",
    "affected_version": "[*, 4.5.5-beta]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.5-beta",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48279",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor Addons and Templates \u003c= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3614",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anti-Malware Security and Brute-Force Firewall \u003c= 4.21.96 - Unauthenticated Remote Code Execution",
    "slug": "gotmls",
    "type": "plugin",
    "affected_version": "* - 4.21.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21.96",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-22144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22144",
    "auth_type": "Unauth",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "AI ChatBot \u003c= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5241",
    "auth_type": "Auth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
  },
  {
    "title": "AI ChatBot \u003c= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "4.9.2",
    "from_version": "4.9.2",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5241",
    "auth_type": "Auth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
  },
  {
    "title": "SEO Blogger to WordPress Migration using 301 Redirection \u003c= 0.4.8 - Reflected Cross-Site Scripting",
    "slug": "seo-blogger-to-wordpress-301-redirector",
    "type": "plugin",
    "affected_version": "* - 0.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13422",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unique UX \u003c= 0.9.2 - Reflected Cross-Site Scripting",
    "slug": "unique-ux",
    "type": "plugin",
    "affected_version": "* - 0.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23625",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advance WP Query Search Filter \u003c= 1.0.10 - Reflected Cross-Site Scripting",
    "slug": "advance-wp-query-search-filter",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26743",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theasys \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "theasys",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25144",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Store Toolkit for WooCommerce \u003c= 2.3.1 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-store-toolkit",
    "type": "plugin",
    "affected_version": "[*, 2.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25077",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – ABF Freight Edition \u003c= 3.3.7 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-abf-freight-edition",
    "type": "plugin",
    "affected_version": "* - 3.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13485",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Enter Addons \u003c= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "enteraddons",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47625",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JK Html To Pdf \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "jk-html-to-pdf",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: KingComposer \u003c 2.9.4 - Authorization Bypass due to Improper Access Control",
    "slug": "kingcomposer",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36700",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS Pro \u003c= 2.7.0 - Missing Authorization to Privilege Escalation",
    "slug": "tutor-pro",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4351",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz Maker \u003c= 6.4.9.4 - Reflected Cross-Site Scripting",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.4.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6166",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Content XMLRPC \u003c= 1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "post-content-xmlrpc",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24629",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ImageMapper \u003c= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page/Post Deletion via imgmap_delete_area_ajax",
    "slug": "imagemapper",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5506",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Booking.com Banner Creator \u003c= 1.4.2 - Cross-Site Scripting",
    "slug": "bookingcom-banner-creator",
    "type": "plugin",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24646",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smash Balloon Instagram Feed \u003c= 6.9.0 (Free) \u0026 \u003c= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute",
    "slug": "instagram-feed",
    "type": "plugin",
    "affected_version": "* - 6.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4583",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smash Balloon Instagram Feed \u003c= 6.9.0 (Free) \u0026 \u003c= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute",
    "slug": "instagram-feed-pro",
    "type": "plugin",
    "affected_version": "* - 6.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4583",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-HideThat \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-hide-that",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54415",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 2.8.4 - Reflected Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-8426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8426",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bounce Handler MailPoet 3 \u003c= 1.3.21 - Reflected Cross-Site Scripting",
    "slug": "bounce-handler-mailpoet",
    "type": "plugin",
    "affected_version": "* - 1.3.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9938",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ACF Photo Gallery Field \u003c= 1.7.4 - Reflected Cross-Site Scripting",
    "slug": "navz-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24909",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kiwiz - Certification de facturation - Woocommerce \u003c= 2.1.3 - Unauthenticated Arbitrary File Download",
    "slug": "woocommerce-gateway-certification-de-facture-et-gestion-de-pdf-kiwiz",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2180",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Christmas Panda \u003c= 1.0.4 - Cross-Site Request Forgery",
    "slug": "christmas-panda",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30842",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HB AUDIO GALLERY \u003c= 3.0 - Unauthenticated Arbitrary File Upload",
    "slug": "hb-audio-gallery",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-51790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51790",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Revive Adserver \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-revive-adserver",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12461",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Checker \u003c= 1.10.8 - Cross-Site Scripting",
    "slug": "broken-link-checker",
    "type": "plugin",
    "affected_version": "[*, 1.10.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5057",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Biteship \u003c= 2.2.24 - Reflected Cross-Site Scripting via biteship_error and biteship_message",
    "slug": "biteship",
    "type": "plugin",
    "affected_version": "* - 2.2.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24866",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exit Popups \u0026 Onsite Retargeting by OptiMonk \u003c= 2.0.4 - Cross-Site Request Forgery",
    "slug": "exit-intent-popups-by-optimonk",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37891",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form 7 - Repeatable Fields \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode",
    "slug": "cf7-repeatable-fields",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10180",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Nav Archives \u003c= 2.1.3 - Cross-Site Request Forgery to Settings Update",
    "slug": "simple-nav-archives",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8398",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SKT Addons for Elementor \u003c= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30812",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pray For Me \u003c= 1.0.4 - Cross-Site Request Forgery to Settings Update",
    "slug": "pray-for-me",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3965",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Download Manager \u003c= 3.2.21 - Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "[*, 3.2.22)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.22",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24969",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGlobus Translate Options \u003c= 2.1.0 - Reflected Cross-Site Scripting via page",
    "slug": "wpglobus-translate-options",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25711",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Function",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0968",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AEC Kiosque \u003c= 1.9.3 - Reflected Cross-Site Scripting",
    "slug": "aec-kiosque",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30902",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP To Do \u003c= 1.3.0 - Cross-Site Request Forgery via wptodo_manage()",
    "slug": "wp-todo",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3945",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CBX Currency Converter \u003c= 3.0.3 - Cross-Site Request Forgery leading to Plugin Settings Leakage/Changes",
    "slug": "cbcurrencyconverter",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28747",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Amazonify \u003c= 0.8.1 - Cross-Site Request Forgery to Amazon Tracking ID Update",
    "slug": "amazonify",
    "type": "plugin",
    "affected_version": "* - 0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5818",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Related Posts via Categories \u003c= 2.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "related-posts-via-categories",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30602",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "One Click Order Re-Order \u003c= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "one-click-order-reorder",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5641",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sassy Social Share \u003c= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "sassy-social-share",
    "type": "plugin",
    "affected_version": "* - 3.3.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2159",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress \u003c= 3.4.27 - Cross-Site Request Forgery to Plugin Installation",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.4.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36174",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Post Duplicator \u003c= 1.0.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "easy-post-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32567",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Memberpress \u003c= 1.11.24 - Reflected Cross-Site Scripting via message and error",
    "slug": "memberpress",
    "type": "plugin",
    "affected_version": "* - 1.11.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1412",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder – Create highly converting, mobile friendly marketing popups \u003c= 4.3.1 - Missing Authorization and Nonce Exposure",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6696",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Blue Wrench Video Widget \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "blue-wrench-videos-widget",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23809",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Marketplace \u003c= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30433",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Namaste! LMS \u003c= 2.6.2 - Authenticated (Student+) Stored Cross-Site Scripting",
    "slug": "namaste-lms",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50409",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Master \u003c= 3.4.12 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "ajax-filter-posts",
    "type": "plugin",
    "affected_version": "* - 3.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24733",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PageLayer \u003c= 1.7.7 - Cross-Site Request Forgery via pagelayer_load_plugin",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49196",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SuperFaktura WooCommerce \u003c= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery",
    "slug": "woocommerce-superfaktura",
    "type": "plugin",
    "affected_version": "* - 1.40.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.40.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1758",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Map Multi Marker \u003c= 3.2.1 - Reflected Cross-Site Scripting",
    "slug": "map-multi-marker",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47591",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple AL Slider \u003c= 1.2.10 - Reflected Cross-Site Scripting",
    "slug": "simple-al-slider",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5729",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Scrollbar by webxapp – Best vertical/horizontal scrollbars plugin \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "scrollbar-by-webxapp",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50467",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eRoom – Zoom Meetings \u0026 Webinar \u003c= 1.3.8 - Cross-Site Request Forgery",
    "slug": "eroom-zoom-meetings-webinar",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25615",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "URL Shortener | Conversion Tracking | AB Testing | WooCommerce \u003c= 9.0.2 - Cross-Site Request Forgery",
    "slug": "easy-broken-link-checker",
    "type": "plugin",
    "affected_version": "* - 9.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1362",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking for Appointments and Events Calendar – Amelia \u003c= 1.0.98 - Reflected Cross-Site Scripting",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.0.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.98",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1484",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2127",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AutomatorWP \u003c= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value",
    "slug": "automatorwp",
    "type": "plugin",
    "affected_version": "* - 5.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12626",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Splashscreen \u003c= 0.20 - Cross-Site Request Forgery",
    "slug": "splashscreen",
    "type": "plugin",
    "affected_version": "* - 0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6501",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Ultimate Search \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-ultimate-search",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31452",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Basic Interactive World Map \u003c= 2.7 - Cross-Site Request Forgery to Settings Update",
    "slug": "basic-interactive-world-map",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39517",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NS Simple Intro Loader \u003c= 2.2.3 - Reflected Cross-Site Scripting",
    "slug": "ns-simple-intro-loader",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23459",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Manager for UserPro \u003c= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update",
    "slug": "userpro-mediamanager",
    "type": "plugin",
    "affected_version": "* - 3.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12822",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Industrial Lite \u003c= 1.0.8 - Missing Authorization",
    "slug": "industrial-lite",
    "type": "theme",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26955",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tracking Code Manager \u003c= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tracking-code-manager",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8721",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator \u003c= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.27.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6133",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MailChimp Forms by MailMunch \u003c= 3.1.4 - Missing Authorization via multiple AJAX actions",
    "slug": "mailchimp-forms-by-mailmunch",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40203",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Blogmine \u003c= 1.1.7 - Unauthenticated Local File Inclusion",
    "slug": "blogmine",
    "type": "theme",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49276",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Network Tabs - Social Media API Key Leakage \u003c= 1.7.1 - Information Exposure",
    "slug": "social-network-tabs",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-20555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20555",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Starter Templates — Elementor, WordPress \u0026 Beaver Builder Templates \u003c= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "astra-sites",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4630",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LucidLMS \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "lucidlms",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22498",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sell Downloads \u003c= 1.0.7 - Improper Input Validation",
    "slug": "sell-downloads",
    "type": "plugin",
    "affected_version": "[*, 1.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9348",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP-Lister Lite for Amazon \u003c= 2.6.8 - Reflected Cross-Site Scripting",
    "slug": "wp-lister-for-amazon",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30199",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Sharing Toolkit \u003c= 2.1.1 - Cross-Site Request Forgery",
    "slug": "social-sharing-toolkit",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-2701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2701",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ditty \u003c= 3.1.35 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3939",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paytm Payment Donation \u003c= 2.3.1 - Reflected Cross-Site Scripting",
    "slug": "paytm-donation",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24635",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AJAX Login and Registration modal popup + inline form \u003c= 2.23 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ajax-login-and-registration-modal-popup",
    "type": "plugin",
    "affected_version": "* - 2.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33918",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sertifier Certificate \u0026 Badge Maker for WordPress – Tutor LMS \u003c= 1.19 - Cross-Site Request Forgery to Settings Update",
    "slug": "sertifier-certificates-open-badges",
    "type": "plugin",
    "affected_version": "* - 1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7841",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Directorybox Manager \u003c= 2.5 - Authentication Bypass",
    "slug": "wp-directorybox-manager",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13182",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Website Builder \u003c= 2.9.7 - Authenticated Stored Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Galleria \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "wp-galleria",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31441",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Page Builder \u003c= 4.1.11 - Reflected Cross-Site Scripting",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "[*, 4.1.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24351",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyBoss Theme \u003c= 2.4.60 - Missing Authorization",
    "slug": "buddyboss-theme",
    "type": "theme",
    "affected_version": "* - 2.4.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51477",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Yoast SEO \u003c= 22.5 - Reflected Cross-Site Scripting",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "* - 22.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "22.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4041",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 3.3.2 - Multiple Cross-Site Request Forgery",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10884",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Ultimate Reviews FREE \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "wp-ultimate-reviews-free",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23739",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kipso \u003c= 1.3.4 - Unauthenticated Local File Inclusion",
    "slug": "kipso",
    "type": "theme",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53578",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Generate Dummy Posts \u003c= 1.0.0 - Missing Authorization",
    "slug": "generate-dummy-posts",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46637",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 26.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3862",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tickera – WordPress Event Ticketing \u003c= 3.5.4.8 - Unauthenticated Customer Data Exposure",
    "slug": "tickera-event-ticketing-system",
    "type": "plugin",
    "affected_version": "* - 3.5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12578",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera \u003c= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-website-creator",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52347",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carousel, Recent Post Slider and Banner Slider \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "spice-post-slider",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5362",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shield Security – Smart Bot Blocking \u0026 Intrusion Prevention Security \u003c= 20.0.5 - Reflected Cross-Site Scripting",
    "slug": "wp-simple-firewall",
    "type": "plugin",
    "affected_version": "* - 20.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7313",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Just Writing Statistics \u003c= 4.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "just-writing-statistics",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35641",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "White Label CMS \u003c= 2.7.3 - Missing Authorization to Plugin Settings Reset",
    "slug": "white-label-cms",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4280",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "itemprop WP for SERP/SEO Rich snippets \u003c= 3.5.201706131 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "itempropwp",
    "type": "plugin",
    "affected_version": "* - 3.5.201706131",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.201706131",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23819",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Amazon Affiliates - Wordpress Plugin \u003c= 14.0.10 - Reflected Cross-Site Scripting",
    "slug": "woozone",
    "type": "plugin",
    "affected_version": "* - 14.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33548",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Share VOD – Turnkey Video Site Builder Script \u003c= 2.6.30 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "video-share-vod",
    "type": "plugin",
    "affected_version": "* - 2.6.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12449",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HSS Embed Streaming Video \u003c= 3.23 - Reflected Cross-Site Scripting",
    "slug": "hss-embed-streaming-video",
    "type": "plugin",
    "affected_version": "* - 3.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23523",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "APIExperts Square for WooCommerce \u003c= 4.2.9 - Reflected Cross-Site Scripting",
    "slug": "woosquare",
    "type": "plugin",
    "affected_version": "* - 4.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27959",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups \u003c= 1.3.5 - Missing Authorization",
    "slug": "coupon-x-discount-pop-up",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12204",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WHA Crossword \u003c= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wha-crossword",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37330",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mega Menu Block \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "getwid-megamenu",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48258",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calendar Event Multi View \u003c= 1.4.06 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "cp-multi-view-calendar",
    "type": "plugin",
    "affected_version": "* - 1.4.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.06",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2846",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slide Banners \u003c= 1.3 - Missing Authorization",
    "slug": "slide-banners",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25120",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSV PDF Preview \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rsv-pdf-preview",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51905",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Last.fm Rotation \u003c= 1.0 - Directory Traversal",
    "slug": "lastfm-rotation",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-5181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5181",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CMS Blocks \u003c= 1.1 - Missing Authorization",
    "slug": "cms-blocks",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53284",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Affiliate Links \u003c= 0.1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35097",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GlobalQuran \u003c= 1.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "globalquran",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25143",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Popup Image \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "popup-image",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51811",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IdeaPush \u003c= 8.52 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ideapush",
    "type": "plugin",
    "affected_version": "* - 8.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47181",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ads Pro Plugin \u003c= 4.88 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ap-plugin-scripteo",
    "type": "plugin",
    "affected_version": "* - 4.88",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.88",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46464",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Calendar \u003c= 3.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cf7-calendar",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46510",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom top bar \u003c= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "custom-top-bar",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28895",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Project Manager  \u003c= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13752",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c= 0.70 - Remote File Inclusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 0.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.70",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2003-1599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2003-1599",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress File Upload / WordPress File Upload Pro \u003c= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.19.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2767",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload / WordPress File Upload Pro \u003c= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wordpress-file-upload-pro",
    "type": "plugin",
    "affected_version": "* - 4.19.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2767",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eBecas \u003c= 3.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "ebecas",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32584",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accept Stripe Payments \u003c= 2.0.79 - Insecure Direct Object Reference",
    "slug": "stripe-payments",
    "type": "plugin",
    "affected_version": "* - 2.0.79",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.79",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CP Multi View Event Calendar  \u003c= 1.4.10 - Missing Authentication leading to Authenticated (Subscriber+) Private Form Submission",
    "slug": "cp-multi-view-calendar",
    "type": "plugin",
    "affected_version": "* - 1.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28492",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 4.4.4 - Admin+ SQL Injection via orderby parameter",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "[*, 4.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24786",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Theron Lite \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode",
    "slug": "theron-lite",
    "type": "theme",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5925",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cookie Consent ( for GDPR, CCPA \u0026 ePrivacy ) \u003c= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header",
    "slug": "gdpr-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4869",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Minimum Password Strength \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "minimum-password-strength",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27339",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CallPhone'r \u003c= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "callphoner",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30550",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accordion \u0026 FAQ – Helpie WordPress Accordion FAQ Plugin \u003c= 1.27 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "helpie-faq",
    "type": "plugin",
    "affected_version": "* - 1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47647",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Ajax Chat \u003c= 20231101 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-ajax-chat",
    "type": "plugin",
    "affected_version": "* - 20231101",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20231101",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2956",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.7.1 - Authenticated (Subscriber+) Open Redirect",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24740",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro - Courses for Membership Add On \u003c= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Course Modifications",
    "slug": "pmpro-courses",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-39990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39990",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Real WYSIWYG \u003c= 0.0.2 - Reflected Cross-Site Scripting",
    "slug": "real-wysiwyg",
    "type": "plugin",
    "affected_version": "* - 0.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39310",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uptodown APK Download Widget \u003c= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "uptodown-apk-download-widget",
    "type": "plugin",
    "affected_version": "* - 0.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12453",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LJ Custom Menu Links \u003c= 2.5 - Reflected Cross-Site Scripting",
    "slug": "lj-custom-menu-links",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23881",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orion SMS OTP Verification \u003c= 1.1.7 - Authentication Bypass via Account Takeover",
    "slug": "orion-sms-otp-verification",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-9967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9967",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Plugin Oficial – Getnet para WooCommerce \u003c= 1.8.0 - Reflected Cross-Site Scripting",
    "slug": "wc-checkout-getnet",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1303",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \u003c= 4.4.0 - Reflected Cross-Site Scripting",
    "slug": "print-invoices-packing-slip-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22288",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Change Email Sender \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-change-email-sender",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29815",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HM Multiple Roles \u003c= 1.2 - Privilege Escalation via Arbitrary Role Change",
    "slug": "hm-multiple-roles",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24602",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CTUsers \u003c= 1.0.0 - Unauthenticated Local File Inclusion",
    "slug": "ctuser",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32298",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 3.9.0 - SQL Injection",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 3.9.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9310",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Omnipress \u003c= 1.5.4 - Authenticated (Contributor+) Post Disclosure",
    "slug": "omnipress",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13407",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Cost Calculator Builder \u003c= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "* - 3.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6012",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Optima Express + MarketBoost IDX Plugin \u003c= 7.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "optima-express",
    "type": "plugin",
    "affected_version": "* - 7.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30749",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoices \u0026 Packing Slips 2.14.0 - 3.0.0 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-pdf-invoices-packing-slips",
    "type": "plugin",
    "affected_version": "2.14.0 - 3.0.0",
    "from_version": "2.14.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2537",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar Contact Form \u003c= 1.2.34 - Cross-Site Request Forgery via cpdexbccf_feedback",
    "slug": "booking-calendar-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.2.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25037",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass",
    "slug": "really-simple-ssl-pro-multisite",
    "type": "plugin",
    "affected_version": "9.0.0 - 9.1.1.1",
    "from_version": "9.0.0",
    "from_inclusive": true,
    "to_version": "9.1.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10924",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass",
    "slug": "really-simple-ssl",
    "type": "plugin",
    "affected_version": "9.0.0 - 9.1.1.1",
    "from_version": "9.0.0",
    "from_inclusive": true,
    "to_version": "9.1.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10924",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass",
    "slug": "really-simple-ssl-pro",
    "type": "plugin",
    "affected_version": "9.0.0 - 9.1.1.1",
    "from_version": "9.0.0",
    "from_inclusive": true,
    "to_version": "9.1.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10924",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-TopBar \u003c= 5.36 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-topbar",
    "type": "plugin",
    "affected_version": "* - 5.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.36",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23824",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Github Gist \u003c= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-github-gist",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58875",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_id",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4160",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_id",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4160",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ad Inserter - Ad Manager and AdSense Ads  \u003c= 2.8.0 - Reflected Cross-Site Scripting",
    "slug": "ad-inserter",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22623",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCOM Member \u003c= 1.7.5 - Authentication Bypass via 'user_phone'",
    "slug": "wpcom-member",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1475",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3560",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LoginPress | Custom Login Page Customizer \u003c= 1.1.13 - Unauthorized Settings Update",
    "slug": "loginpress",
    "type": "plugin",
    "affected_version": "* - 1.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15871",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Booking Calendar \u003c= 10.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 10.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10027",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Table Lite \u003c= 2.6.2 - Cross-Site Request Forgery",
    "slug": "wc-product-table-lite",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47519",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP User Frontend \u003c= 4.1.12 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "wp-user-frontend",
    "type": "plugin",
    "affected_version": "* - 4.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58673",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31627",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BodyCenter - Gym, Fitness WooCommerce WordPress Theme \u003c= 2.4 - Unauthenticated Local File Inclusion",
    "slug": "bodycenter",
    "type": "theme",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-25999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25999",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stockdio Historical Chart \u003c 2.8.1 - Reflected Cross-Site Scripting",
    "slug": "stockdio-historical-chart",
    "type": "plugin",
    "affected_version": "[*, 2.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-28707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28707",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by Supsystic \u003c= 1.7.14 - Reflected Cross-Site scripting",
    "slug": "contact-form-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24276",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Drive WP Media \u003c= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-drive-wp-media",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26574",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT",
    "slug": "restropress",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.1.9.2",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-9209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9209",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PF Timer \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pf-timer",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51863",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elements Plus! \u003c= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elements-plus",
    "type": "plugin",
    "affected_version": "* - 2.16.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32457",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FiboSearch \u003c= 1.17.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ajax-search-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.17.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1469",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.49",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2436",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Portfolio Plugin \u003c 1.05 - Cross-Site Request Forgery",
    "slug": "portfolio-by-lisa-westlund",
    "type": "plugin",
    "affected_version": "[*, 1.05)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.05",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-6523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6523",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "AIO Contact \u003c= 2.8.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "aio-contact",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54219",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Store Locator WordPress \u003c= 1.5.2 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "agile-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49329",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SOCIAL.NINJA \u003c= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "seo-meta",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23907",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45640",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Media Share Buttons \u0026 Social Sharing Icons \u003c= 2.8.5 - Cross-Site Request Forgery",
    "slug": "ultimate-social-media-icons",
    "type": "plugin",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5602",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Site Kit by Google \u003c= 1.7.1 - Sensitive Information Disclosure",
    "slug": "google-site-kit",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-8934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8934",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Page Flip Image Gallery \u003c= 0.2.2 - Directory Traversal",
    "slug": "page-flip-image-gallery",
    "type": "plugin",
    "affected_version": "* - 0.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-5752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-5752",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Duplicate Page \u003c= 1.2 - Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "wp-duplicate-page",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2093",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Penci Shortcodes \u0026 Performance \u003c 6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "penci-shortcodes",
    "type": "plugin",
    "affected_version": "[*, 6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-59587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59587",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple catalogue \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "simple-catalogue",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13633",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, \u0026 Animations \u003c= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5284",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom CSS Addons \u003c= 1.9.1 - Reflected Cross-Site Scripting",
    "slug": "css-addons",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23578",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple:Press \u003c= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editing",
    "slug": "simplepress",
    "type": "plugin",
    "affected_version": "* - 6.10.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13518",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Push Notification for Post and BuddyPress \u003c= 2.07 - Reflected Cross-Site Scripting",
    "slug": "push-notification-for-post-and-buddypress",
    "type": "plugin",
    "affected_version": "* - 2.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12407",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eMagicOne Store Manager for WooCommerce \u003c= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()",
    "slug": "store-manager-connector",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4336",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MainWP iThemes Security Extension \u003c= 4.1.1 - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "mainwp-ithemes-security-extension",
    "type": "plugin",
    "affected_version": "4.1.1.",
    "from_version": "4.1.1.",
    "from_inclusive": true,
    "to_version": "4.1.1.",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23643",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Books Gallery \u003c= 4.4.8 - Cross-Site Request Forgery leading to Plugin Settings Changes",
    "slug": "wp-books-gallery",
    "type": "plugin",
    "affected_version": "* - 4.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23705",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Total Upkeep \u003c= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure",
    "slug": "boldgrid-backup",
    "type": "plugin",
    "affected_version": "* - 1.14.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4932",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Bamboo Enquiries \u003c= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bamboo-enquiries",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51859",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Viral Quiz \u003c= 1.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "ultimate-viral-quiz",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10302",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – TForce Edition \u003c= 3.6.4 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-ups-edition",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13478",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GTM Server Side \u003c= 2.1.19 - Reflected Cross-Site Scripting",
    "slug": "gtm-server-side",
    "type": "plugin",
    "affected_version": "* - 2.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8712",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PPWP – Password Protect Pages \u003c= 1.8.9 -  Protection Mechanism Bypass",
    "slug": "password-protect-page",
    "type": "plugin",
    "affected_version": "* - 1.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0620",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP htaccess Control \u003c= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-htaccess-control",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25462",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.1.12 - Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.1.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36170",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel Engine \u003c= 5.7.9 - Unauthenticated SQL Injection",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 5.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30502",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "SMS Alert Order Notifications – WooCommerce \u003c= 3.7.8 - Unauthenticated SQL Injection",
    "slug": "sms-alert",
    "type": "plugin",
    "affected_version": "* - 3.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26988",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AffiliateWP – External Referral Links \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "affiliatewp-external-referral-links",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53460",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARPrice \u003c= 4.0.3 - Unauthenticated PHP Object Injection",
    "slug": "arprice",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49688",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Catalog Simple \u003c= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-type-x",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58992",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \u003c= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7027",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WOLF \u003c= 1.0.7.1 - Cross-Site Request Forgery",
    "slug": "bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46152",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Shopping Pages \u003c= 1.14 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "shopping-pages",
    "type": "plugin",
    "affected_version": "* - 1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3492",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CP Multi View Event Calendar \u003c= 1.4.13 - Insufficient Authorization",
    "slug": "cp-multi-view-calendar",
    "type": "plugin",
    "affected_version": "* - 1.4.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.13",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-23814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23814",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Massive Dynamic \u003c= 8.2 - Unauthenticated Local File Inclusion",
    "slug": "massive-dynamic",
    "type": "theme",
    "affected_version": "* - 8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26916",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modern Polls \u003c= 1.0.10 - Cross-Site Request Forgery",
    "slug": "modern-polls",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46466",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HTML5 Video Player with Playlist \u003c= 2.50 - Reflected Cross-Site Scripting",
    "slug": "html5-video-player-with-playlist",
    "type": "plugin",
    "affected_version": "* - 2.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32536",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Angular Contact Form \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "advanced-angular-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23658",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple SEO  \u003c= 1.8.12 - Cross-Site Request Forgery",
    "slug": "cds-simple-seo",
    "type": "plugin",
    "affected_version": "* - 1.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-44627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44627",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Car Dealer \u003c= 1.6.6 - Unauthenticated PHP Object Injection",
    "slug": "cardealer",
    "type": "theme",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39480",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Manager and Tickets Selling for WooCommerce \u003c 3.5.8 - SQL Injection",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "[*, 3.5.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0478",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Cart Lite for WooCommerce \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "woocommerce-woocart-popup-lite",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31100",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Void Contact Form 7 Widget For Elementor Page Builder \u003c= 2.1.1 - Cross-Site Request Forgery in void_cf7_opt_in_user_data_track",
    "slug": "cf7-widget-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47166",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.1.11 - Authenticated SQL injection via shortcode",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24221",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hashtags \u003c= 0.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-hashtags",
    "type": "plugin",
    "affected_version": "* - 0.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28931",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meet My Team \u003c= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meet-my-team",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37339",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Afterpay Gateway for WooCommerce \u003c= 3.5.0 - Reflected Cross-Site Scripting",
    "slug": "afterpay-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29416",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "S3Player – WooCommerce \u0026 Elementor Integration \u003c= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "drm-protected-video-streaming",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress \u0026 WooCommerce \u003c= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Form Settings",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12567",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Patreon WordPress \u003c= 1.6.9 - Cross-Site Request Forgery",
    "slug": "patreon-connect",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24231",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Login by Auth0 3.11.0 - 3.11.2 - Cross-Site Scripting",
    "slug": "auth0",
    "type": "plugin",
    "affected_version": "3.11.0 - 3.11.2",
    "from_version": "3.11.0",
    "from_inclusive": true,
    "to_version": "3.11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20173",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCOM Member \u003c= 1.7.7 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wpcom-member",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39570",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Similar Posts – Best Related Posts Plugin for WordPress \u003c= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "similar-posts",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41612",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Confetti Fall Animation \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via confetti-fall-animation Shortcode",
    "slug": "confetti-fall-animation",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8919",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Us page - Contact people LITE \u003c= 3.7.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "contact-us-page-contact-people",
    "type": "plugin",
    "affected_version": "* - 3.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28967",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CTHthemes CityBook Theme \u003c 2.3.4, TownHub Theme \u003c 1.0.6, EasyBook Theme \u003c 1.2.2 - Cross-Site Scripting",
    "slug": "easybook",
    "type": "theme",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-20210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20210",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CTHthemes CityBook Theme \u003c 2.3.4, TownHub Theme \u003c 1.0.6, EasyBook Theme \u003c 1.2.2 - Cross-Site Scripting",
    "slug": "townhub",
    "type": "theme",
    "affected_version": "[*, 1.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-20210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20210",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CTHthemes CityBook Theme \u003c 2.3.4, TownHub Theme \u003c 1.0.6, EasyBook Theme \u003c 1.2.2 - Cross-Site Scripting",
    "slug": "citybook",
    "type": "theme",
    "affected_version": "[*, 2.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-20210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20210",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DyaPress ERP/CRM \u003c= 18.0.2.0 - Unauthenticated Local File Inclusion",
    "slug": "dyapress",
    "type": "plugin",
    "affected_version": "* - 18.0.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.0.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30582",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modal Window \u003c= 6.1.4 - Cross-Site Request Forgery to Settings Ipdate",
    "slug": "modal-window",
    "type": "plugin",
    "affected_version": "* - 6.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24717",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ELEX WooCommerce Dynamic Pricing and Discounts \u003c= 2.1.2 - Cross-Site Request Forgery",
    "slug": "elex-woocommerce-dynamic-pricing-and-discounts",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31364",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProfileGrid  \u003c= 5.9.5.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49033",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Custom PC Builder Lite for WooCommerce \u003c= 1.0.1 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "custom-pc-builder-lite-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-43838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-43838",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant \u003c= 4.1.1 - Cross-Site Request Forgery",
    "slug": "gdpr-compliant-recaptcha-for-all-forms",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49283",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSVPMaker \u003c= 8.7.2 - Server-Side Request Forgery",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "[*, 8.7.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.7.3",
    "to_inclusive": false,
    "severity": "low",
    "cve": "CVE-2021-24371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24371",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MyRewards \u003c= 5.3.0 - Missing Authorization",
    "slug": "woorewards",
    "type": "plugin",
    "affected_version": "* - 5.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32688",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Custom DataBase Tables \u003c= 2.1.34 - Reflected Cross-Site Scripting",
    "slug": "custom-database-tables",
    "type": "plugin",
    "affected_version": "* - 2.1.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22539",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliator \u003c= 2.1.3 - Unauthenticated Arbitrary File Upload",
    "slug": "affiliator-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49326",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "W3 Total Cache \u003c= 0.9.2.8 - Remote Code Execution",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "* - 0.9.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.2.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-2010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2010",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.21",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.21",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.14",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.14",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.22",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.22",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.18",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.18",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.17",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.17",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.6",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.33",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.33",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.30",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.30",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.23",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.23",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.13",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.13",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.5",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.33",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.33",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.30",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.30",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.27",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.27",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.9",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Self-Cross Site Scripting via Theme Folder Name",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.31",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.31",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2020-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4049",
    "auth_type": "Privileged",
    "cvss_score": 2.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quick Contact Form \u003c= 8.0.3.1 - Cross-Site Request Forgery to Sensitive Information Disclosure",
    "slug": "quick-contact-form",
    "type": "plugin",
    "affected_version": "* - 8.0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25035",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Brafton \u003c 3.4.8 - Reflected Cross-Site Scripting",
    "slug": "BraftonWordpressPlugin",
    "type": "plugin",
    "affected_version": "[*, 3.4.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10973",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi Feed Reader \u003c= 2.2.3 - Authenticated SQL Injection",
    "slug": "multi-feed-reader",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-2195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2195",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Share Buttons Adder \u003c= 8.4.11 - Authenticated(Administrator+) Stored Cross-Site Scripting via CSS Settings",
    "slug": "simple-share-buttons-adder",
    "type": "plugin",
    "affected_version": "* - 8.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0621",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackupBuddy \u003c 3.0 - Authentication Bypass",
    "slug": "backupbuddy",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-2743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2743",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventON \u003c= 2.4.4 - Missing Authorization",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48116",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page Builder: Live Composer \u003c= 1.5.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "live-composer-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52193",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customer Email Verification for WooCommerce \u003c= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "emails-verification-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13525",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP User Profile Avatar \u003c= 1.0.6 - Missing Authorization",
    "slug": "wp-user-profile-avatar",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49980",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SS Quiz \u003c= 2.0.5 - Unauthenticated PHP Object Injection",
    "slug": "ssquiz",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-27287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27287",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Team Builder \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "team-display",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31907",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Olimometer \u003c 2.57 - SQL Injection",
    "slug": "olimometer",
    "type": "plugin",
    "affected_version": "[*, 2.57)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.57",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10904",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Giveaways \u003c= 2.48.2 - Cross-Site Request Forgery",
    "slug": "giveasap",
    "type": "plugin",
    "affected_version": "* - 2.48.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.48.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47606",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "3.6.0 - 4.7.3",
    "from_version": "3.6.0",
    "from_inclusive": true,
    "to_version": "4.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3488",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Wishlist \u003c= 3.32.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "yith-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 3.32.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.32.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34385",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flo Forms – Easy Drag \u0026 Drop Form Builder \u003c= 1.0.35 - Options Change to Stored Cross-Site Scripting",
    "slug": "flo-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core 5.8 beta -  Stored Cross-Site Scripting in Custom HTML Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 beta 1 - 5.8 beta 2",
    "from_version": "5.8 beta 1",
    "from_inclusive": true,
    "to_version": "5.8 beta 2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39202",
    "auth_type": "Auth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Country State City Dropdown CF7 \u003c= 2.7.1 - Missing Authorization",
    "slug": "country-state-city-auto-dropdown",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3520",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Interactive Geo Maps \u003c= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "interactive-geo-maps",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23866",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "History Timeline \u003c= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "timeline-awesome",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37328",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LogDash Activity Log \u003c= 1.1.3 - Unauthenticated SQL Injection",
    "slug": "logdash-activity-log",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6030",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Graphs \u0026 Charts \u003c= 2.0.8 - Missing Authorization",
    "slug": "graph-lite",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23961",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads \u003c= 2.0.84 - Missing Authorization",
    "slug": "quick-adsense-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.0.84",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.84",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47317",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All-in-One WP Migration \u003c= 7.40 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "all-in-one-wp-migration",
    "type": "plugin",
    "affected_version": "* - 7.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.40",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24216",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 25.1.0 - Authenticated (Author+) SQL Injection",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 25.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "25.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22693",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ark Theme Core \u003c= 1.70.0 - Unauthenticated Remote Code Execution",
    "slug": "ark-core",
    "type": "plugin",
    "affected_version": "* - 1.70.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.70.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26970",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Field For WP Job Manager \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "custom-field-for-wp-job-manager",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3328",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShortPixel Critical CSS \u003c= 1.0.2 - Missing Authorization",
    "slug": "shortpixel-critical-css",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32810",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Live Forms \u003c= 4.8.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "liveforms",
    "type": "plugin",
    "affected_version": "* - 4.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30809",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Email Debug 1.0 - 1.1.0 - Missing Authorization to Unauthenticated Privilege Escalation via Password Reset",
    "slug": "wp-email-debug",
    "type": "plugin",
    "affected_version": "1.0 - 1.2.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5486",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Countdown \u0026 Clock \u003c= 2.3.2 - Reflected Cross-Site Scripting",
    "slug": "countdown-builder",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29421",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OceanWP \u003c= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion",
    "slug": "oceanwp",
    "type": "theme",
    "affected_version": "* - 3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2476",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetTricks \u003c= 1.5.1 - Missing Authorization",
    "slug": "jet-tricks",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26942",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Navayan CSV Export \u003c= 1.0.9 - Unauthenticated SQL Injection",
    "slug": "navayan-csv-export",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-55988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55988",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UniTimetable \u003c= 1.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "unitimetable",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25084",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Body Class \u003c= 0.6.0 - Cross-Site Scripting",
    "slug": "wp-custom-body-class",
    "type": "plugin",
    "affected_version": "* - 0.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-6029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6029",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KiviCare – Clinic \u0026 Patient Management System (EHR) \u003c= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter",
    "slug": "kivicare-clinic-management-system",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1572",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Countdown Block \u003c= 1.1.1 - Missing Authorization",
    "slug": "wp-countdown-block",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24633",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential WP Real Estate \u003c= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion",
    "slug": "essential-wp-real-estate",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13318",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1535",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms and User Login \u003c= 4.6.0.3 - Authenticated Settings Import to Privilege Escalation",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 4.6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-9457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9457",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Go Pricing - WordPress Responsive Pricing Tables \u003c= 3.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "go_pricing",
    "type": "plugin",
    "affected_version": "* - 3.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2498",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "List category posts \u003c= 0.90.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "list-category-posts",
    "type": "plugin",
    "affected_version": "* - 0.90.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.90.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c 5.1.7 - Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "[*, 5.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6716",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Captcha \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "image-captcha",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30534",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via `author` Parameter",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.80.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.80.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Matterport Shortcode \u003c= 2.1.5 - Reflected Cross-Site Scripting",
    "slug": "shortcode-gallery-for-matterport-showcase",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4290",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "4.0.1 - 7.2.4",
    "from_version": "4.0.1",
    "from_inclusive": true,
    "to_version": "7.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13708",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MaxButtons  \u003c 1.26.1 - Reflected Cross-Site Scripting",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "[*, 1.26.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-7181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7181",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Davenport - Versatile Blog and Magazine WordPress Theme \u003c= 1.3 - Unauthenticated Local File Inclusion",
    "slug": "davenport",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-52811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52811",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IMITHEMES Listing \u003c= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Reset",
    "slug": "imithemes-listing",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2253",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Safe Ai Malware Protection for WP \u003c= 1.0.17 - Missing Authorization to Unauthenticated Database Export",
    "slug": "safe-ai-malware-protection-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12269",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "IBS Mappro \u003c 1.0 - Directory Traversal",
    "slug": "ibs-mappro",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-5472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5472",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ultimate Gift Cards for WooCommerce \u003c= 3.0.6 - Missing Authorization to Infinite Money Glitch",
    "slug": "woo-gift-cards-lite",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11423",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Ultimate Gift Cards for WooCommerce \u003c= 3.0.6 - Missing Authorization to Infinite Money Glitch",
    "slug": "gift-cards-for-woocommerce-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11423",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Link Library \u003c= 7.6 - Reflected Cross-Site Scripting",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29123",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TP Education \u003c= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes",
    "slug": "tp-education",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32103",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.0.5 - Cross-Site Request Forgery",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38144",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.9.3 - Cross-Site Request Forgery to Settings Update",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39453",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sidebar Adder 2 \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "sidebar-adder",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34666",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FraudLabs Pro for WooCommerce \u003c= 2.22.11 - Missing Authorization",
    "slug": "fraudlabs-pro-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.22.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.22.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49320",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c 1.2.7.2 - Cross-Site Scripting",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "[*, 1.2.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24690",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FloristPress \u003c= 7.3.0 - Missing Authorization to Arbitrary Content Deletion",
    "slug": "bakkbone-florist-companion",
    "type": "plugin",
    "affected_version": "* - 7.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53798",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.12 - Cross-Site Request Forgery in savetranslation function",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25707",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Administrator Z \u003c= 2025.03.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "administrator-z",
    "type": "plugin",
    "affected_version": "* - 2025.03.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2025.03.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2815",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ReviewX \u003c= 1.6.7 - Unauthenticated CSV Injection",
    "slug": "reviewx",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46809",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Popup Builder by OptinMonster \u003c= 1.1.4.5 - Remote Code Execution",
    "slug": "optinmonster",
    "type": "plugin",
    "affected_version": "[*, 1.1.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10996",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DiveBook \u003c= 1.1.4 - Reflected Cross-Site Scripting",
    "slug": "divebook",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-14206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-14206",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hide My WP Ghost \u003c= 5.0.25 - CAPTCHA Bypass in brute_math_authenticate",
    "slug": "hide-my-wp",
    "type": "plugin",
    "affected_version": "* - 5.0.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34001",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shopping Cart \u0026 eCommerce Store \u003c= 5.6.4 - Sensitive Information Exposure",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4213",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Navegg Analytics \u003c= 3.3.3 - Cross-Site Request Forgery",
    "slug": "navegg",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46497",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress \u0026 WooCommerce \u003c= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8254",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Blocks \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-block-editor-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39578",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Table of Contents \u003c= 2.0.65 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 2.0.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.65",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5573",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opal Hotel Room Booking plugin \u003c= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "opal-hotel-room-booking",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29449",
    "auth_type": "Auth",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Content No Cache: prevent specific content from being cached \u003c= 0.1.2 - Unauthenticated Private Content Disclosure",
    "slug": "content-no-cache",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12103",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Auto Tag Creator \u003c= 1.0.2 - Missing Authorization via tag_save_settings_callback",
    "slug": "auto-tag-creator",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47523",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BlockMeister – Block Pattern Builder \u003c= 3.1.10 - Reflected Cross-Site Scripting",
    "slug": "blockmeister",
    "type": "plugin",
    "affected_version": "* - 3.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9616",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.1.5 - Missing Authorization in migrateProductOnlyToCommon function",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40203",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Codescar Radio Widget \u003c= 0.4.2 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "codescar-radio-widget",
    "type": "plugin",
    "affected_version": "* - 0.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32500",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.9 - Open Redirect",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31237",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Spreadconnect \u003c= 2.1.5 - Missing Authorization",
    "slug": "wc-spod",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53291",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Avada \u003c= 7.11.10 - Missing Authorization",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24748",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', \u0026 'Advanced Data Table'",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4448",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Scheduling Plugin – Online Booking for WordPress \u003c= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnection",
    "slug": "calendar-booking",
    "type": "plugin",
    "affected_version": "* - 3.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1634",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Ultimate FAQ \u003c= 2.1.1 - Missing Authorization to Arbitrary FAQ Creation",
    "slug": "ultimate-faqs",
    "type": "plugin",
    "affected_version": "[*, 2.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24968",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WPMU Prefill Post \u003c= 1.02 - Authenticated (Administrator+) SQL Injection",
    "slug": "wpmu-prefill-post",
    "type": "plugin",
    "affected_version": "* - 1.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22507",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.14.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1570",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LIQUID SPEECH BALLOON \u003c 1.0.7 - Cross-Site Scripting",
    "slug": "liquid-speech-balloon",
    "type": "plugin",
    "affected_version": "[*, 1.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17070",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Register Profile With Shortcode \u003c= 3.5.9 - Cross-Site Request Forgery to User Password Reset",
    "slug": "wp-register-profile-with-shortcode",
    "type": "plugin",
    "affected_version": "* - 3.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5448",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletter – Send awesome emails from WordPress \u003c= 7.4.4 - Reflected Cross-Site Scripting",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "* - 7.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1756",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AMP for WP \u003c= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data",
    "slug": "accelerated-mobile-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.93.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.93.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1043",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Auberge \u003c 1.4.5 - Cross-Site Scripting",
    "slug": "auberge",
    "type": "theme",
    "affected_version": "[*, 1.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9502",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Invoices \u0026 Packing Slips for WooCommerce \u003c= 3.8.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "woocommerce-pdf-invoices-packing-slips",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3045",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arielbrailovsky-Viralad \u003c= 1.0.8 - Unauthenticated SQL Injection",
    "slug": "arielbrailovsky-viralad",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2106",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SvegliaT Buttons \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "svegliat-buttons",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Data Table \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "responsive-data-table",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51710",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FooGallery (Free and Premium) \u003c 2.4.15 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "foogallery-premium",
    "type": "plugin",
    "affected_version": "[*, 2.4.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-2762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2762",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FooGallery (Free and Premium) \u003c 2.4.15 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "[*, 2.4.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-2762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2762",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CarSpot – Dealership Wordpress Classified Theme \u003c 2.1.7 - Authenticated Stored Cross-Site Scripting",
    "slug": "carspot",
    "type": "theme",
    "affected_version": "[*, 2.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15870",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Real Estate \u003c= 4.4.2 - Insecure Direct Object Reference to Arbitrary Attachment Deletion",
    "slug": "essential-real-estate",
    "type": "plugin",
    "affected_version": "* - 4.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4274",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.27 - Multiple Cross-Site Scripting vulnerabilities",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-17866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17866",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Video Gallery \u003c= 1.7.1 - SQL Injection",
    "slug": "wp-video-gallery-free",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0826",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Button Generator – easily Button Builder \u003c= 2.3.9 - Cross-Site Request Forgery",
    "slug": "button-generation",
    "type": "plugin",
    "affected_version": "* - 2.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3471",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Age Verification \u003c= 0.4 - Open Redirect",
    "slug": "age-verification",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-6499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6499",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3197",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "xili-dictionary \u003c= 2.12.5 - Reflected Cross-Site Scripting",
    "slug": "xili-dictionary",
    "type": "plugin",
    "affected_version": "* - 2.12.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30840",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Missing Authorization in 'clear_page_cache'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1333",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Amazon Products to WooCommerce \u003c= 1.2.7 - Unauthenticated Server-Side Request Forgery",
    "slug": "import-products-to-wc",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5817",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Slider and Carousel with Category for WooCommerce \u003c= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "woo-product-slider-and-carousel-with-category",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4791",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shiptimize for WooCommerce \u003c= 3.1.86 - Reflected Cross-Site Scripting",
    "slug": "shiptimize-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.1.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54235",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Telefication \u003c= 1.8.0 - Open Relay and Server-Side Request Forgery",
    "slug": "telefication",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39339",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L"
  },
  {
    "title": "ListingPro Plugin \u003c= 2.9.4 - Unauthenticated Local File Inclusion",
    "slug": "listingpro-plugin",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-39619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39619",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stock market charts from finviz \u003c= 1.0.1 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "stock-market-charts-from-finviz",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23809",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enable Media Replace \u003c= 4.1.2 - Authenticated(Author+) PHP Object Injection",
    "slug": "enable-media-replace",
    "type": "plugin",
    "affected_version": "[*, 4.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4643",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon \u003c= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset",
    "slug": "wpsyncsheets-wpforms",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12164",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Password for WP \u003c= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "password-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11419",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Plugin by Squirrly SEO \u003c= 12.3.15 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "squirrly-seo",
    "type": "plugin",
    "affected_version": "* - 12.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0597",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FancyBox for WordPress \u003c= 3.3.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "fancybox-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3662",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPAdverts \u003c= 2.2.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wpadverts",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47440",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "6Storage Rentals \u003c= 2.19.6 - Missing Authorization",
    "slug": "6storage-rentals",
    "type": "plugin",
    "affected_version": "* - 2.19.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.19.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26002",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Client Showcase \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "client-showcase",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31737",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rich Reviews \u003c= 1.7.4 - Stored Cross-Site Scripting",
    "slug": "rich-reviews",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-25216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25216",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Section Widget \u003c= 3.3.1 - Reflected Cross-Site Scripting",
    "slug": "section-widget",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46537",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS – Online Courses, eLearning PRO Plus \u003c= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "masterstudy-lms-learning-management-system-pro",
    "type": "plugin",
    "affected_version": "* - 4.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7438",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPMobile.App — Android and iOS Mobile Application \u003c= 11.52 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "wpappninja",
    "type": "plugin",
    "affected_version": "* - 11.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12420",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Color Palette \u003c= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via hex Parameter",
    "slug": "color-palette",
    "type": "plugin",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5233",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Creative Contact Form \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "sexy-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52794",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sensei LMS – Online Courses, Quizzes, \u0026 Learning \u003c= 4.24.1 - Unauthenticated Email Template Disclosure",
    "slug": "sensei-lms",
    "type": "plugin",
    "affected_version": "* - 4.24.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7786",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GeoDirectory \u003c= 2.3.70 - Missing Authorization via geodirectory_rated()",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.3.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43981",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSVPMaker \u003c= 9.9.3 - Authenticated (Admin+) SQL Injection via $email value",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 9.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25045",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JupiterX Core  3.0.0 - 3.3.0 - Missing Authorization",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.3.0",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38394",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords \u003c= 3.1 - Unauthenticated PHP Object Injection",
    "slug": "muzaara-adwords-optimize-dashboard",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23914",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ask Me \u003c= 6.8.3 - Cross-Site Request Forgery",
    "slug": "ask-me",
    "type": "theme",
    "affected_version": "* - 6.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1251",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 2.7.0 - Authenticated(Editor+) Privilege Escalation",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23990",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HTTP Headers \u003c= 1.18.10 - Authenticated(Administrator+) Remote Code Execution",
    "slug": "http-headers",
    "type": "plugin",
    "affected_version": "* - 1.18.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1208",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce AWeber Newsletter Subscription \u003c= 4.0.2 - Missing Authorization to Access Token Modification",
    "slug": "woocommerce-aweber-newsletter-subscription",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33944",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SimpleMap Store Locator \u003c= 2.6.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "simplemap",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22282",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Javo Core \u003c= 3.0.0.266 - Missing Authorization",
    "slug": "javo-core",
    "type": "plugin",
    "affected_version": "* - 3.0.0.266",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0.266",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58003",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPLMS \u003c 1.9.9.5.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "[*, 1.9.9.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-56047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56047",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.1 - Insecure Password Reset Mechanism",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2449",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stock Locations for WooCommerce \u003c= 2.8.6 - Missing Authorization",
    "slug": "stock-locations-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47463",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Posts Widget \u003c= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ultimate-posts-widget",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0561",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Backup \u003c= 2.7.10 - Arbitrary File Download via Path Traversal",
    "slug": "simple-backup",
    "type": "plugin",
    "affected_version": "[*, 2.7.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-10134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10134",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Consultant \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-consultant",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4582",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integrate Google Drive \u003c= 1.1.99 - Missing Authorization via REST API Endpoints",
    "slug": "integrate-google-drive",
    "type": "plugin",
    "affected_version": "* - 1.1.99",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.99",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32117",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Maps – Display Google Maps Perfectly with Ease \u003c= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3502",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widget",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1377",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "tagDiv Cloud Library \u003c 2.7 - Missing Authorization to Arbitrary User Metadata Update",
    "slug": "Newspaper",
    "type": "theme",
    "affected_version": "* - 12.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-1597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1597",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "tagDiv Cloud Library \u003c 2.7 - Missing Authorization to Arbitrary User Metadata Update",
    "slug": "td-cloud-library",
    "type": "plugin",
    "affected_version": "[*, 2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-1597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1597",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Alert Before Your Post \u003c= 0.1.1 - Cross-Site Scripting",
    "slug": "alert-before-your-post",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-5107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5107",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension \u003c= 3.1.2 - Authenticated Arbitrary Options Update",
    "slug": "shortcode-addons",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-33970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33970",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Malware Scanner \u003c= 4.7.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "miniorange-malware-protection",
    "type": "plugin",
    "affected_version": "* - 4.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25902",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Duplicate Post Page Menu \u0026 Custom Post Type \u003c= 2.3.1 - Missing Authorization",
    "slug": "duplicate-post-page-menu-custom-post-type",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36526",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PixelYourSite \u003c= 5.2.1 - Reflected Cross-Site Scripting",
    "slug": "pixelyoursite",
    "type": "plugin",
    "affected_version": "[*, 5.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-0578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0578",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fast Total Search \u003c= 1.78.258 - Cross-Site Request Forgery",
    "slug": "fulltext-search",
    "type": "plugin",
    "affected_version": "* - 1.78.258",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.78.258",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24572",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VW Automobile Lite \u003c= 2.1.2 - Missing Authorization",
    "slug": "vw-automobile-lite",
    "type": "theme",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56234",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.26 - Reflected Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43220",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stackable – Page Builder Gutenberg Blocks \u003c= 3.13.6 - Unauthenticated CSS Injection",
    "slug": "stackable-ultimate-gutenberg-blocks",
    "type": "plugin",
    "affected_version": "* - 3.13.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8760",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Auphonic Importer \u003c= 1.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "auphonic-importer",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23649",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Catalog Woocommerce \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-catalog-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22809",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Stock Alert \u003c= 2.0.1 - Information Disclosure",
    "slug": "woocommerce-product-stock-alert",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37972",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "EG-Attachments \u003c= 2.1.3 - Reflected Cross-Site Scripting via 'paged'",
    "slug": "eg-attachments",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46070",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accessibility Widget \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "accessibility-widget",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32831",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "If-So Dynamic Content Personalization \u003c= 1.8.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "if-so",
    "type": "plugin",
    "affected_version": "* - 1.8.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6070",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoho SalesIQ \u003c= 1.0.8 - Stored Cross-Site Scripting",
    "slug": "zoho-salesiq",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15644",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Html5 Video Player \u003c= 2.5.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "html5-video-player",
    "type": "plugin",
    "affected_version": "* - 2.5.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6485",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Holiday Calendar \u003c= 1.18.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-holiday-calendar",
    "type": "plugin",
    "affected_version": "* - 1.18.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29003",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PhotoShelter for Photographers Blog Feed Plugin \u003c= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "photoshelter-official-plugin",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31766",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ChatBot \u003c= 4.4.8 - Unauthenticated Stored Cross-Site Scripting in Admin Dashboard",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1660",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Imagements \u003c= 1.2.5 - Arbitrary File Upload",
    "slug": "imagements",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24236",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Malcure Malware Scanner \u003c= 16.8 - Missing Authorization",
    "slug": "wp-malware-removal",
    "type": "plugin",
    "affected_version": "* - 16.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3701",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Qi Blocks \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "qi-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38712",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shipdeo \u003c= 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "shipdeo-woo",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23457",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARMember \u003c= 3.4.10 - Missing Access Control leading to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 3.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47425",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "G Meta Keywords \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "g-meta-keywords",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49301",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hover Effects Ultimate \u003c= 9.7.1 - Authenticated (Admin+) Arbitrary Options Update",
    "slug": "image-hover-effects-ultimate",
    "type": "plugin",
    "affected_version": "* - 9.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-42459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42459",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.3.5 - Sensitive Data Exposure",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40194",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Featured Screenshot \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "wp-featured-screenshot",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32557",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integration for Contact Form 7 HubSpot \u003c= 1.2.8 - Open Redirect via state parameter",
    "slug": "cf7-hubspot",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31095",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "1003 Mortgage Application \u003c= 1.75 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "1003-mortgage-application",
    "type": "plugin",
    "affected_version": "* - 1.75",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.75",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45368",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "JetProductGallery \u003c= 2.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-woo-product-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31412",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPAdverts – Classifieds Plugin \u003c= 2.1.7 - Reflected Cross-Site Scripting",
    "slug": "wpadverts",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10890",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cena Store \u003c= 2.11.26 - Unauthenticated Local File Inclusion",
    "slug": "cena",
    "type": "theme",
    "affected_version": "* - 2.11.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48171",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Spell Check \u003c= 9.17 - Cross-Site Request Forgery",
    "slug": "wp-spell-check",
    "type": "plugin",
    "affected_version": "* - 9.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22143",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pricing Deals for WooCommerce \u003c= 2.0.2.02 - Unauthenticated SQL Injection",
    "slug": "pricing-deals-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.2.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2.02",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1057",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EZP Maintenance Mode \u003c= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "easy-pie-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23682",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "12 Step Meeting List \u003c= 3.16.5 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion",
    "slug": "12-step-meeting-list",
    "type": "plugin",
    "affected_version": "* - 3.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24580",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Global DNS \u003c= 3.1.0 - Unauthenticated Remote Code Execution",
    "slug": "global-dns",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-53577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53577",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DX Share Selection \u003c= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "dx-share-selection",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2001",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Profile Builder \u003c= 3.10.3 - Cross-Site Request Forgery via pms-cross-promotion.php",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47669",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Gutenberg Blocks – Unlimited blocks For Gutenberg \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "unlimited-blocks",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44049",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.12 - Cross-Site Request Forgery in admin_widgets_welcome function",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25707",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoice Builder \u003c= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Export",
    "slug": "woo-pdf-invoice-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3677",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Category Specific RSS feed Subscription \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "category-specific-rss-feed-menu",
    "type": "plugin",
    "affected_version": "[*, 2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-22691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22691",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Timeline – Vertical and Horizontal timeline plugin \u003c= 3.6.7 - Reflected Cross-Site Scripting",
    "slug": "wp-timelines",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47322",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP DB Manager \u003c 2.7.2 - Arbitrary File Read",
    "slug": "wp-dbmanager",
    "type": "plugin",
    "affected_version": "[*, 2.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-8336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8336",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Integrator \u003c= 1.32 - Cross-Site Scripting",
    "slug": "wp-integrator",
    "type": "plugin",
    "affected_version": "* - 1.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-5913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5913",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simply Schedule Appointments \u003c= 1.6.5.27 - Authenticated(Administrator+) SQL Injection",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "[*, 1.6.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50851",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Daily Prayer Time \u003c= 2023.03.08 - Cross-Site Request Forgery",
    "slug": "daily-prayer-time-for-mosques",
    "type": "plugin",
    "affected_version": "* - 2023.03.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2023.03.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27632",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Football Pool \u003c= 2.11.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "football-pool",
    "type": "plugin",
    "affected_version": "* - 2.11.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43139",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Funnel Builder by FunnelKit \u003c= 3.9.0 - Unauthenticated Local File Inclusion",
    "slug": "funnel-builder",
    "type": "plugin",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26979",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ad Inserter \u003c= 2.4.21 - Authenticated Remote Code Execution",
    "slug": "ad-inserter",
    "type": "plugin",
    "affected_version": "* - 2.4.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15324",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Brizy Pro \u003c= 2.6.1 - Reflected Cross-Site Scripting",
    "slug": "brizy-pro",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22763",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZenLite \u003c= 4.3 - Cross-Site Scripting",
    "slug": "zenlite",
    "type": "theme",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3854",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Redirect Manager \u003c= 2.18.18 - Cross-Site Scripting",
    "slug": "easy-redirect-manager",
    "type": "plugin",
    "affected_version": "* - 2.18.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-6267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6267",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Subtitle \u003c= 3.4 - Cross-Site Scripting",
    "slug": "wp-subtitle",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1393",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c 0.8.4.9 - SQL Injection",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "[*, 0.8.4.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.4.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.8.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2925",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog Floating Button \u003c= 1.4.12 - Cross-Site Request Forgery",
    "slug": "blog-floating-button",
    "type": "plugin",
    "affected_version": "* - 1.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27445",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Taskbuilder \u003c= 3.0.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "taskbuilder",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22716",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Lightweight and Responsive Youtube Embed \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lightweight-and-responsive-youtube-embed",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31744",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Trinity Audio \u003c= 5.20.0 - Missing Authorization",
    "slug": "trinity-audio",
    "type": "plugin",
    "affected_version": "* - 5.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49272",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Member Hero \u003c= 1.0.9 - Remote Code Execution",
    "slug": "member-hero",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0885",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "List Custom Taxonomy Widget \u003c= 4.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "list-custom-taxonomy-widget",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32833",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 3.4.10 - Unauthenticated PHP Object Injection",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 3.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31084",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Cloudflare Turnstile \u003c= 1.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-cloudflare-turnstile",
    "type": "plugin",
    "affected_version": "* - 1.23.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5135",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "White Label CMS \u003c 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "white-label-cms",
    "type": "plugin",
    "affected_version": "[*, 1.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-5387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5387",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "BlossomThemes Email Newsletter \u003c= 2.2.6 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "blossomthemes-email-newsletter",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37098",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Tournament Registration \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via field Parameter",
    "slug": "wp-tournament-registration",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6690",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SecureMoz Security Audit \u003c= 1.0.5 - PHP Object Injection",
    "slug": "securemoz-security-audit",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-6828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6828",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds \u003c= 1.4.10 - Missing Authorization to Authenticated (Subscriber+) User Email Export",
    "slug": "woo-wallet",
    "type": "plugin",
    "affected_version": "* - 1.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1690",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooMS \u003c= 9.12 - Reflected Cross-Site Scripting",
    "slug": "wooms",
    "type": "plugin",
    "affected_version": "* - 9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32602",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Biagiotti Membership \u003c= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user",
    "slug": "biagiotti-membership",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12287",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Order Export For WooCommerce \u003c= 3.3.2 - Cross-Site Request Forgery",
    "slug": "woo-order-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40128",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Nextend Social Login and Register \u003c= 1.5.5 - Reflected Cross-Site Scripting",
    "slug": "nextend-facebook-connect",
    "type": "plugin",
    "affected_version": "[*, 1.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-4413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4413",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Stateless – Google Cloud Storage \u003c= 3.4.0 - Missing Authorization to Limited Arbitrary Options Update",
    "slug": "wp-stateless",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1385",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Houzez \u003c= 4.0.4 - Unauthenticated Local File Inclusion",
    "slug": "houzez",
    "type": "theme",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53198",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP fade in text news \u003c= 12.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "wp-fade-in-text-news",
    "type": "plugin",
    "affected_version": "* - 12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5437",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Enhanced BibliPlug \u003c= 1.3.8 - Authenticated (Contirbutor+) Stored Cross-Site Scripting",
    "slug": "enhanced-bibliplug",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9855",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Tickets with Ticket Scanner \u003c= 2.5.3 - Cross-Site Request Forgery to Arbitrary Ticket Deletion",
    "slug": "event-tickets-with-ticket-scanner",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1762",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GravityWP - Merge Tags \u003c= 1.4.4 - Unauthenticated Local File Inclusion",
    "slug": "gravitywp-merge-tags",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49271",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.3.19 - Authenticated Open Redirect",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-19796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19796",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WPSHARE247 Elementor Addons \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpshare247-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31813",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mojoomla School Management System (Unspecified Version) - Authenticated (Student+) SQL Injection",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-14843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14843",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Jitsi Shortcode \u003c= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-jitsi-shortcodes",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3977",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fonto \u003c= 1.2.2 - Authenticated (Author+) Arbitrary File Download",
    "slug": "fonto",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31827",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CopySafe Web Protection \u003c= 4.3 - Missing Authorization",
    "slug": "wp-copysafe-web",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60127",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Funnel Kit Funnel Builder PRO \u003c= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_post",
    "slug": "funnel-builder-pro",
    "type": "plugin",
    "affected_version": "* - 3.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1056",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Videochat Turnkey Site – HTML5 PPV Live Webcams  \u003c= 7.2.16 - Unauthenticated Arbitrary File Deletion",
    "slug": "ppv-live-webcams",
    "type": "plugin",
    "affected_version": "* - 7.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-22663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22663",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Legacy ePlayer \u003c= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sportspress-tv",
    "type": "plugin",
    "affected_version": "* - 0.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22572",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bitcoin / AltCoin Payment Gateway for WooCommerce \u003c= 1.7.2 - Unauthenticated SQL Injection",
    "slug": "woo-altcoin-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4118",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPQA Builder \u003c= 6.1.0 - Cross-Site Request Forgery",
    "slug": "wpqa",
    "type": "plugin",
    "affected_version": "* - 6.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2376",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PPOM for WooCommerce \u003c= 32.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "woocommerce-product-addon",
    "type": "plugin",
    "affected_version": "[*, 32.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "32.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-1839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1839",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery \u003c= 2.2.46 - Sensitive Information Disclosure",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 2.2.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.46",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-7586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-7586",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP-Recall – Registration, Profile, Commerce \u0026 More \u003c= 16.26.10 - Unauthenticated SQL Injection",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1323",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.2.13 - Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.2.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-7280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-7280",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Albo Pretorio Online \u003c= 4.6.1 - Reflected Cross-Site Scripting",
    "slug": "albo-pretorio-on-line",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28993",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meks Easy Photo Feed Widget \u003c 1.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "meks-easy-instagram-widget",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24958",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooThumbs for WooCommerce by Iconic \u003c= 5.5.3 - Reflected Cross-Site Scripting",
    "slug": "iconic-woothumbs",
    "type": "plugin",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29116",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Infinite Scroll – Ajax Load More \u003c= 5.5.3 - Authenticated (Admin+) Arbitrary File Read",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2943",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "DSGVO All in one for WP \u003c= 3.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "dsgvo-all-in-one-for-wp",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24294",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HelloAsso \u003c= 1.1.10 - Missing Authorization",
    "slug": "helloasso",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44052",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Locatoraid Store Locator \u003c= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "locatoraid",
    "type": "plugin",
    "affected_version": "* - 3.9.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2031",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ListingPro \u003c= 2.9.3 - Cross-Site Request Forgery to Account Takeover",
    "slug": "listingpro",
    "type": "theme",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-39623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39623",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.2.9 - Authenticated (Contributor+) Information Exposure",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9889",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GHActivity \u003c= 2.0.0-alpha - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ghactivity",
    "type": "plugin",
    "affected_version": "[*, 2.0.0-alpha]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0-alpha",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43949",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget Options - Extended \u003c= 5.1.0 \u0026  Widget Options \u003c= 4.0.1 - Authenticated (Subscriber+) Information Disclosure",
    "slug": "extended-widget-options",
    "type": "plugin",
    "affected_version": "[*, 5.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-35691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35691",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Widget Options - Extended \u003c= 5.1.0 \u0026  Widget Options \u003c= 4.0.1 - Authenticated (Subscriber+) Information Disclosure",
    "slug": "widget-options",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35691",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Coming Soon Page, Under Construction \u0026 Maintenance Mode by SeedProd \u003c= 6.17.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "coming-soon",
    "type": "plugin",
    "affected_version": "* - 6.17.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.17.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47299",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Note Press \u003c= 0.1.10 - Authenticated (Admin+) SQL Injection via Update",
    "slug": "note-press",
    "type": "plugin",
    "affected_version": "* - 0.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1689",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rapid Cache \u003c= 1.2.3 - Unauthenticated Cache Poisoning",
    "slug": "rapid-cache",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12314",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c 6.1.3 - Cross-Site Scripting",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "[*, 6.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-3647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3647",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "OAuth Client by DigitialPixies \u003c= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dpt-oauth-client",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3631",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Total Donations \u003c= 3.0.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "total-donations",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-43837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-43837",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stars Rating \u003c= 3.5.0 - Denial of Service",
    "slug": "stars-rating",
    "type": "plugin",
    "affected_version": "[*, 3.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24893",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Accordion \u003c= 2.3.11 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "accordions",
    "type": "plugin",
    "affected_version": "* - 2.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32143",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "F4 Media Taxonomies \u003c= 1.1.4 - Missing Authorization",
    "slug": "f4-media-taxonomies",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58617",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Domain Sharding \u003c= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "domain-sharding",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50533",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Local Avatar \u003c= 12.1 - Cross-Site Request Forgery via manage_avatar_cache",
    "slug": "add-local-avatar",
    "type": "plugin",
    "affected_version": "* - 12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47650",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Instinct WP e-Commerce \u003c= 3.4 - Arbitrary File Upload",
    "slug": "wp-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-6811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-6811",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Manager for WooCommerce \u003c= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Monetag Official Plugin \u003c= 1.1.3 - Missing Authorization",
    "slug": "monetag-official",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52500",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "eCommerce Product Catalog Plugin for WordPress \u003c= 3.3.32 - Reflected Cross-Site Scripting",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "* - 3.3.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32558",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPLMS \u003c 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "[*, 1.9.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-56045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56045",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.34",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.34",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.14",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.10",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.6",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.2",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.15",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.31",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.24",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.23",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.22",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.18",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.7",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.19",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.1",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.32",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.32",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.31",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.28",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Privilege Escalation via XML-RPC",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.4",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28036",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BMI Calculator Plugin \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bmi-calculator-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Awesome Import \u0026 Export Plugin - Import \u0026 Export WordPress Data \u003c= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Execution/Privilege Escalation",
    "slug": "wp-awesome-import-export",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13232",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Author Box Plugin With Different Description \u003c= 1.3.5 - Cross-Site Request Forgery",
    "slug": "author-box-with-different-description",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39371",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Earnware Connect \u003c= 1.0.74 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "earnware-connect",
    "type": "plugin",
    "affected_version": "* - 1.0.74",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.74",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7651",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Best WordPress Gallery Plugin – FooGallery \u003c= 2.4.16 - Authenticated (Contributor+) Directory Traversal",
    "slug": "foogallery-premium",
    "type": "plugin",
    "affected_version": "* - 2.4.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6947",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Vizeon - Business Consulting \u003c= 1.1.7 - Unauthenticated Local File Inclusion",
    "slug": "vizeon",
    "type": "theme",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31064",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.5.6 - Sensitive Information Exposure via  element_pack_ajax_search",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2966",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Time Slots Booking Form \u003c= 1.2.30 - Cross-Site Request Forgery",
    "slug": "wp-time-slots-booking-form",
    "type": "plugin",
    "affected_version": "* - 1.2.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49332",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Livemesh Addons for WPBakery Page Builder \u003c= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addons-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50370",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Starter Templates by Kadence WP \u003c= 1.2.16 - Authenticated (Admin+) PHP Object Injection",
    "slug": "kadence-starter-templates",
    "type": "plugin",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3679",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dr Affiliate \u003c= 1.2.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "dr-affiliate",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-55975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SIP Reviews Shortcode for WooCommerce \u003c= 1.2.3 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "sip-reviews-shortcode-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6480",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Forms for Mailchimp \u003c= 6.8.8 - Authenticated (Administrator+) Cross-Site Scripting via Form Name",
    "slug": "yikes-inc-easy-mailchimp-extender",
    "type": "plugin",
    "affected_version": "* - 6.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1323",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Contact Forms by Cimatti \u003c= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function",
    "slug": "contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10521",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Restrict Content \u003c= 3.2.8 - Missing Authorization",
    "slug": "restrict-content",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31432",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image optimization service by Optimole \u003c= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload",
    "slug": "optimole-wp",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11519",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image horizontal reel scroll slideshow \u003c= 13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "image-horizontal-reel-scroll-slideshow",
    "type": "plugin",
    "affected_version": "* - 13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5413",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relais 2FA \u003c= 1.0 - Authentication Bypass",
    "slug": "relais-2fa",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10245",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Japanized For WooCommerce \u003c= 2.6.40 - Cross-Site Request Forgery",
    "slug": "woocommerce-for-japan",
    "type": "plugin",
    "affected_version": "* - 2.6.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48284",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Masteriyo - LMS for WordPress \u003c= 1.6.7 - Sensitive Information Exposure",
    "slug": "learning-management-system",
    "type": "plugin",
    "affected_version": "[*, 1.6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-3345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3345",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Shortcodes Blocks Creator Ultimate \u003c= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ultimate-shortcodes-creator",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10340",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Featured Image \u003c= 3.9.2 - Reflected Cross-Site Scripting",
    "slug": "auto-post-thumbnail",
    "type": "plugin",
    "affected_version": "* - 3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24932",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "pageMash \u003e Page Management \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "pagemash",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31087",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Small Package Quotes – Unishippers Edition \u003c= 2.4.8 - Unauthenticated SQL Injection",
    "slug": "small-package-quotes-unishippers-edition",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24665",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Square \u003c= 2.0.0 - Missing Authorization via activate_plugin",
    "slug": "square",
    "type": "theme",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30486",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP STAGING WordPress Backup Plugin \u003c 3.2.0 - Sensitive Information Exposure via cache files",
    "slug": "wp-staging",
    "type": "plugin",
    "affected_version": "[*, 3.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-7204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7204",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Stackable – Page Builder Gutenberg Blocks \u003c= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stackable-ultimate-gutenberg-blocks",
    "type": "plugin",
    "affected_version": "* - 3.13.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12117",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Variable Inspector \u003c= 2.6.3 - Missing Authorization",
    "slug": "variable-inspector",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32229",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Content Blocks (Custom Post Widget) \u003c= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-post-widget",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34566",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Infinite Scroll - Ajax Load More \u003c= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 7.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8505",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom My Account for Woocommerce \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "custom-my-account-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46634",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Loginplus \u003c= 1.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "loginplus",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51782",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Note Press \u003c= 0.1.10 - Authenticated (Admin+) SQL Injection via id Parameter",
    "slug": "note-press",
    "type": "plugin",
    "affected_version": "* - 0.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1690",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Marketing SMS and Newsletters Forms \u003c 2.0.0 - Cross-Site Scripting",
    "slug": "smart-marketing-for-wp",
    "type": "plugin",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18010",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Album and Image Gallery plus Lightbox \u003c= 2.0 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "album-and-image-gallery-plus-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4194",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Social Feed | All social media in one place \u003c= 1.5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting]",
    "slug": "add-facebook",
    "type": "plugin",
    "affected_version": "* - 1.5.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47227",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beacon Lead Magnets and Lead Capture \u003c= 1.5.8 - Cross-Site Request Forgery",
    "slug": "beacon-by",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47596",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nelio AB Testing \u003c 4.6.4 - Cross-Site Request Forgery",
    "slug": "nelio-ab-testing",
    "type": "plugin",
    "affected_version": "[*, 4.6.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18547",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery Manager \u003c= 1.6.58 - Reflected Cross-Site Scripting",
    "slug": "fancy-gallery",
    "type": "plugin",
    "affected_version": "* - 1.6.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10875",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login Lockdown – Protect Login Form \u003c= 2.06 - Authenticated(Administrator+) SQL Injection",
    "slug": "login-lockdown",
    "type": "plugin",
    "affected_version": "[*, 2.07)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.07",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50837",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VK Blocks \u003c= 1.94.2.2 - Missing Authorization to Sensitive Information Exposure",
    "slug": "vk-blocks",
    "type": "plugin",
    "affected_version": "* - 1.94.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.94.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13635",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form by FormGet \u003c= 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "formget-contact-form",
    "type": "plugin",
    "affected_version": "* - 5.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5125",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Awesome Login \u003c= 0.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "wp-awesome-login",
    "type": "plugin",
    "affected_version": "* - 0.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9456",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advance Portfolio Grid \u003c= 1.07.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "advance-portfolio-grid",
    "type": "plugin",
    "affected_version": "* - 1.07.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.07.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57982",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Epicwin Plugin \u003c= 1.5 - Cross-Site Request Forgery to SQL Injection",
    "slug": "epicwin-subscribers",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28986",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro \u003c= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "back-in-stock-notifier-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4038",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "The Holiday Calendar \u003c 1.11.3 - Cross-Site Scripting",
    "slug": "the-holiday-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.11.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9270",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetWidgets For Elementor \u003c= 1.0.8 - Contributor+ Stored Cross-Site Scripting",
    "slug": "jetwidgets-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24268",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Calendar \u003c= 1.4.6 - Reflected Cross-Site Scripting",
    "slug": "calendar-event",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36390",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Made Easy \u003c= 2.3.16 - Missing Authorization",
    "slug": "events-made-easy",
    "type": "plugin",
    "affected_version": "* - 2.3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0404",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "YouTube Channel \u003c 3.0.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "youtube-channel",
    "type": "plugin",
    "affected_version": "* - 3.0.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4756",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Geek \u003c= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "event-geek",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24480",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eazy Plugin Manager \u003c= 4.3.0 - Missing Authorization",
    "slug": "plugins-on-steroids",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32542",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Önceki Yazı Link \u003c= 1.3 - Cross-Site Request Forgery",
    "slug": "onceki-yazi-linki",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27357",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Recently Viewed Products \u003c= 1.0.0 - Unauthenticated PHP Object Injection",
    "slug": "recently-viewed-products",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-34027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34027",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Free WP Mail SMTP \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "free-wp-mail-smtp",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28974",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "G Auto-Hyperlink \u003c= 1.0.1 - Authenticated (Admin+) SQL Injection",
    "slug": "g-auto-hyperlink",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24627",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Categorify \u003c= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "* - 1.0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1652",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce - Social Login \u003c= 2.6.2 - Email Verification due to Insufficient Randomness",
    "slug": "woo-social-login",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5868",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WCP OpenWeather \u003c= 2.5.0 - Reflected Cross-Site Scripting via 'tab'",
    "slug": "wcp-openweather",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25471",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Website Collaboration, Feedback \u0026 Project Management – Atarim \u003c= 3.22.6 - Hardcoded Credentials",
    "slug": "atarim-visual-collaboration",
    "type": "plugin",
    "affected_version": "* - 3.22.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.22.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2038",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Responsive Pricing Table \u003c= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dk-pricr-responsive-pricing-table",
    "type": "plugin",
    "affected_version": "* - 5.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46855",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RAYS Grid \u003c= 1.3.1 - Cross-Site Request Forgery",
    "slug": "rays-grid",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27317",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery \u003c= 1.9.12 - Arbitrary File Upload",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 1.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-3684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3684",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Showing URL in QR Code \u003c= 0.0.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "get-site-to-phone-by-qr-code",
    "type": "plugin",
    "affected_version": "* - 0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3847",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GNUCommerce \u003c= 1.5.4 - Unauthenticated PHP Object Injection",
    "slug": "gnucommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30985",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Login Screen Manager \u003c= 3.5.2 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "login-screen-manager",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5243",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce csv import export \u003c= 2.0.6 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "extendons-eo-wooimport-export",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54029",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Simple Tweet \u003c= 1.4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "simple-tweet",
    "type": "plugin",
    "affected_version": "* - 1.4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45767",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Name Directory \u003c= 1.27.1 - Cross Site Request Forgery",
    "slug": "name-directory",
    "type": "plugin",
    "affected_version": "* - 1.27.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22692",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hot Random Image \u003c= 1.9.2 - Path Traversal to Authenticated (Contributor+) Limited Arbitrary Image Access via path Parameter",
    "slug": "hot-random-image",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4419",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 1.2.11 - Cross-Site Scripting",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-4568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4568",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flash Uploader \u003c= 3.1.2 - Arbitrary Command Execution",
    "slug": "wordpress-flash-uploader",
    "type": "plugin",
    "affected_version": "[*, 3.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-5014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5014",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WDES Responsive Mobile Menu \u003c= 1.2.5 - Unauthenticated PHP Object Injection",
    "slug": "wdes-responsive-mobile-menu",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52414",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Box \u003c= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "* - 4.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9599",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bbPress Move Topics \u003c= 1.1.4 - PHP Object Injection",
    "slug": "bbp-move-topics",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-21005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-21005",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Video Robot - The Ultimate Video Importer \u003c= 1.20.0 - Unauthenticated SQL Injection",
    "slug": "wp-video-robot",
    "type": "plugin",
    "affected_version": "* - 1.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52431",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Stop User Enumeration plugin \u003c1.3.9 - User Enumeration",
    "slug": "stop-user-enumeration",
    "type": "plugin",
    "affected_version": "[*, 1.3.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-1000226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000226",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Allmart \u003c= 1.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "allmart-core",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49418",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jetpack Boost \u003c= 3.4.6 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "jetpack-boost",
    "type": "plugin",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6584",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.6.1 - Cross-Site Request Forgery in listenTosFieldSavingTask function",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32501",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HD Quiz \u003c= 1.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "hd-quiz",
    "type": "plugin",
    "affected_version": "* - 1.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22161",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mapme \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mapme",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51913",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FlexStock \u003c= 3.13.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "stock-sync-with-google-sheet-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30765",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files \u003c= 2.7.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG files",
    "slug": "embed-any-document",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23707",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post SMTP \u003c= 2.9.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52436",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.5.3 - Missing Authorization",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32589",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XML Sitemaps \u003c= 4.1.1 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "google-sitemap-generator",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25088",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10308",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Forms \u003c= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "* - 6.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0660",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.8 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8104",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58205",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All in One Music Player \u003c= 1.3.1 - Authenticated (Contributor+) Path Traversal via theme Parameter",
    "slug": "all-in-one-music-player",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8559",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced What should we write next about \u003c= 1.0.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "advanced-what-should-we-write-about-next",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-55987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55987",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Navigation Du Lapin Blanc \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "navigation-du-lapin-blanc",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22745",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Database Addon \u003c= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter",
    "slug": "contact-form-cfdb7",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6740",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Transients Manager \u003c= 2.0.6 - Cross-Site Request Forgery",
    "slug": "transients-manager",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10045",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gutentor \u003c= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutentor",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22293",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp Limits \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "wp-limits",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24818",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShortLinks Pro \u003c= 1.0.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "shortlinkspro",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49327",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "EleForms \u003c= 2.9.9.9 - Missing Authorization",
    "slug": "all-contact-form-integration-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38748",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AMP WP \u003c= 1.5.15 - Cross-Site Request Forgery via multiple settings pages",
    "slug": "amp-wp",
    "type": "plugin",
    "affected_version": "* - 1.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45831",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Field Suite \u003c= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content]",
    "slug": "custom-field-suite",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3559",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Citadela Listing \u003c= 5.18.1 - Cross-Site Request Forgery",
    "slug": "citadela-directory",
    "type": "plugin",
    "affected_version": "* - 5.18.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.18.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32085",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Search Everything \u003c= 8.1 - Cross-Site Request Forgery",
    "slug": "search-everything",
    "type": "plugin",
    "affected_version": "[*, 8.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-3843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3843",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Accordion Slider Lite \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "accordion-slider-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11892",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.12.8 - Authenticated (Contributor+) Information Disclosure via Shortcode",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 2.12.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1279",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1234",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Slider \u003c= 4.5.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "logo-slider-wp",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12308",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pont \u003c= 1.5 - Arbitrary Options Update",
    "slug": "pont",
    "type": "theme",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9475",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AppMaps \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "appmaps",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54400",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "E2Pdf \u003c= 1.20.18 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "e2pdf",
    "type": "plugin",
    "affected_version": "* - 1.20.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46154",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPBookit \u003c= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover",
    "slug": "wpbookit",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3810",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.1",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.14",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.13",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.16",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.16",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.13",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.10",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.6",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.5",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.4",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5487",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SpeedyCache \u003c= 1.1.2 -  Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "speedycache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49746",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "tagDiv Composer \u003c 3.5 - Unauthorized Account Access and Privilege Escalation",
    "slug": "Newspaper",
    "type": "theme",
    "affected_version": "* - 12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3477",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "tagDiv Composer \u003c 3.5 - Unauthorized Account Access and Privilege Escalation",
    "slug": "newsmag",
    "type": "theme",
    "affected_version": "* - 5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3477",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "tagDiv Composer \u003c 3.5 - Unauthorized Account Access and Privilege Escalation",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "[*, 3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-3477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3477",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wp-Monalisa \u003c= 6.4 - Cross-Site Request Forgery",
    "slug": "wp-monalisa",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48038",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Futurio Extra \u003c= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "futurio-extra",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50446",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chat Bubble \u003c= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chat-bubble",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0898",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple Booking Calendar \u003c= 2.0.10 - Reflected Cross-Site Scripting",
    "slug": "wp-simple-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8663",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export Order, Product, Customer \u0026 Coupon for WooCommerce to Google Sheets \u003c= 1.8.2 - Missing Authorization",
    "slug": "wpsyncsheets-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22667",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Login Page Styler \u003c= 6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "login-page-styler",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46861",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Timeline and History slider \u003c= 2.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "timeline-and-history-slider",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43232",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Yearly Archive \u003c= 2.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-yearly-archive",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25484",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "System Dashboard \u003c= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "system-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.8.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26911",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Site Offline \u003c= 1.5.7 - Missing Authorization",
    "slug": "site-offline",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48348",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Elementor \u003c= 1.24.1 - Registration Bypass",
    "slug": "ultimate-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.24.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-13125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13125",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Website Collaboration, Feedback \u0026 Project Management – Atarim \u003c= 3.30 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "atarim-visual-collaboration",
    "type": "plugin",
    "affected_version": "* - 3.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.30",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2793",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Lightbox \u0026 Gallery \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3742",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmbedPress \u003c= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2468",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FooGallery \u003c= 2.2.44 - Cross-Site Request Forgery",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 2.2.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44233",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Icons \u003c= 2.8.4 - Missing Authorization",
    "slug": "simple-icons",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31786",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.1 - 6.1.3",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38000",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.2 - 6.2.2",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38000",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.3 - 6.3.1",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38000",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.7",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38000",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.5",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38000",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes",
    "slug": "gutenberg",
    "type": "plugin",
    "affected_version": "* - 16.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38000",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Manager \u003c= 1.4.3 - Cross-Site Request Forgery",
    "slug": "contact-form-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-20053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20053",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Download Manager \u003c= 3.2.42 - Reflected Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1985",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BetPress \u003c= 1.0.1 Lite - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "betpress",
    "type": "plugin",
    "affected_version": "* - 1.0.1 Lite",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1 Lite",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48309",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 5.16.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 5.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.16.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24147",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDReseller \u003c= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "gdreseller",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23567",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bacon Ipsum \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bacon-ipsum",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Listdom \u003c= 4.0.0 - Open Redirect",
    "slug": "listdom",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider a SlidersPack \u003c= 2.0.2 - Missing Authorization via wp_spaios_save_attachment_data",
    "slug": "sliderspack-all-in-one-image-sliders",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46845",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Participants Database \u003c= 1.7.5.9 - Unauthorized Cross-Site Scripting",
    "slug": "participants-database",
    "type": "plugin",
    "affected_version": "* - 1.7.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14126",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Block Builder – Lazy Blocks  \u003c= 3.8.2 - Reflected Cross-Site Scripting",
    "slug": "lazy-blocks",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12878",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PGS Core \u003c= 5.9.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "pgs-core",
    "type": "plugin",
    "affected_version": "* - 5.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60118",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Radio Station by netmix® – Manage and play your Show Schedule in WordPress! \u003c= 2.5.7 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "radio-station",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33689",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Member – User Profile, User Registration, Login \u0026 Membership Plugin \u003c= 2.5.0 - Authenticated (Admin+) Directory Traversal",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "1.0 - 2.5.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2445",
    "auth_type": "Privileged",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Cooked Pro \u003c 1.8.0 - Unauthenticated Arbitrary File Upload",
    "slug": "cooked-pro",
    "type": "plugin",
    "affected_version": "[*, 1.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2024-49291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49291",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LearnPress \u003c= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9881",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDiscuz \u003c= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51691",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bauernregeln \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "bauernregeln",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23838",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "News, Magazine and Blog Elements \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "news-magazine-and-blog-elements",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31740",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced iFrame \u003c= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 2024.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1341",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mediamatic – Media Library Folders \u003c= 2.8.1 - Missing Authorization",
    "slug": "mediamatic",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0293",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP EASY RECIPE \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-easy-recipe",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flatsome \u003c= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "flatsome",
    "type": "plugin",
    "affected_version": "* - 3.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8684",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP EasyCart \u003c= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_product",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2892",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Simple:Press \u003c= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Signatures",
    "slug": "simplepress",
    "type": "plugin",
    "affected_version": "* - 6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4028",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wonder PDF Embed \u003c= 1.6 - Contributor+ Stored Cross-Site Scripting",
    "slug": "wonderplugin-pdf-embed",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24541",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Fortnox Integration \u003c= 4.5.5 - Missing Authorization",
    "slug": "woocommerce-fortnox-integration",
    "type": "plugin",
    "affected_version": "* - 4.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49998",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Classified Listing Pro \u003c 2.0.20 - Reflected Cross-Site Scripting",
    "slug": "classified-listing-pro",
    "type": "plugin",
    "affected_version": "[*, 2.0.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.20",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2655",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid and Gutenberg Blocks \u003c= 2.3.11 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54007",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "URL Shortify \u003c= 1.7.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "url-shortify",
    "type": "plugin",
    "affected_version": "* - 1.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5605",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Portfolio for Elementor \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "portfolio-elementor",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4765",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.5.30.7210 - Cross-Site Request Forgery",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.30.7210",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.30.7210",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25066",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Indexer \u003c= 3.0.6.1 - PHP Object Injection",
    "slug": "post-indexer",
    "type": "plugin",
    "affected_version": "[*, 3.0.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10948",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Smart Preloader \u003c= 1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-smart-preloader",
    "type": "plugin",
    "affected_version": "* - 1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23675",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LinkedInclude \u003c= 3.0.4 - Cross-Site Request Forgery",
    "slug": "linkedinclude",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57918",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ad Inserter \u003c= 2.7.9 - Reflected Cross-Site Scripting",
    "slug": "ad-inserter",
    "type": "plugin",
    "affected_version": "[*, 2.7.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0288",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BP Direct Menus \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bp-direct-menus",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10189",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Catch Duplicate Switcher \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "catch-duplicate-switcher",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23619",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TWIPLA (Visitor Analytics IO) \u003c= 1.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "visitor-analytics-io",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31937",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hillter \u003c= 3.0.7 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "hillter",
    "type": "theme",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24777",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TS Poll – Survey, Versus Poll, Image Poll, Video Poll \u003c= 2.4.0 - Authenticated (Administrator+) SQL Injection via orderby Parameter",
    "slug": "poll-wp",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9022",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smooth Scroll Page Up/Down Buttons \u003c= 1.3 - Admin+ Stored Cross-Site Scripting",
    "slug": "smooth-page-scroll-updown-buttons",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24418",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid and Gutenberg Blocks \u003c= 2.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50432",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AWeber  \u003c= 7.3.20 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "aweber-web-form-widget",
    "type": "plugin",
    "affected_version": "* - 7.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13313",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function",
    "slug": "peprodev-ups",
    "type": "plugin",
    "affected_version": "1.9.1 - 7.5.2",
    "from_version": "1.9.1",
    "from_inclusive": true,
    "to_version": "7.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3921",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Simple WP Events \u003c= 1.8.17 - Unauthenticated Arbitrary File Deletion",
    "slug": "simple-wp-events",
    "type": "plugin",
    "affected_version": "* - 1.8.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.17",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2004",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "vipdrv \u003c= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "vipdrv-vip-test-drive",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58884",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3527",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 5.7 - Missing Authorization via update_cdn_status",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45000",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Graphina \u003c= 3.0.4 - Missing Authorization",
    "slug": "graphina-elementor-charts-and-graphs",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47480",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form by ContactMe.com \u003c= 2.3 - Cross-Site Scripting",
    "slug": "contactme",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4518",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VKontakte Wall Post \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "vkontakte-wall-post",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49313",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VPSUForm \u003c= 3.2.20 - Missing Authorization",
    "slug": "v-form",
    "type": "plugin",
    "affected_version": "* - 3.2.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58957",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Woo Labels \u003c= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-woo-labels",
    "type": "plugin",
    "affected_version": "* - 2.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Views – Post Grid \u0026 Filter, Recent Posts, Category Posts, \u0026 More (Gutenberg Blocks and Shortcode) \u003c= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Post Overlay",
    "slug": "content-views-query-and-display-post-page",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3929",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Shoppette Theme \u003c 1.0.5 - Cross-Site Scripting",
    "slug": "shoppette",
    "type": "theme",
    "affected_version": "[*, 1.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9535",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Category Banner Management \u003c= 2.4.1 - Cross-Site Request Forgery",
    "slug": "banner-management-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39158",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShareThis Dashboard for Google Analytics \u003c= 3.2.2 - Cross-Site Request Forgery",
    "slug": "googleanalytics",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32282",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Gallery – Responsive Photo Gallery \u003c= 1.0.5 - Missing Authorization",
    "slug": "awesome-responsive-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24697",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooMail - WooCommerce Email Customizer \u003c= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection",
    "slug": "email-customizer-for-woocommerce-with-drag-drop-builder",
    "type": "plugin",
    "affected_version": "* - 3.0.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13747",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple YouTube Responsive \u003c= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-youtube-responsive",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25982",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PGS Core \u003c= 5.8.0 - Unauthenticated PHP Object Injection",
    "slug": "pgs-core",
    "type": "plugin",
    "affected_version": "* - 5.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-0855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0855",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appointment Booking Calendar \u003c= 1.3.82 - Cross-Site Request Forgery",
    "slug": "appointment-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 1.3.82",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.82",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0856",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP GDPR Compliance \u003c= 1.4.2 - Arbitrary Options Update and Action Calling",
    "slug": "wp-gdpr-compliance",
    "type": "plugin",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-19207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19207",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Full Screen (Page) Background Image Slideshow \u003c= 1.1 Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "full-screen-page-background-image-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11221",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Categorify \u003c= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "* - 1.0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1650",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Traveler \u003c= 3.2.0 - Missing Authorization",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26733",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Backup \u0026 Migration \u003c= 1.4.7 - Unauthenticated Sensitive Information Exposure",
    "slug": "wp-migration-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31254",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Portfolio Gallery – Image Gallery Plugin \u003c= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "portfolio-filter-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29769",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Atarim \u003c= 3.9.3 - Reflected Cross-Site Scripting",
    "slug": "atarim-visual-collaboration",
    "type": "plugin",
    "affected_version": "* - 3.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37393",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Trash Duplicate and 301 Redirect \u003c= 1.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion",
    "slug": "trash-duplicate-and-301-redirect",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13468",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Advanced Google reCAPTCHA \u003c= 1.29 - Authenticated (Subscriber+) Limited SQL Injection via 'sSearch' Parameter",
    "slug": "advanced-google-recaptcha",
    "type": "plugin",
    "affected_version": "* - 1.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2074",
    "auth_type": "Auth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Meta Field Block \u003c= 1.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "display-a-meta-field-as-block",
    "type": "plugin",
    "affected_version": "* - 1.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43278",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDiscuz \u003c= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-46311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46311",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JSON Structuring Markup \u003c= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "json-structuring-markup",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31908",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Easybooking \u003c= 1.0.3 - Cross-Site Scripting",
    "slug": "wp-easybooking",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4584",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Staging Pro \u003c= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function",
    "slug": "wp-staging-pro",
    "type": "plugin",
    "affected_version": "* - 6.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3104",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FluentCommunity \u003c= 1.2.15 - Unauthenticated PHP Object Injection",
    "slug": "fluent-community",
    "type": "plugin",
    "affected_version": "* - 1.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39550",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Voting Contest \u003c 3.0 - Reflected Cross-Site Scripting",
    "slug": "wp-voting-contest",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0321",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export Users to CSV \u003c= 1.1.1 - CSV Injection",
    "slug": "export-users-to-csv",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-15571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-15571",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "STAGGS \u003c= 2.11.0 - Unauthenticated Arbitrary File Upload",
    "slug": "staggs",
    "type": "plugin",
    "affected_version": "* - 2.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47637",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Podlove Podcast Publisher \u003c 2.3.16 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 2.3.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10941",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP SexyLightBox \u003c= 0.5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-sexylightbox",
    "type": "plugin",
    "affected_version": "* - 0.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32478",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Live Chat + Chatbots Plugin for WordPress – Chaport \u003c= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chaport",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30977",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form \u003c= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "contact-form-ready",
    "type": "plugin",
    "affected_version": "* - 2.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30935",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible \u003c= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification",
    "slug": "wc-frontend-manager",
    "type": "plugin",
    "affected_version": "* - 6.7.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3780",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Fonto – Custom Web Fonts Manager \u003c= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "fonto",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8920",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "4 author cheer up donate \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "4-author-cheer-up-donate",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23670",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iPanorama 360 WordPress Virtual Tour Builder \u003c= 1.8.1 - Missing Authorization",
    "slug": "ipanorama-360-virtual-tour-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33941",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "My Resume Builder \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "my-resume-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53336",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goodlayers Core \u003c= 2.0.7 - Reflected Cross-Site Scripting via 'font-family'",
    "slug": "goodlayers-core",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11200",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CP Contact Form with PayPal \u003c= 1.3.52 - Cross-Site Request Forgery",
    "slug": "cp-contact-form-with-paypal",
    "type": "plugin",
    "affected_version": "* - 1.3.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13758",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Video Playlist For YouTube \u003c= 6.1 - Cross-Site Request Forgery",
    "slug": "video-playlist-for-youtube",
    "type": "plugin",
    "affected_version": "* - 6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45653",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iPanorama 360 – WordPress Virtual Tour Builder \u003c= 1.8.0 -  Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "ipanorama-360-virtual-tour-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5336",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Simple Events \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-simple-events",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24376",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CC \u0026 BCC for Woocommerce Order Emails \u003c= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cc-bcc-for-woocommerce-order-emails",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37522",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TheGem (Elementor) \u003c= 5.10.5 - Missing Authorization",
    "slug": "thegem-elementor",
    "type": "theme",
    "affected_version": "* - 5.10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60096",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GD bbPress Attachments \u003c 2.3 - Directory Traversal",
    "slug": "gd-bbpress-attachments",
    "type": "plugin",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-5482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5482",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tour Master - Tour Booking, Travel, Hotel \u003c= 5.3.4 - Reflected Cross-Site Scripting",
    "slug": "tourmaster",
    "type": "plugin",
    "affected_version": "* - 5.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12400",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DWT - Directory \u0026 Listing WordPress Theme \u003c=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "dwt-listing",
    "type": "theme",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0169",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rankie \u003c= 1.8.2 - Reflected Cross-Site Scripting",
    "slug": "valvepress-rankie",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39487",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Responsive Tabs horizontal vertical and accordion Tabs \u003c= 1.1.15 - Reflected Cross-Site Scripting",
    "slug": "responsive-horizontal-vertical-and-accordion-tabs",
    "type": "plugin",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24409",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Blocks (Custom Post Widget) \u003c= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_block Shortcode",
    "slug": "custom-post-widget",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3565",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feed Them Social – for Twitter feed, Youtube and more \u003c= 2.9.9 - Subscriber+ Stored Cross-Site Scripting",
    "slug": "feed-them-social",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2532",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Post Corrector \u003c= 1.0.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-post-corrector",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26003",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Photoswipe \u003c= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-photoswipe",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5473",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dollie Hub – Build Your Own WordPress Cloud Platform \u003c= 6.2.0 - Authenticated (Contributor+) Post Disclosure",
    "slug": "dollie",
    "type": "plugin",
    "affected_version": "* - 6.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12099",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Duplicator Pro \u003c= 4.5.11 - Reflected Cross-Site Scripting",
    "slug": "duplicator-pro",
    "type": "plugin",
    "affected_version": "* - 4.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33309",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Insert or Embed Articulate Content into WordPress \u003c 4.29991 - Directory Traversal",
    "slug": "insert-or-embed-articulate-content-into-wordpress",
    "type": "plugin",
    "affected_version": "[*, 4.29991)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.29991",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15648",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Custom Fonts – Host Your Fonts Locally \u003c= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "custom-fonts",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1332",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Bulb Finder for WordPress \u003c= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "auto-bulb-finder-for-wp-wc",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9858",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Showcase Ultimate – Logo Carousel, Logo Slider \u0026 Logo Grid \u003c= 1.3.8 - Authenticated(Contributor+) PHP Object Injection",
    "slug": "logo-showcase-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1951",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Views for WPForms \u003c= 3.2.2 - Missing Authorization via get_form_fields",
    "slug": "views-for-wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0372",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "The Plus Blocks for Block Editor | Gutenberg \u003c= 3.2.5 - Reflected Cross-Site Scripting",
    "slug": "the-plus-addons-for-block-editor",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery, Images, Slider in Rbs Image Gallery \u003c= 3.2.23 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13384",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mega Elements \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget",
    "slug": "mega-elements-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4702",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Symposium \u003c 15.4 - SQL Injection",
    "slug": "wp-symposium",
    "type": "plugin",
    "affected_version": "[*, 15.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-3325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3325",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "woocommerce-mercadopago",
    "type": "plugin",
    "affected_version": "7.3.0 - 7.6.1",
    "from_version": "7.3.0",
    "from_inclusive": true,
    "to_version": "7.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3934",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simply Excerpts \u003c= 1.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simply-excerpts",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5137",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Timeline Pro \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via [placeholder]",
    "slug": "timeline-pro",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22584",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web – Mobile-Friendly Drag \u0026 Drop Contact Form Builder \u003c= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10265",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP iCal Availability \u003c= 1.0.3 - Missing Authorization",
    "slug": "wp-ical-availability",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46607",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cookie Warning \u003c= 1.3 - Cross-Site Request Forgery",
    "slug": "cookie-warning",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49426",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "reCaptcha by BestWebSoft \u003c= 1.12 - CAPTCHA Bypass",
    "slug": "google-captcha",
    "type": "plugin",
    "affected_version": "[*, 1.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-0890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-0890",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \u003c= 1.27.8 - Cross-Site Request Forgery",
    "slug": "post-and-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.27.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52711",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPFront Notification Bar \u003c= 3.3.2 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wpfront-notification-bar",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29819",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Course Builder - Online Course WordPress Theme \u003c 3.6.6 - Unauthenticated PHP Object Injection",
    "slug": "course-builder",
    "type": "theme",
    "affected_version": "[*, 3.6.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-48336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48336",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OPSI Israel Domestic Shipments \u003c= 2.6.8 - Missing Authorization",
    "slug": "woo-ups-pickup",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23766",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ImageMagick Sharpen Resized Images \u003c= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "imagemagick-sharpen-resized-images",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34790",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada \u003c= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1668",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6924",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iFeature Slider \u003c= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ifeature-slider",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45375",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34575",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yoast SEO \u003c= 3.4.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "[*, 3.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24153",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Consent by Supsystic \u003c= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gdpr-compliance-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49191",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AVIF \u0026 SVG Uploader \u003c= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "avif-support",
    "type": "plugin",
    "affected_version": "1.1.0",
    "from_version": "1.1.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9060",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Images Ape \u003c= 2.0.6 - Authenticated Plugin Deactivation",
    "slug": "gallery-images-ape",
    "type": "plugin",
    "affected_version": "[*, 2.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-25149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25149",
    "auth_type": "Auth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.262",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.262",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3338",
    "auth_type": "Auth",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Limit Bio \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "limit-bio",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13884",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Log \u003c= 2.4.8 - Unauthenticated Hook Injection",
    "slug": "email-log",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0867",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Events Calendar \u003c= 6.6.4 - Unauthenticated SQL Injection",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8275",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI Chatbot for WordPress – Hyve Lite \u003c= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "hyve-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24666",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinpoint Booking System – #1 WordPress Booking Plugin \u003c= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "* - 2.9.9.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13235",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Cloud SAML SSO \u003c= 1.0.19 - Missing Authorization to Unauthenticated Identity Provider Deletion via delete_config Action",
    "slug": "cloud-sso-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 1.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7045",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Wd-image-magnifier-xoss \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wd-image-magnifier-xoss",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51840",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web3Press \u003c= 3.2.0 - Authenticated (Contributor+) Arbitrary File Read",
    "slug": "likecoin",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46527",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Google Tag Manager \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "wp-google-tag-manager",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22693",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NextScripts: Social Networks Auto-Poster \u003c= 4.3.17 - Missing Authorization",
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "type": "plugin",
    "affected_version": "* - 4.3.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36831",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "SNORDIAN's H5PxAPIkatchu \u003c= 0.4.14 - Missing Authorization",
    "slug": "h5pxapikatchu",
    "type": "plugin",
    "affected_version": "* - 0.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30821",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content – ProfilePress \u003c= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13121",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Auction Plugin \u003c= 3.7 - Authenticated (Editor+) SQL Injection",
    "slug": "wp-auctions",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22349",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Ultimate Tours Builder \u003c= 1.055 - Cross-Site Request Forgery",
    "slug": "WP_UltimateToursBuilder",
    "type": "plugin",
    "affected_version": "* - 1.055",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.055",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31921",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Razorpay Payment Button \u003c= 2.4.6 - Reflected Cross-Site Scripting",
    "slug": "razorpay-payment-button",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10851",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 6.2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3246",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Help Desk – The Ultimate Help Desk \u0026 Support Plugin \u003c= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13607",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CMSMasters Content Composer \u003c= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "cmsmasters-content-composer",
    "type": "plugin",
    "affected_version": "* - 1.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7963",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Quick Setup \u003c= 2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin/Theme Installation",
    "slug": "wp-quick-setup",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52429",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Earth Embed \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-earth-tours",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25078",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CubeWP – All-in-One Dynamic Content Framework \u003c= 1.1.12 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "cubewp-framework",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30500",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Contact Form Builder \u0026 Lead Generation Plugin \u003c= 1.9.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "lead-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4261",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ez Form Calculator - WordPress plugin \u003c= 2.14.1.2 - Reflected Cross-Site Scripting",
    "slug": "ez-form-calculator-premium",
    "type": "plugin",
    "affected_version": "* - 2.14.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22282",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.2 - 6.2.7",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.23",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.16",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.11",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.3 - 6.3.6",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.6 - 6.6.3",
    "from_version": "6.6",
    "from_inclusive": true,
    "to_version": "6.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.26",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.27",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.20",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.13",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.7 - 6.7.3",
    "from_version": "6.7",
    "from_inclusive": true,
    "to_version": "6.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.22",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.17",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.15",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.10",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.1 - 6.1.8",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.4 - 6.4.6",
    "from_version": "6.4",
    "from_inclusive": true,
    "to_version": "6.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.5 - 6.5.6",
    "from_version": "6.5",
    "from_inclusive": true,
    "to_version": "6.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.8 - 6.8.2",
    "from_version": "6.8",
    "from_inclusive": true,
    "to_version": "6.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.30",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.19",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.11",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flattr \u003c= 1.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "flattr",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3920",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Foyer \u003c= 1.7.5 - Content Injection via Improper Access Control",
    "slug": "foyer",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47663",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Mega Menu Plugin for WordPress – ThemeHunk \u003c= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "themehunk-megamenu-plus",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8433",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Collapse-O-Matic \u003c= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "jquery-collapse-o-matic",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4475",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPKit For Elementor \u003c= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Options Update",
    "slug": "wpkit-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32281",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Comments - wpDiscuz \u003c= 7.3.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24737",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Extension For Mailchimp \u003c= 0.5.73 - Cross-Site Request Forgery",
    "slug": "contact-form-7-mailchimp-extension",
    "type": "plugin",
    "affected_version": "* - 0.5.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33677",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page View Count \u003c= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "page-views-count",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0095",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Address Encoder \u003c= 1.0.23 - Cross-Site Request Forgery via eae_clear_caches()",
    "slug": "email-address-encoder",
    "type": "plugin",
    "affected_version": "* - 1.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43927",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields Pro \u003c= 6.2.9 - Authenticated (Contributor+) Code Injection",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "* - 6.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-34761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34761",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Schema Pro \u003c= 2.7.8 - Authenticated(Contributor+) Missing Authorization",
    "slug": "wp-schema-pro",
    "type": "plugin",
    "affected_version": "* - 2.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36683",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PropertyHive \u003c= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34381",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "weForms \u003c= 1.6.18 - Missing Authorization via export_form_entries",
    "slug": "weforms",
    "type": "plugin",
    "affected_version": "* - 1.6.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51524",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Clever Addons for Elementor \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cafe-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51580",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Compliance \u003c= 4.0.2 - Missing Authorization",
    "slug": "gdpr-cookie-compliance",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-25143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25143",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Advanced File Manager \u003c= 5.2.4 - Sensitive Information Exposure via Directory Listing",
    "slug": "file-manager-advanced",
    "type": "plugin",
    "affected_version": "* - 5.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5598",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MainWP Wordfence Extension \u003c= 4.0.7 - Missing Authorization to Plugin Settings Change",
    "slug": "mainwp-wordfence-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23669",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Estatik \u003c= 2.2.5 - Unauthenticated Arbitrary File Upload",
    "slug": "estatik",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-10958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10958",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wr Age Verification \u003c= 2.0.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wr-age-verification",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55979",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "5 Anker Connect \u003c= 1.2.6 - Reflected Cross-Site Scripting",
    "slug": "5-anker-connect",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-30545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-30545",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.8.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11832",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "loader-utils (JS package) \u003c 2.0.3 - Prototype Pollution",
    "slug": "elasticpress",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37601",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "loader-utils (JS package) \u003c 2.0.3 - Prototype Pollution",
    "slug": "maps-block-apple",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37601",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "loader-utils (JS package) \u003c 2.0.3 - Prototype Pollution",
    "slug": "insert-special-characters",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37601",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Charitable – Donation Plugin \u003c= 1.6.50 - Authenticated Stored Cross-Site Scripting",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "* - 1.6.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24531",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43983",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Error Log Viewer by BestWebSoft \u003c= 1.1.6 - Authenticated (Administrator+) Arbitrary File Read",
    "slug": "error-log-viewer",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9950",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CSS3 Accordions for WordPress \u003c= 3.0 - Missing Authorization",
    "slug": "css3_accordions",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31923",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Login and Registration \u003c= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "ms-registration",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39363",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TicketBAI Facturas para WooCommerce \u003c= 3.18 - Unauthenticated Arbitrary File Deletion",
    "slug": "wp-ticketbai",
    "type": "plugin",
    "affected_version": "* - 3.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4564",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.980 - Authenticated (Author+) External Entity Injection",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.980",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.980",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50442",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "short.io \u003c= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-shortcm",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mangboard \u003c= 1.9.9 - SQL Injection",
    "slug": "mangboard",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-26609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-26609",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Shine PDF Embeder \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shine-pdf",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11412",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Replace Word \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "replace-word",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37973",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sign In With Google \u003c= 1.8.0 - Authentication Bypass in authenticate_user",
    "slug": "sign-in-with-google",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11015",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "System Dashboard  \u003c= 2.8.9 - Reflected Cross-Site Scripting via X-Forwarded-For",
    "slug": "system-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7246",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flexi Quote Rotator \u003c= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "flexi-quote-rotator",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2328",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Login Page \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-custom-login-page",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26012",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ULike 4.7.1 - 4.7.2 - Authenticated (Subscriber+) Stored-Cross-Site Scripting",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "4.7.1 - 4.7.2",
    "from_version": "4.7.1",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6792",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SecureSubmit \u003c= 1.5.18 - Missing Authorization",
    "slug": "securesubmit",
    "type": "plugin",
    "affected_version": "* - 1.5.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56271",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Breeze \u003c= 2.1.14 - Missing Authorization",
    "slug": "breeze",
    "type": "plugin",
    "affected_version": "* - 2.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50422",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "InstaWP Connect \u003c= 0.1.0.85 - Unauthenticated Local PHP File Inclusion",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.85",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.85",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2636",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Enfold \u003c= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id",
    "slug": "enfold",
    "type": "theme",
    "affected_version": "* - 6.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13695",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetBackup \u003c= 2.0.9.7 - Sensitive Information Exposure via Directory Listing",
    "slug": "backup",
    "type": "plugin",
    "affected_version": "* - 2.0.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-7165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7165",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CRM ERP Business Solution \u003c= 1.13 - Missing Authorization",
    "slug": "crm-erp-business-solution",
    "type": "plugin",
    "affected_version": "* - 1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49987",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Debug Assistant \u003c= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "debug-assistant",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26527",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export and Import Users and Customers \u003c= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function",
    "slug": "users-customers-import-export-for-wp-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-1972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1972",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShopLentor \u003c= 2.5.1 - Cross-Site Request Forgery to Post Updates",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46798",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Lodgix.com Vacation Rental Website Builder \u003c= 3.9.73 - Authenticated (Contributor+) SQL Injection",
    "slug": "lodgixcom-vacation-rental-listing-management-booking-plugin",
    "type": "plugin",
    "affected_version": "* - 3.9.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50539",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "HTML5 Radio Player - WPBakery Page Builder Addon \u003c= 2.5 - Reflected Cross-Site Scripting",
    "slug": "lbg_radio_player_addon_visual_composer",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53564",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.101 - Reflected Cross-Site Scripting",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.101",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.101",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32526",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple JWT Login \u003c= 3.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-jwt-login",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58648",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH Custom Login \u003c= 1.7.3 - Reflected Cross-Site Scripting",
    "slug": "yith-custom-login",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8665",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPS Child Theme Generator \u003c 1.2 - Directory Traversal",
    "slug": "wps-child-theme-generator",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-15822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15822",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Max Addons Pro for Bricks \u003c= 1.6.1 - Missing Authorization",
    "slug": "max-addons-pro-bricks",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32951",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Panorama – WordPress Project Management Plugin \u003c= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "project-panorama-lite",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23810",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WeShare Buttons \u003c= 13.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "e-mailit",
    "type": "plugin",
    "affected_version": "* - 13.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60135",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Creative Mail \u003c= 1.5.4 - Cross-Site Request Forgery to Settings Disconnect",
    "slug": "creative-mail-by-constant-contact",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40687",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OAuth Single Sign On – SSO (OAuth Client) \u003c= 6.26.12 - Cross-Site Request Forgery",
    "slug": "miniorange-login-with-eve-online-google-facebook",
    "type": "plugin",
    "affected_version": "* - 6.26.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.26.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10752",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WizShop \u003c= 3.0.2 - Unauthenticated Local File Inclusion",
    "slug": "wizshop",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-25122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25122",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "InLinks \u003c= 1.1 - Authenticated SQL Injection",
    "slug": "inlinks",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-16955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16955",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Restaurant \u0026 Cafe Addon for Elementor \u003c= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "restaurant-cafe-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54316",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Anti Spambot \u003c= 1.0.1 - Missing Authorization",
    "slug": "contact-form-7-anti-spambot",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23862",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPB Image Widget \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpb-image-widget",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58858",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Table for WooCommerce by CodeAstrology (wooproducttable.com) \u003c= 3.5.1 - Information Exposure",
    "slug": "woo-product-table",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10813",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Pollin \u003c= 1.01.1 - Authenticated (Admin+) SQL Injection",
    "slug": "pollin",
    "type": "plugin",
    "affected_version": "* - 1.01.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13712",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "XML for Avito \u003c= 2.5.2 - Reflected Cross-Site Scripting",
    "slug": "xml-for-avito",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24646",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Like Box – Popup – Sidebar Widget \u003c 2.8.3 - Cross-Site Scripting",
    "slug": "cardoza-facebook-like-box",
    "type": "plugin",
    "affected_version": "[*, 2.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9524",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "W3 Total Cache \u003c= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "[*, 2.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24427",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PostX \u003c= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 4.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10728",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Assistant for NextGEN Gallery \u003c= 1.0.9 - Unauthenticated Arbitrary Directory Deletion",
    "slug": "assistant-for-nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7641",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Bitly's WordPress Plugin \u003c= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-bitly",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5577",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Skitter Slideshow \u003c= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-skitter-slideshow",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28906",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Code Embed \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-embed-code",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8804",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSV GMaps \u003c= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "rsv-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23665",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "April's Super Functions Pack  \u003c= 1.4.7 - Reflected Cross-Site Scripting",
    "slug": "aprils-super-functions-pack",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-100026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-100026",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Signup Form \u003c= 1.6.5 - Authenticated (Contributor+) SQL Injection",
    "slug": "simple-signup-form",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13595",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CS Framework \u003c= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "cs-framework",
    "type": "plugin",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP RSS By Publishers \u003c= 0.1 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-rss-by-publishers",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4359",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Interactive US Map \u003c= 2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "interactive-us-map",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32661",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eventr \u003c= 1.02.2 - SQL Injection",
    "slug": "eventr",
    "type": "plugin",
    "affected_version": "* - 1.02.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.02.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002018",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Auto YouTube Importer \u003c= 1.0.3 - Cross-Site Request Forgery",
    "slug": "auto-youtube-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23797",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Free counter \u003c= 1.1 -  Stored Cross-Site Scripting",
    "slug": "free-counter",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-4084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4084",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DSGVO All in one for WP \u003c= 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dsgvo-all-in-one-for-wp",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43964",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.3.2 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12875",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Booking Calendar Contact Form \u003c= 1.2.55 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "booking-calendar-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.2.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.55",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24723",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced uploader \u003c= 4.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "advanced-uploader",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1103",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Jet Skinner for BuddyPress \u003c= 1.2.5 - Reflected Cross-Site Scripting",
    "slug": "jet-skinner-for-buddypress",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23706",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.7.0 - Cross-Site Request Forgery",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24537",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Add Code To Head \u003c= 1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "add-code-to-head",
    "type": "plugin",
    "affected_version": "* - 1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48314",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mega Addons For WPBakery Page Builder \u003c= 4.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "mega-addons-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 4.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0268",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.3.1 - Missing Authorization",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24618",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Portfolio Gallery – Image Gallery Plugin \u003c= 1.6.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "portfolio-filter-gallery",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6262",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "coreActivity \u003c= 2.0.1 - IP Spoofing",
    "slug": "coreactivity",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0868",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Mobile URL Redirect \u003c= 1.7.2 - Cross-Site Request Forgery leading to Mobile Redirect Updates",
    "slug": "simple-mobile-url-redirect",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23897",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Easy Addons for Elementor \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49631",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Maps CP \u003c= 1.0.43 - Cross-Site Request Forgery via feedback_action",
    "slug": "codepeople-post-map",
    "type": "plugin",
    "affected_version": "* - 1.0.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25039",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via \"Product Files\"",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10518",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Live Cricket WordPress Lite \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-live-cricket-lite",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31597",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maspik – Spam blacklist \u003c= 0.10.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "contact-forms-anti-spam",
    "type": "plugin",
    "affected_version": "* - 0.10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.10.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25101",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CMP – Coming Soon \u0026 Maintenance \u003c= 4.1.10 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "cmp-coming-soon-maintenance",
    "type": "plugin",
    "affected_version": "* - 4.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50374",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Htaccess by BestWebSoft – WordPress Website Access Control Plugin \u003c= 1.7.5 - Reflected Cross-Site Scripting",
    "slug": "htaccess",
    "type": "plugin",
    "affected_version": "[*, 1.7.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18496",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVT Simple \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "svt-simple",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51759",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CarDealerPress \u003c= 6.6.2410.02 - Reflected Cross-Site Scripting",
    "slug": "cardealerpress",
    "type": "plugin",
    "affected_version": "* - 6.6.2410.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.2410.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54325",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.6.24 - Authenticated (Admin+) Arbitrary File Deletion",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36505",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Stamped.io Product Reviews \u0026 UGC for WooCommerce \u003c= 2.3.2 - Missing Authorization",
    "slug": "stampedio-product-reviews",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30479",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Inactive Logout \u003c= 3.2.2 - Missing Authorization",
    "slug": "inactive-logout",
    "type": "plugin",
    "affected_version": "[*, 3.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44142",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.8.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2123",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Addon Library \u003c= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "addon-library",
    "type": "plugin",
    "affected_version": "* - 1.3.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.76",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1710",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Product Tabs Lite for WooCommerce \u003c= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injection",
    "slug": "woocommerce-custom-product-tabs-lite",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12600",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Loco Translate \u003c= 2.5.3 - Authenticated PHP Code Injection",
    "slug": "loco-translate",
    "type": "plugin",
    "affected_version": "[*, 2.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24721",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "PDF Flipbook, 3D Flipbook – DearFlip \u003c= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "3d-flipbook-dflip-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0895",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Mediabay \u003c= 1.6 - Authenticated (Editor+) Stored Cross-Site Scripting Vulnerability",
    "slug": "mediabay-lite",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46066",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BabelZ – Google Translate Widget \u003c= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "babelz",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8095",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple shortcode buttons \u003c= 1.3.2 - Reflected Cross-Site Scripting",
    "slug": "simple-shortcode-buttons",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23449",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Spaces - WordPress Properties Directory Theme \u003c= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register'",
    "slug": "real-spaces",
    "type": "theme",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6758",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Betheme \u003c= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 26.5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.5.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45077",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slideshow Gallery \u003c= 1.6.8 - Cross-Site Scripting",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-18019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-18019",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Urdu Formatter – Shamil \u003c= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "urdu-formatter-shamil",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22531",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Flv \u003c= 1.0 - Cross-Site Scripting",
    "slug": "smart-flv",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-1765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1765",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup box \u003c= 3.4.4 - Reflected Cross-Site Scripting via 'ays_pb_tab' Parameter",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27414",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Amministrazione Aperta \u003c= 3.7.3 - Admin+ Local File Inclusion",
    "slug": "amministrazione-aperta",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1560",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar WpDevArt \u003c= 3.2.19 - Authenticated (Contributor+) SQL Injection",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "* - 3.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10856",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MailOptin \u003c= 1.2.54.0 - Authenticated (Admin+) Cross Site Scripting",
    "slug": "mailoptin",
    "type": "plugin",
    "affected_version": "1.2.54.0",
    "from_version": "1.2.54.0",
    "from_inclusive": true,
    "to_version": "1.2.54.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23980",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4571",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Sharkdropship for AliExpress Dropship and Affiliate \u003c= 2.2.4 - Missing Authorization",
    "slug": "wooshark-aliexpress-importer",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-30870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30870",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Echo RSS Feed Post Generator \u003c= 5.4.8.1 - Reflected Cross-Site Scripting",
    "slug": "rss-feed-post-generator-echo",
    "type": "plugin",
    "affected_version": "* - 5.4.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49312",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress Docs \u003c= 2.2.3 - Reflected Cross-Site Scripting",
    "slug": "buddypress-docs",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9207",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Doc Embedder \u003c= 2.6 - Cross-Site Scripting",
    "slug": "google-document-embedder",
    "type": "plugin",
    "affected_version": "[*, 2.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10880",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multilang Contact Form \u003c= 1.5 - Reflected Cross-Site Scripting",
    "slug": "multilang-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22795",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anthologize \u003c= 0.8.2 - Cross-Site Request Forgery",
    "slug": "anthologize",
    "type": "plugin",
    "affected_version": "* - 0.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30823",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JetWidgets For Elementor \u003c= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jetwidgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0034",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Library Management System \u003c= 3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Manipulation",
    "slug": "library-management-system",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10303",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.4.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37499",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EmbedPress \u003c= 3.9.1 - Reflected Cross-Site Scripting",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5749",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 1.6.6 - Unauthenticated Arbitrary Account Creation",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4343",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery \u003c= 1.5.1 - Cross-Site Scripting",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2010-1186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-1186",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZooEffect Plugin for Video player, Photo Gallery Slideshow jQuery and audio / music / podcast – HTML5 \u003c= 1.11 - Reflected Cross-Site Scripting",
    "slug": "1-jquery-photo-gallery-slideshow-flash",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-5180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5180",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks – Page Builder Features \u003c= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4208",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shariff Wrapper \u003c= 4.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "shariff",
    "type": "plugin",
    "affected_version": "* - 4.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2695",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Depicter \u003c= 3.0.2 - Authenticated (Contributor+) Arbitrary Nonce Generation",
    "slug": "depicter",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4390",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Social Chat – Click To Chat App \u003c= 6.0.4 - Administrator+ Stored Cross-Site Scripting",
    "slug": "wp-whatsapp-chat",
    "type": "plugin",
    "affected_version": "* - 6.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2361",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HollerBox \u003c= 2.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "holler-box",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41657",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jet Elements \u003c= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.7.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0371",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX \u003c= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5223",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swifty Page Manager \u003c= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "swifty-page-manager",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0087",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InstaWP Connect – 1-click WP Staging \u0026 Migration \u003c= 0.1.0.44 - Authentication Bypass to Admin",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.44",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6397",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import Eventbrite Events \u003c= 1.7.4 - Reflected Cross-Site Scripting",
    "slug": "import-eventbrite-events",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12422",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Workable API \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via workable_jobs Shortcode",
    "slug": "wrapper-for-workable-api",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8721",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 1.3.88 - Cross Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 1.3.88",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.88",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-0585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0585",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring \u003c= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wemanage-app-worker",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1205",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Chartify \u003c= 3.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chart-builder",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30904",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdminQuickbar \u003c= 1.9.1 - Reflected Cross-Site Scripting",
    "slug": "adminquickbar",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39464",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Change Add to Cart Button Text for WooCommerce \u003c= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "add-to-cart-button-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48254",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meta Tag Manager \u003c= 3.1 - Missing Authorization",
    "slug": "meta-tag-manager",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22260",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Formidable Registration \u003c= 2.11 - Authenticated (Contributor+) Arbitrary User Password Reset To Account Takeover",
    "slug": "formidable-registration",
    "type": "plugin",
    "affected_version": "* - 2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1290",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "S-DEV SEO \u003c= 1.88 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "s-dev-seo",
    "type": "plugin",
    "affected_version": "* - 1.88",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.88",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22744",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4821",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Dynamic Links \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "wp-dynamic-links",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49038",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Cross-Site Request Forgery via ajax_clone_folder",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0725",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form \u0026#8211; 7 : Hide Success Message \u003c= 1.1.4 - Missing Authorization",
    "slug": "contact-form-7-hide-success-message",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53304",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MailOptin \u003c= 1.2.75.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mailoptin",
    "type": "plugin",
    "affected_version": "* - 1.2.75.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.75.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58596",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP All Export \u003c= 1.3.0 - Admin+ Stored Cross-Site Scripting",
    "slug": "wp-all-export",
    "type": "plugin",
    "affected_version": "[*, 1.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24708",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "jLayer Parallax Slider \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "jlayer-parallax-slider-wp",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CleverReach WP \u003c= 1.5.20 - Unauthenticated SQL Injection via title Parameter",
    "slug": "cleverreach-wp",
    "type": "plugin",
    "affected_version": "* - 1.5.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7036",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Vayu Blocks \u003c= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes",
    "slug": "vayu-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9378",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sydney Toolbox \u003c= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id",
    "slug": "sydney-toolbox",
    "type": "plugin",
    "affected_version": "* - 1.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2936",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Indeed Membership Pro 7.3 - 8.6 - Authentication Bypass",
    "slug": "indeed-membership-pro",
    "type": "plugin",
    "affected_version": "[7.3, 8.6.1)",
    "from_version": "7.3",
    "from_inclusive": true,
    "to_version": "8.6.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-36832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36832",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEO Booster \u003c= 3.7 - Admin+ SQL Injection",
    "slug": "seo-booster",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24747",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Field Suite \u003c= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom Field",
    "slug": "custom-field-suite",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3562",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Booking Calendar \u003c= 1.7.1 - Cross Site Request Forgery",
    "slug": "advanced-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45824",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pakke Envíos \u003c= 1.0.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "pakke",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52819",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Multi Store Locator \u003c= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-multi-store-locator",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0152",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Event Post \u003c= 1.3.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "themify-event-post",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30831",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Blocks – Page Builder Gutenberg Blocks, Patterns \u0026 Templates \u003c= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1854",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FS Poster \u003c= 6.5.8 - Reflected Cross-Site Scripting",
    "slug": "fs-poster",
    "type": "plugin",
    "affected_version": "* - 6.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30962",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Antispam Bee \u003c= 2.11.3 - IP Address Spoofing via get_client_ip",
    "slug": "antispam-bee",
    "type": "plugin",
    "affected_version": "* - 2.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41134",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multimedia Responsive Carousel with Image Video Audio Support \u003c= 2.6.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "multimedia-carousel",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31928",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Store Locator WordPress \u003c= 1.4.12 - Reflected Cross-Site Scripting via 'asl-nounce'",
    "slug": "agile-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4151",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Post Notes \u003c= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-post-notes",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37562",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tab – Accordion, FAQ \u003c 1.3.2 - Unauthenticated Arbitrary Tab Modification",
    "slug": "tabbed",
    "type": "plugin",
    "affected_version": "[*, 1.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24831",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Custom Search by BestWebSoft \u003c= 1.35 - Reflected Cross-Site Scripting",
    "slug": "custom-search-plugin",
    "type": "plugin",
    "affected_version": "* - 1.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18494",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SportsPress – Sports Club \u0026 League Manager \u003c= 2.7.20 - Missing Authorization to Notice Dismissal",
    "slug": "sportspress",
    "type": "plugin",
    "affected_version": "* - 2.7.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.20",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-34824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34824",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Private Content Plus \u003c= 3.6.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "wp-private-content-plus",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4390",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Loginizer \u003c= 1.7.8 - Reflected Cross-Site Scripting via 'limit_session[count]'",
    "slug": "loginizer",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2296",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Marekkis Watermark-Plugin \u003c= 0.9.4 - Reflected Cross-Site Scripting",
    "slug": "marekkis-watermark",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23425",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Forms – when you need more than just a contact form \u003c= 2.1.0 - Missing Authorization",
    "slug": "smart-forms",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-8803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8803",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Magnify \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "image-magnify",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 3.8.9 - Cross-Site Request Forgery",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "* - 3.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.9",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2015-0895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-0895",
    "auth_type": "Unauth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Frontend Admin by DynamiApps \u003c= 3.25.17 - Reflected Cross-Site Scripting",
    "slug": "acf-frontend-form-element",
    "type": "plugin",
    "affected_version": "* - 3.25.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26987",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz and Survey Master \u003c= 8.0.4 - Improper Input Validation",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4033",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Five Star Restaurant Reservations \u003c= 2.4.7 - Subscriber+ Stored Cross-Site Scripting",
    "slug": "restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24965",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.1.2.2 - Missing Authorization",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35777",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Digital Downloads – Sell Digital Files \u0026 Subscriptions (eCommerce Store + Payments Made Easy) \u003c= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-6692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6692",
    "auth_type": "Privileged",
    "cvss_score": 3.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0508",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cryptocurrency Widgets For Elementor \u003c= 1.6.4 - Unauthenticated Local File Inclusion",
    "slug": "cryptocurrency-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-53739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53739",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Justified Image Grid \u003c= 4.6.1 - Unauthenticated Server-Side Request Forgery",
    "slug": "justified-image-grid",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43989",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar \u003c= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 10.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13323",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swift Framework \u003c 2024.04.30 Authenticated (Admin+) Stored Cross-Site Scripting via Auth",
    "slug": "socialdriver-framework",
    "type": "plugin",
    "affected_version": "[*, 2024.04.30)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.04.30",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-2696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2696",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Click To Tweet \u003c= 2.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "click-to-tweet",
    "type": "plugin",
    "affected_version": "* - 2.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23514",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Testimonials \u003c= 3.6.1 - Cross-Site Request Forgery Bypass",
    "slug": "easy-testimonials",
    "type": "plugin",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36749",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Perfect Brands for WooCommerce \u003c= 2.0.4 - Server Information Disclosure",
    "slug": "perfect-woocommerce-brands",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-23982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23982",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Candifly \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "candifly",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12440",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SSU \u003c= 1.5.0 - Missing Authorization",
    "slug": "wp-s3-smart-upload",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33597",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP 2FA with Telegram \u003c= 3.0 - Authenticated (Subscriber+) Authentication Bypass",
    "slug": "two-factor-login-telegram",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9687",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Points and Rewards for WooCommerce \u003c= 1.5.0 - Cross-Site Request Forgery to Settings Change",
    "slug": "points-and-rewards-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27607",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flagged Content \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "flagged-content",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27284",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy Page Builder \u003c= 2.3.11 - Incorrect Authorization Checks Allowing Post Modification",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 1.0.125",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.125",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-38345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38345",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Brizy Page Builder \u003c= 2.3.11 - Incorrect Authorization Checks Allowing Post Modification",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "1.0.127 - 2.3.11",
    "from_version": "1.0.127",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-38345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38345",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Active Products Tables for WooCommerce \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51480",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Direct Checkout – Quick View – Buy Now For WooCommerce \u003c= 1.5.8 - Authenticated (Shop manager+) Stored Cross-Site Scripting via Custom CSS Code",
    "slug": "quick-view-and-buy-now-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47657",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 4.0.6 - Local File Inclusion and PHAR Deserialization",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "[*, 4.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-25082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25082",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Infinite Scroll - Ajax Load More \u003c= 5.6.0.2 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 5.6.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4466",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewStatPress \u003c= 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "newstatpress",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9311",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sina Extension for Elementor \u003c 2.2.1 - Local File Inclusion",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 2.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-15839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15839",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Formilla Live Chat \u003c= 1.3.0 - Authenticated (Administrator+) Cross-Site Scripting via 'FormillaID'",
    "slug": "formilla-live-chat",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23727",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Who Hit The Page – Hit Counter \u003c= 1.4.14.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "who-hit-the-page-hit-counter",
    "type": "plugin",
    "affected_version": "* - 1.4.14.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.14.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47558",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Coming Soon, Maintenance Mode \u003c= 1.1.1 - Unauthenticated Local File Inclusion",
    "slug": "site-mode",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26894",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Automatically Hierarchic Categories in Menu \u003c= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "automatically-hierarchic-categories-in-menu",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13466",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10393",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Payment Gateway for Telcell \u003c= 2.0.3 - Open Redirect",
    "slug": "payment-gateway-for-telcell",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6786",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accept Authorize.NET Payments Using Contact Form 7 \u003c= 2.5 - Unauthenticated Information Exposure",
    "slug": "accept-authorize-net-payments-using-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53322",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce Food - Restaurant Menu \u0026 Food ordering \u003c= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids",
    "slug": "woo-exfood",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13792",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "GNA Search Shortcode \u003c= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gna-search-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complianz \u003c= 6.4.4 (Premium \u003c= 6.4.6.1)  - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "complianz-gdpr-premium",
    "type": "plugin",
    "affected_version": "* - 6.4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33333",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complianz \u003c= 6.4.4 (Premium \u003c= 6.4.6.1)  - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33333",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfmatters \u003c= 2.1.6 - Missing Authorization",
    "slug": "perfmatters",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47874",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ECPay Ecommerce for WooCommerce \u003c= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion",
    "slug": "ecpay-ecommerce-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.2411060",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2411060",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13652",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventON PRO - WordPress Virtual Event Calendar Plugin \u003c= 4.6.8 - Cross-Site Request Forgery via admin_test_email",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6243",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mobile Smart \u003c= v1.3.16 - Reflected Cross-Site Scripting",
    "slug": "mobile-smart",
    "type": "plugin",
    "affected_version": "* - v1.3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "v1.3.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31021",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Box Shortcode And Widget \u003c= 1.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "facebook-likebox-widget-and-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1401",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Exit Box Lite \u003c= 1.0.6 - Cross-Site Request Forgery",
    "slug": "wordpress-exit-box-lite",
    "type": "plugin",
    "affected_version": "* - 1.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-10029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-10029",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mega Elements \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mega-elements-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47343",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chameleoni Jobs \u003c= 2.5.4 - Reflected Cross-Site Scripting",
    "slug": "chameleon-jobs",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52459",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Where Did You Hear About Us Checkout Field for WooCommerce \u003c= 1.3.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting",
    "slug": "wc-customer-source",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2752",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Backlink Monitor \u003c= 1.6.0 - Cross-Site Request Forgery",
    "slug": "seo-backlink-monitor",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53456",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Community by PeepSo \u003c= 6.1.6.0 - Cross-Site Request Forgery via delete",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39925",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Advanced Order Export For WooCommerce \u003c= 3.5.5 - Unauthenticated PHP Object Injection via Order Details",
    "slug": "woo-order-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10828",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sleekplan \u003c= 0.2.0 - Reflected Cross-Site Scripting",
    "slug": "sleekplan",
    "type": "plugin",
    "affected_version": "* - 0.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23469",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Betheme \u003c= 26.6.2 - Missing Authorization Checks to Private Page/Post Data Disclosure",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 26.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45353",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Banner Effect Header \u003c 1.2.8 - Cross-Site Scripting",
    "slug": "banner-effect-header",
    "type": "plugin",
    "affected_version": "[*, 1.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-1384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1384",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carousel CK \u003c= 1.1.0 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "carousel-ck",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1336",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Out Of Stock Badge \u003c= 1.3.1 - Cross-Site Request Forgery to Stored Cross-site Scripting",
    "slug": "out-of-stock-badge",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53754",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hubbub Lite \u003c= 1.34.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "social-pug",
    "type": "plugin",
    "affected_version": "* - 1.34.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.34.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10145",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links \u0026 Link Pages \u003c= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "clickwhale",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0804",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure",
    "slug": "easy-login-woocommerce",
    "type": "plugin",
    "affected_version": "2.7.1 - 2.7.2",
    "from_version": "2.7.1",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5665",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Doppler Forms \u003c= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "doppler-form",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32667",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relevanssi Live Ajax Search \u003c= 2.4 - Unauthenticated WP_Query Argument Injection",
    "slug": "relevanssi-live-ajax-search",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7573",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.4.1 - Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3385",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.1 - Cross-Site Request Forgery",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45067",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 4.2.2 - Cross-Site Request Forgery on Settings",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19981",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Prevent files / folders access \u003c= 2.6.0 - Authenticated (Subscriber+) Path Traversal",
    "slug": "prevent-file-access",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53561",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Cleanfix \u003c= 5.6.2 - Missing Authorization via register",
    "slug": "wp-cleanfix",
    "type": "plugin",
    "affected_version": "* - 5.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48775",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
  },
  {
    "title": "Asgard Security Scanner \u003c= 0.7 - Reflected Cross-Site Scripting",
    "slug": "asgard",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12715",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login Widget for Ultimate Member \u003c= 1.1.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "login-widget-for-ultimate-member",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30890",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder – Contact forms and much more \u003c= 8.5.6 - Missing Authorization via set_starred()",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1129",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider \u003c= 2.2.82 - Unauthenticated PHP Object Injection",
    "slug": "fluent-smtp",
    "type": "plugin",
    "affected_version": "* - 2.2.82",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.82",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9511",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CC Circle Progress Bar \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cc-circle-progress-bar",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23936",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Newsletter Signups \u003c= 1.0.4 - Authenticated (Admin+) SQL Injection",
    "slug": "easy-newsletter-signups",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5108",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Posts for Page \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "posts-for-page",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39369",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elfsight Testimonials Slider \u003c= 1.0.1 - Missing Authorization",
    "slug": "elfsight-testimonials-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31584",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Add image to Post \u003c= 0.6 - Cross-Site Request Forgery",
    "slug": "add-image-to-post",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54428",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "coreActivity \u003c= 1.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "coreactivity",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0852",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Showcase and Slider – Team Members Builder \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "team-showcase-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51763",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4397",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blogger Buzz \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blogger-buzz",
    "type": "theme",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54680",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nativery \u003c= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nativery",
    "type": "plugin",
    "affected_version": "* - 0.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22781",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Betheme \u003c= 26.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 26.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45363",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fluent Support \u003c= 1.8.0 - Insufficient Authorization on Email Verification",
    "slug": "fluent-support",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47302",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Hover Effects – Elementor Addon \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'eihe_align'",
    "slug": "image-hover-effects-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29936",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Notify \u003c= 1.0 - Missing Authorization",
    "slug": "site-notify",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32240",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.7.5 - Missing Authorization",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22739",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Age Verification for your checkout page. Verify your customer's identity \u003c= 1.20.0 - Reflected Cross-Site Scripting",
    "slug": "agecheckernet",
    "type": "plugin",
    "affected_version": "1.20.0",
    "from_version": "1.20.0",
    "from_inclusive": true,
    "to_version": "1.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22622",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter Popup \u003c= 1.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "newsletter-popup",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3641",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZoloBlocks \u003c= 2.3.2 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "zoloblocks",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53210",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Vegas \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "vegas-fullscreen-background-slider",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-43841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-43841",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reviews Plus \u003c 1.2.14 - Denial of Service",
    "slug": "reviews-plus",
    "type": "plugin",
    "affected_version": "[*, 1.2.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24894",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Catch Dark Mode \u003c= 2.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "catch-dark-mode",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32154",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ark-commenteditor \u003c= 2.15.6 - iframe Injection",
    "slug": "ark-wysiwyg-comment-editor",
    "type": "plugin",
    "affected_version": "* - 2.15.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4227",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant Solutions – Checklist 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "restaurant-solutions-checklist",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1977",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CouponXL \u003c= 4.5.0 - Unauthenticated Privilege Escalation",
    "slug": "couponxl",
    "type": "theme",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39489",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "semver-regex \u003c= 3.1.3 and 4.0.0-4.0.3 - Regular Expression Denial of Service (ReDoS)",
    "slug": "insert-special-characters",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-43307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-43307",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Avantage \u003c= 2.4.9 - Unauthenticated PHP Object Injection",
    "slug": "avantage",
    "type": "theme",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39495",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MM-email2image \u003c= 0.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "mm-email2image",
    "type": "plugin",
    "affected_version": "* - 0.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3075",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Menubar \u003c= 5.8.2 - Cross-Site Request Forgery in wpm-admin.php",
    "slug": "menubar",
    "type": "plugin",
    "affected_version": "* - 5.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36687",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Accredible Certificates \u0026 Open Badges \u003c= 1.4.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "accredible-certificates",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50827",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Matomo \u003c= 4.15.3 - Reflected Cross-Site Scripting via idsite",
    "slug": "matomo",
    "type": "plugin",
    "affected_version": "* - 4.15.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6923",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Networker \u003c= 1.2.0 - Unauthenticated Local File Inclusion",
    "slug": "networker",
    "type": "theme",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52723",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IP Metaboxes \u003c= 2.1.1 -  Unauthenticated Stored Cross-Site Scripting",
    "slug": "ip-metaboxes",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30745",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MagOne \u003c= 8.5 - Reflected Cross-Site Scripting",
    "slug": "magone",
    "type": "theme",
    "affected_version": "* - 8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39488",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PE Easy Slider \u003c= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pe-easy-slider",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60133",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import Spreadsheets from Microsoft Excel \u003c= 10.1.4 - Authenticated (Editor+) Arbitrary File Upload",
    "slug": "import-spreadsheets-from-microsoft-excel",
    "type": "plugin",
    "affected_version": "* - 10.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-38734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38734",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Church Admin \u003c= 5.0.18 - Unauthenticated SQL Injection",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 5.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26941",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Piotnet Addons For Elementor \u003c= 2.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "piotnet-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13650",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2 - Reflected Cross-Site Scripting via datef",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4208",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Really Simple SSL \u003c= 9.1.4 - Cross-Site Request Forgery",
    "slug": "really-simple-ssl",
    "type": "plugin",
    "affected_version": "* - 9.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24623",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Login Logout Register Menu \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'llrmloginlogout' Shortcode",
    "slug": "login-logout-register-menu",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sticky Buttons \u003c= 4.1.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "sticky-buttons",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24720",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 3.2.6.8 - Privilege Escalation via accept-to-be-teacher action parameter",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 3.2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-11511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11511",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Calendi \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "calendi",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23606",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Serial Codes Generator and Validator with WooCommerce Support \u003c= 2.7.7 - Cross-Site Request Forgery via [placeholder]",
    "slug": "serial-codes-generator-and-validator",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30854",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Leblix \u003c= 2.4 - Unauthenticated Local File Inclusion",
    "slug": "leblix",
    "type": "theme",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58995",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cyber Slider \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "cyber-new-slider",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23630",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Booked – Appointment Booking and Scheduling Management System for WordPress \u003c= 2.4.5 - Cross-Site Request Forgery",
    "slug": "easy-booked",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22634",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hive Support \u003c= 1.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "hive-support",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32214",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Generator \u003c= 1.7.1 - Authenticated(Administrator+) SQL Injection",
    "slug": "page-generator",
    "type": "plugin",
    "affected_version": "[*, 1.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-52131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52131",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Missing Authorization in 'wpfc_clear_cache_of_allsites_callback'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1930",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 1.6.6 - Unauthenticated Arbitrary Account Changes",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4346",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "flickr-picture-backup \u003c= 0.7 - Arbitrary file upload",
    "slug": "flickr-picture-backup",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002016",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Reftagger Shortcode \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "reftagger-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51612",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial Slider \u003c= 1.3.1 - Cross-Site Request Forgery",
    "slug": "testimonial-slider",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-44741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44741",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Breakdance \u003c= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta",
    "slug": "breakdance",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6854",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobs for WordPress \u003c= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Read",
    "slug": "job-postings",
    "type": "plugin",
    "affected_version": "* - 2.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1310",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Filter \u0026 Grids \u003c= 2.8.33 - Cross-Site Request Forgery",
    "slug": "ymc-smart-filter",
    "type": "plugin",
    "affected_version": "* - 2.8.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39664",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Sticky Footer \u003c= 1.3.2 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "simple-sticky-footer",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9454",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Avada Builder \u003c= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "fusion-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13345",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Newspack Newsletters \u003c= 3.13.0 - Open Redirect",
    "slug": "newspack-newsletters",
    "type": "plugin",
    "affected_version": "* - 3.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49325",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SALESmanago \u003c= 3.8.1 - Cross-Site Request Forgery",
    "slug": "salesmanago",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57970",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4357",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Link Library \u003c= 7.6.6 - Reflected Cross-Site Scripting",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2325",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Estate Directory \u003c= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation",
    "slug": "real-estate-directory",
    "type": "theme",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28532",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1537",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brand my Footer \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "brand-my-footer",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51801",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.15",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.15",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.8",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.7",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.6",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.2",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.18",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.18",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.12",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.3",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Cross-Site Scripting via Taxonomy names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.16",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quill Forms \u003c= 3.3.0 - Missing Authorization",
    "slug": "quillforms",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46610",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "youForms for WordPress – Creating Forms for CopeCart \u003c= 1.0.5 - Stored Cross-Site Scripting",
    "slug": "youforms-free-for-copecart",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24596",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventin \u003c= 4.0.7 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56213",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPCargo \u003c= 6.8.9 - Unauthenticated Remote Code Execution",
    "slug": "wpcargo",
    "type": "plugin",
    "affected_version": "[*, 6.9.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-25003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25003",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder – Contact forms and much more \u003c= 8.5.5 - Authenticated (Admin+) SQL Injection",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50838",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wallet System for WooCommerce \u003c= 2.5.13 - Information Exposure via Log Files",
    "slug": "wallet-system-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.5.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38699",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Social Stream Designer \u003c= 1.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "social-stream-design",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32677",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Nirweb support \u003c= 3.0.3 - Missing Authorization",
    "slug": "nirweb-support",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22695",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.10 - Authenticated Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.0.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-10234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10234",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 2.9.13 - Missing Authorization",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 2.9.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45826",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Chamber Dashboard Business Directory \u003c= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "chamber-dashboard-business-directory",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11452",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flo Forms \u003c= 1.0.40 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "flo-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35095",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GoHero Store Customizer for WooCommerce \u003c= 3.5 - Missing Authorization to Unuthenticated Settings Update",
    "slug": "personalize-woocommerce-cart-page",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12826",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iPages Flipbook \u003c= 1.5.1 - Missing Authorization",
    "slug": "ipages-flipbook",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33909",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Simple PayPal Shopping Cart \u003c= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress-simple-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FlatPM \u003c 3.1.05 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "flatpm-wp",
    "type": "plugin",
    "affected_version": "[*, 3.1.05)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.05",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-29803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29803",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Esselink.nu Settings \u003c= 2.94 - Cross-Site Request Forgery",
    "slug": "esselinknu-settings",
    "type": "plugin",
    "affected_version": "* - 2.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.94",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52793",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Watu Quiz \u003c= 3.3.8.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 3.3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0429",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP HTML Author Bio \u003c= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wp-html-author-bio-by-ahmad-awais",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24545",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Catalog Simple \u003c= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcode",
    "slug": "post-type-x",
    "type": "plugin",
    "affected_version": "* - 1.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1405",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.19.2 - Stored Cross-Site Scripting",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "[*, 1.19.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1255",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Participants Database \u003c= 2.5.5 - Missing Authorization",
    "slug": "participants-database",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48751",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DecaLog \u003c= 3.7.0 - Cross-Site Request Forgery via get_settings_page",
    "slug": "decalog",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27444",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.7.2 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37947",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XML Sitemap \u0026 Google News \u003c= 5.4.8 - Unauthenticated Local File Inclusion",
    "slug": "xml-sitemap-feed",
    "type": "plugin",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4441",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.9.5 - Sensitive Data Exposure",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "[*, 3.9.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24695",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Copperleaf Photolog \u003c= 0.16- SQL injection",
    "slug": "cpl",
    "type": "plugin",
    "affected_version": "* - 0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2010-0673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-0673",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter \u003c= 1.222.17 - Missing Authorization",
    "slug": "custom-add-to-cart-button-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.222.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.222.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37202",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP VR \u003c= 8.5.26 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.5.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47452",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ajax Search Lite \u003c= 4.12.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ajax-search-lite",
    "type": "plugin",
    "affected_version": "* - 4.12.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13585",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Made Easy \u003c= 2.3.14 - Authenticated (Subscriber+) SQL Injection via 'search_name'",
    "slug": "events-made-easy",
    "type": "plugin",
    "affected_version": "* - 2.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28660",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MaxGalleria \u003c= 6.2.5 - Stored Cross-Site Scripting",
    "slug": "maxgalleria",
    "type": "plugin",
    "affected_version": "[*, 6.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-25603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25603",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VR Frases \u003c= 3.0.1 - Reflected Cross-Site Scripting",
    "slug": "vr-frases",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13626",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Watu Quiz \u003c= 3.4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 3.4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2640",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 2.9.2 - Stored Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-20406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-20406",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LMSACE Connect \u003c= 3.4 - Missing Authorization",
    "slug": "lmsace-connect",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29007",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Subpage List \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "subpage-view",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4168",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seriously Simple Podcasting \u003c= 3.0.2 - Reflected Cross-Site Scripting",
    "slug": "seriously-simple-podcasting",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup, Optin Form \u0026 Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin \u003c= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mailoptin",
    "type": "plugin",
    "affected_version": "* - 1.2.70.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.70.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8628",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Developer Formatter \u003c= 2015.0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom CSS",
    "slug": "devformatter",
    "type": "plugin",
    "affected_version": "* - 2015.0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2015.0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5699",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.25",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.25",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.22",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.22",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.15",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.10",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.5",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.23",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.19",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.14",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.13",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.9",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Security Misconfiguration with URL Hostnames",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.4",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "DOAJ Export \u003c= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "doaj-export",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58256",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Set Favicon \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "easy-set-favicon",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33645",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38676",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "In Stock Mailer for WooCommerce \u003c= 2.1.1 - Reflected Cross-Site Scripting",
    "slug": "in-stock-mailer-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Payoneer Checkout \u003c= 3.4.0 - Missing Authorization",
    "slug": "payoneer-checkout",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58795",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Bootstrap Shortcode \u003c= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4576",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2 - Reflected Cross-Site Scripting via pointsf",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4209",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Shortcode Sidebars \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "custom-shortcode-sidebars",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53736",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Audio Merchant \u003c= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "audio-merchant",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6196",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Login Security and History \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-login-security-and-history",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24328",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.6.2 - Cryptographic Weakness",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-4107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-4107",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.11.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10649",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "iBuildApp \u003c= 0.2.0 - Reflected Cross-Site Scripting",
    "slug": "ibuildapp",
    "type": "plugin",
    "affected_version": "* - 0.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13326",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Patreon WordPress \u003c= 1.6.9 - Cross-Site Request Forgery",
    "slug": "patreon-connect",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24230",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Popup Anything – A Marketing Popup and Lead Generation Conversions \u003c= 2.1.6 - Reflected Cross-Site Scripting",
    "slug": "popup-anything-on-click",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2115",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Private Content Plus \u003c= 3.6 - Protection Mechanism Bypass",
    "slug": "wp-private-content-plus",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0680",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content – ProfilePress \u003c= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13120",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 5.7.11 - Reflected Cross-Site Scripting via campaign_id",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22300",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes - TQL Edition \u003c= 1.2.6 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "ltl-freight-quotes-tql-edition",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58644",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Visitor Traffic Real Time Statistics \u003c= 3.8 - Subscriber+ SQL Injection",
    "slug": "visitors-traffic-real-time-statistics",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24829",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \u003c= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price List Widget",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1426",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.3.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47628",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPFrom Email \u003c= 1.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpfrom-email",
    "type": "plugin",
    "affected_version": "* - 1.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23982",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core 2.9.2 and 3.0.4 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "2.9.2",
    "from_version": "2.9.2",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2011-3818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3818",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core 2.9.2 and 3.0.4 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.0.4",
    "from_version": "3.0.4",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2011-3818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3818",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Global Translator \u003c= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "global-translator",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30630",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEPA Girocode \u003c= 0.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sepa-girocode",
    "type": "plugin",
    "affected_version": "* - 0.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49450",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Keyy Two Factor Authentication (like Clef) \u003c= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover",
    "slug": "keyy",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10293",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JobCareer | Job Board Responsive WordPress Theme \u003c 2.4 - User Enumeration",
    "slug": "jobcareer",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-19487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19487",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JobCareer | Job Board Responsive WordPress Theme \u003c 2.4 - User Enumeration",
    "slug": "wp-jobhunt",
    "type": "plugin",
    "affected_version": "[*, 2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-19487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19487",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Affiliate For WooCommerce premium \u003c= 4.7.0 - Authenticated Insecure Direct Object Reference",
    "slug": "affiliate-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36284",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery \u003c 2.0.77.3 - Cross-Site Request Forgery",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "[*, 2.0.77.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.77.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-1784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1784",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Importer : Import any XML File to WordPress \u003c 1.0.1 - Server-Side Request Forgery",
    "slug": "wp-smart-import",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-24147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24147",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
  },
  {
    "title": "Plugin README Parser \u003c= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target Parameter",
    "slug": "wp-readme-parser",
    "type": "plugin",
    "affected_version": "* - 1.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP BASE Booking \u003c= 5.0.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-base-booking-of-appointments-services-and-events",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22684",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Unauthenticated SQL Injection via cg_Fields",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4158",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Unauthenticated SQL Injection via cg_Fields",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4158",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Author Box, Guest Author and Co-Authors for Your Posts – Molongui \u003c= 4.7.4 - Information Exposure via ma_debug",
    "slug": "molongui-authorship",
    "type": "plugin",
    "affected_version": "* - 4.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7014",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multi Rating \u003c= 5.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "multi-rating",
    "type": "plugin",
    "affected_version": "* - 5.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32130",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Calendar \u003c= 1.1.50 - Subscriber+ Event Creation",
    "slug": "event-calendar-wd",
    "type": "plugin",
    "affected_version": "* - 1.1.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25025",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "affiliate-toolkit – WordPress Affiliate Plugin \u003c= 3.3.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23786",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cloudflare Image Resizing \u003c= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook",
    "slug": "cf-image-resizing",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-8723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS Elementor Addons \u003c= 2.1.5 - Missing Authorization",
    "slug": "tutor-lms-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53816",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Enhanced Text Widget \u003c= 1.5.8 - Missing Authorization",
    "slug": "enhanced-text-widget",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23823",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Personalized WooCommerce Cart Page \u003c= 2.4 - Cross-Site Request Forgery",
    "slug": "personalize-woocommerce-cart-page",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-5979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5979",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Really Simple SSL \u003c= 7.2.3 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "really-simple-ssl",
    "type": "plugin",
    "affected_version": "* - 7.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31229",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Filr – Secure document library \u003c= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "filr-protection",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43216",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plugin for Google Reviews \u003c= 2.2.2 - Missing Authorization",
    "slug": "widget-google-reviews",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45369",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Buddy Extension \u003c= 4.0.1 - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "mainwp-buddy-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23747",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Nextend Social Login Pro \u003c= 3.1.14 - Authentication Bypass via WordPress.com OAuth provider",
    "slug": "nextend-social-login-pro",
    "type": "plugin",
    "affected_version": "* - 3.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.14",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9893",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Digital Publications by Supsystic \u003c= 1.7.6 - Cross-Site Request Forgery via AJAX action",
    "slug": "digital-publications-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5756",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Under Construction / Maintenance Mode from Acurax \u003c= 2.6 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "coming-soon-maintenance-mode-from-acurax",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6922",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Media Replace \u003c= 0.1.3 - Authenticated (Author+) Arbitrary File Deletion",
    "slug": "easy-media-replace",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-46850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46850",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP Dashboard Notes \u003c= 1.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-dashboard-notes",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43226",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export All Posts, Products, Orders, Refunds \u0026 Users \u003c= 2.9.3 - Information Disclosure Through Unprotected Directory",
    "slug": "wp-ultimate-exporter",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12315",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3308",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advance Post Prefix \u003c= 1.1.1 - Authenticated (Admin+) SQL Injection",
    "slug": "advance-post-prefix",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12735",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty \u003c= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "chaty",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4149",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile \u0026 User signup \u003c= 4.0.26 - Unauthenticated PHP Object Injection",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30223",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Grow Social \u003c= 1.2.5 - Reflected Cross-Site Scripting",
    "slug": "social-pug",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10736",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Active Products Tables for WooCommerce. Use constructor to create tables \u003c= 1.0.6.5 - Unauthenticated Arbitrary Shortcode Execution via woot_get_smth",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10959",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Mail Subscribe List \u003c= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mail-subscribe-list",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58018",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 5.3.4 - Missing Authorization via openai_file_upload_callback",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 5.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0452",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1012",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1012",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1455",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sell Digital Downloads \u003c= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sell-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22826",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rimons Twitter Widget \u003c= 1.2.4 - Cross-Site Scripting",
    "slug": "rimons-twitter-widget",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18533",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Access Category Password \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "access-category-password",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32535",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MBE eShip \u003c= 2.1.2 - Cross-Site Request Forgery",
    "slug": "mail-boxes-etc",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38729",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ConvertPlug \u003c= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update",
    "slug": "convertplug",
    "type": "plugin",
    "affected_version": "* - 3.5.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3237",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 4.6.0 - Unauthenticated Donor Data Exposure",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8620",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor \u003c= 3.5.4 - DOM-Based iFrame Injection",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4953",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKT Templates – Elementor \u0026 Gutenberg templates \u003c= 6.14 - Reflected Cross-Site Scripting",
    "slug": "skt-templates",
    "type": "plugin",
    "affected_version": "* - 6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44007",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YAWPP (Yet Another WordPress Petition Plugin) \u003c= 1.2.2 - Cross-Site Scripting",
    "slug": "yawpp",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9391",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sponsered Link \u003c= 4.0 - Reflected Cross-Site Scripting",
    "slug": "sponsered-link",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22692",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Groups and Communities \u003c= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0723",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced Text Widget  \u003c= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "advanced-text-widget",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26539",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ContentOptin Lite – WP Content Upgrade Plugin \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "contentoptin",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23589",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directorist AddonsKit for Elementor \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addonskit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31857",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Click Mag - Viral WordPress News Magazine/Blog Theme \u003c= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion",
    "slug": "click-mag",
    "type": "theme",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13656",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Share-one-Drive \u003c= 1.15.2 - Reflected Cross-Site Scripting",
    "slug": "share-one-drive",
    "type": "plugin",
    "affected_version": "[*, 1.15.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-42548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42548",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Database Collation Fix \u003c= 1.2.7 - Cross-Site Request Forgery via admin_page",
    "slug": "database-collation-fix",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23997",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Client Reports \u003c= 1.0.16 - Missing Authorization to Sensitive Information Exposure",
    "slug": "wp-client-reports",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23978",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Master Popups \u003c= 1.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "master-popups-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37950",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add From Server \u003c= 3.3.1 - Cross-Site Request Forgery",
    "slug": "add-from-server",
    "type": "plugin",
    "affected_version": "[*, 3.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10914",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YourMembership Single Sign On \u003c= 1.1.3 - Missing Authorization",
    "slug": "login-with-yourmembership",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37987",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "NPS computy \u003c= 2.8.0 - Reflected Cross-Site Scripting",
    "slug": "nps-computy",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11807",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ICS Calendar \u003c= 10.12.0.1 - Authenticated(Contributor+) Directory Traversal via _url_get_contents",
    "slug": "ics-calendar",
    "type": "plugin",
    "affected_version": "[*, 10.12.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.12.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-46784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46784",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Heureka \u003c= 1.0.8 - Cross-Site Request Forgery",
    "slug": "heureka",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25931",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pro Bulk Watermark Plugin for WordPress \u003c= 2.0 - Authenticated (Subscriber+) Path Traversal",
    "slug": "pro-watermark",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4956",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Notification \u003c= 10.3 - Reflected Cross-Site Scripting",
    "slug": "smio-push-notification",
    "type": "plugin",
    "affected_version": "* - 10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39478",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YDS Support Ticket System \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "yds-support-ticket-system",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36388",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 2.8 - Sensitive Information Disclosure",
    "slug": "wpmu",
    "type": "core",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-2334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.8 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-2334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MouseWheel Smooth Scroll \u003c= 5.6 - Plugin's Setting Update via Cross-Site Request Forgery",
    "slug": "mousewheel-smooth-scroll",
    "type": "plugin",
    "affected_version": "* - 5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24852",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "MJM Clinic \u003c= 1.1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mjm-clinic",
    "type": "plugin",
    "affected_version": "* - 1.1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29140",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KiviCare – Clinic \u0026 Patient Management System (EHR) \u003c= 2.3.8 - SQL Injection",
    "slug": "kivicare-clinic-management-system",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0786",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Helpdesk \u0026 Live Chat Plugin Powered by AI – ThriveDesk \u003c= 2.0.6 - Reflected Cross-Site Scripting",
    "slug": "thrivedesk",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24536",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking and Rental Manager \u003c= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "booking-and-rental-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35048",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SurveyJS \u003c= 1.12.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "surveyjs",
    "type": "plugin",
    "affected_version": "* - 1.12.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32167",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yahoo BOSS \u003c= 0.7 - Reflected Cross-Site Scripting",
    "slug": "yahoo-boss",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25102",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Tickets and Registration \u003c= 5.26.5 - Unauthenticated Ticket Payment Bypass",
    "slug": "event-tickets",
    "type": "plugin",
    "affected_version": "* - 5.26.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.26.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-11517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11517",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Theme Options Z \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "theme-options-z",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25121",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Robo Gallery \u003c= 3.2.21 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49696",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "xili-tidy-tags \u003c= 1.12.04 - Reflected Cross-Site Scripting",
    "slug": "xili-tidy-tags",
    "type": "plugin",
    "affected_version": "* - 1.12.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9357",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Missing Authorization on ajax_save_folder",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0718",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Denial of Service via XML",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "low",
    "cve": "CVE-2014-5265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5265",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Denial of Service via XML",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.3",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2014-5265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5265",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Denial of Service via XML",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.3",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2014-5265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5265",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Denial of Service via XML",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.1",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2014-5265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5265",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Read More Excerpt Link \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "read-more-excerpt-link",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26011",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Data Guard \u003c= 8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wordpress-data-guards",
    "type": "plugin",
    "affected_version": "* - 8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23828",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by WPForms \u003c= 1.9.2.2 - Missing Authorization",
    "slug": "wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 1.9.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56276",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Universal Video Player \u003c= 3.8.3 - Reflected Cross-Site Scripting",
    "slug": "universal_video_player",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31917",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi Step Form \u003c= 1.2.5 - Stored Cross-Site Scripting",
    "slug": "multi-step-form",
    "type": "plugin",
    "affected_version": "[*, 1.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-14846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14846",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HAL \u003c= 2.1.1 Authenticated Stored Cross-Site Scripting",
    "slug": "hal",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39345",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NinjaTeam Header Footer Custom Code \u003c 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "header-footer-code",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6493",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Galleries by Angie Makes \u003c= 1.67 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wc-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.67",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4795",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.29",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.18",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.1",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.13",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.10",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.27",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.26",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.26",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.23",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.19",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.29",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.13",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.9",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.5",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.2",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Stored Cross-Site Scripting via Comments via URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.17",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiVendorX \u003c= 4.2.22 - Unauthenticated Information Exposure",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48261",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "微信机器人高级版 \u003c= 6.2.1 - Reflected Cross Site Scripting",
    "slug": "weixin-robot-advanced",
    "type": "plugin",
    "affected_version": "* - 6.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Frontend \u003c= 4.0.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-user-frontend",
    "type": "plugin",
    "affected_version": "* - 4.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-38693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38693",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.102 - Authenticated (Contributor+) SQL Injection",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.102",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.102",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3055",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core - All known versions - Unauthenticated Blind Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3590",
    "auth_type": "Unauth",
    "cvss_score": 4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5426",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11916",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "YouTube SimpleGallery \u003c= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "youtube-simplegallery",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31453",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonials \u003c= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "super-testimonial",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36858",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Google Sheet Connector \u003c= 1.3.20 - Cross-Site Request Forgery",
    "slug": "wc-gsheetconnector",
    "type": "plugin",
    "affected_version": "* - 1.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54030",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-FaceThumb \u003c 0.2 - Cross-Site Scripting",
    "slug": "wp-facethumb",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-2371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2371",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Link Preview \u003c= 1.4.1 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "wp-link-preview",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31527",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Management-screen-droptiles \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "cxc-sawa",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23666",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Community by PeepSo \u003c= 6.0.9.0 - Cross-Site Request Forgery to Field Duplication",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.0.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32092",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Relevanssi – A Better Search \u003c 3.3.8 - Cross-Site Scripting",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "[*, 3.3.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9443",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Control \u003c= 1.5.3 - Insecure Password Reset Mechanism",
    "slug": "wp-user-control",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4915",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Culture Object \u003c= 4.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "culture-object",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36356",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-reCAPTCHA \u003c= 2.9.8.2 - Multiple Cross-Site Request Forgery",
    "slug": "wp-recaptcha",
    "type": "plugin",
    "affected_version": "* - 2.9.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2011-0759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-0759",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Oppso Unit Converter \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "oppso-unit-converter",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31378",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Enquiry for WooCommerce \u003c= 3.1 - Reflected Cross-Site Scripting",
    "slug": "gm-woocommerce-quote-popup",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7151",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks for Gutenberg \u003c= 3.8.5 -  Cross-Site Request Forgery",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47594",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Responsive Menu \u003c= 3.1.7 - Missing Authorization to Settings Update \u0026 Stored Cross-Site Scripting",
    "slug": "wp-responsive-menu",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24971",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.6.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6931",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rate my Post – WP Rating System \u003c= 3.3.4 - Cross-Site Request Forgery",
    "slug": "rate-my-post",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40671",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hash Form \u003c= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation",
    "slug": "hash-form",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12201",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Add to Cart Text Changer and Customize Button, Add Custom Icon \u003c= 2.0 - Cross-Site Request Forgery via wactc_text_form",
    "slug": "woo-add-to-cart-text-change",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49153",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Enable Latex \u003c= 1.2.16 - Cross-Site Request Forgery",
    "slug": "enable-latex",
    "type": "plugin",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58860",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VR-Frases (collect \u0026 share quotes) \u003c= 3.0.1 - Reflected Cross-Site Scripting",
    "slug": "vr-frases",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0860",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Popular Posts \u003c= 6.0.5 - Unauthenticated Views Changes",
    "slug": "wordpress-popular-posts",
    "type": "plugin",
    "affected_version": "* - 6.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43468",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Domain Whitelist \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "user-domain-whitelist",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-10381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10381",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Starter Templates — Elementor, WordPress \u0026 Beaver Builder Templates \u003c= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "astra-sites",
    "type": "plugin",
    "affected_version": "* - 4.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1467",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OneLogin SAML SSO \u003c 2.2.0 - Authentication Bypass",
    "slug": "onelogin-saml-sso",
    "type": "plugin",
    "affected_version": "[*, 2.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10928",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Contact Form By BestWebSoft\u003c= 3.34 - Cross-Site Scripting",
    "slug": "contact-form-plugin",
    "type": "plugin",
    "affected_version": "* - 3.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-7481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7481",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget Options \u003c= 4.1.0 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "widget-options",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22630",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Spam Blocker \u003c= 2.0.4 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cf7-manual-spam-blocker",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32581",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Daily Prayer Time \u003c= 2023.10.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "daily-prayer-time-for-mosques",
    "type": "plugin",
    "affected_version": "* - 2023.10.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2023.10.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StreamWeasels Online Status Bar \u003c= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stream-status-for-twitch",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11438",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookie Notice \u0026 Consent 1.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cookie-notice-consent",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41948",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikRestaurants Table Reservations and Take-Away \u003c= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "vikrestaurants",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57962",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes Blocks Creator Ultimate \u003c= 2.2.0 - Reflected Cross-Site Scripting via 'page'",
    "slug": "ultimate-shortcodes-creator",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12166",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BeyondCart Connector \u003c= 3.0.1 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine_current_user Filter",
    "slug": "beyondcart",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-8570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8570",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.35",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36842",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Interactive Geo Maps \u003c= 1.5.9 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "interactive-geo-maps",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0731",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent \u003c= 3.8.0 - Cross-Site Request Forgery",
    "slug": "gdpr-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49285",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Plugin Tournamatch \u003c 4.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "tournamatch",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5644",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget BUY.BOX \u003c= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "buybox-widget",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13679",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Shortcodes Plugin — Shortcodes Ultimate \u003c 4.10.0 - Directory Traversal",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "[*, 4.10.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-2245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2245",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "tagDiv Composer \u003c= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3813",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wallet System for WooCommerce \u003c= 2.6.8 - Reflected Cross-Site Scripting",
    "slug": "wallet-system-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32530",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ogami \u003c= 1.53 - Unauthenticated Local File Inclusion",
    "slug": "ogami",
    "type": "theme",
    "affected_version": "* - 1.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.53",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31913",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CM Map Locations \u003c= 2.1.6 - Reflected Cross-Site Scripting",
    "slug": "cm-map-locations",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48151",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Loops \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "the-loops",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23754",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada Builder \u003c= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets",
    "slug": "fusion-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12477",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cost Calculator Builder PRO \u003c= 3.2.15 - Unauthenticated SQL Injection via data",
    "slug": "cost-calculator-builder-pro",
    "type": "plugin",
    "affected_version": "* - 3.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11939",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.2.3 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9239",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery for Social Photo \u003c= 1.0.0.27 - Cross-Site Request Forgery to Post Duplication",
    "slug": "feed-instagram-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2224",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.4.1 - Cross-Site Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-3384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3384",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appointmind \u003c= 4.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "appointmind",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51679",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qyrr – simply and modern QR-Code creation \u003c= 0.7 - Cross-Site Scripting",
    "slug": "qyrr-code",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24559",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cross-Site Request Forgery \u003c= 1.2.4 - Cross-Site Request Forgery",
    "slug": "winterlock",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24982",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JW Player for Flash \u0026 HTML5 Video \u003c 2.1.4 - Cross-Site Request Forgery leading to player deletion",
    "slug": "jw-player-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 2.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4030",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Arena.IM – Live Blogging for real-time events \u003c= 0.4.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "arena-liveblog-and-chat-tool",
    "type": "plugin",
    "affected_version": "* - 0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12526",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cookies and Content Security Policy \u003c= 2.15 - Sensitive Information Exposure",
    "slug": "cookies-and-content-security-policy",
    "type": "plugin",
    "affected_version": "* - 2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40662",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Futurio Extra \u003c= 1.6.2 - Authenticated (Admin+) SQL Injection",
    "slug": "futurio-extra",
    "type": "plugin",
    "affected_version": "[*, 1.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-25109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25109",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Comfino Payment Gateway \u003c= 4.1.1 - Reflected Cross-Site Scripting",
    "slug": "comfino-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11329",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HandL UTM Grabber / Tracker \u003c= 2.6.4 - Cross-Site Request Forgery",
    "slug": "handl-utm-grabber",
    "type": "plugin",
    "affected_version": "[*, 2.6.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15769",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Under Construction / Maintenance Mode from Acurax \u003c= 2.6 - Unauthenticated Cross-Site Scripting",
    "slug": "coming-soon-maintenance-mode-from-acurax",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39926",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGraphQL \u003c= 0.3.4 - Information Exposure",
    "slug": "wp-graphql",
    "type": "plugin",
    "affected_version": "* - 0.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-25060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25060",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Live Sales Notification for Woocommerce – Woomotiv \u003c= 3.4.3 - Cross-Site Request Forgery  via ajax_cancel_review",
    "slug": "woomotiv",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1325",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Typekit \u003c= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "advanced-typekit",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nimble Page Builder \u003c= 3.2.1 - Reflected Cross-Site Scripting",
    "slug": "nimble-builder",
    "type": "plugin",
    "affected_version": "[*, 3.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0314",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "2Way VideoCalls and Random Chat – HTML5 Webcam Videochat \u003c= 5.2.7 - Reflected Cross-Site Scripting",
    "slug": "webcam-2way-videochat",
    "type": "plugin",
    "affected_version": "* - 5.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34656",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CBX Map for Google Map \u0026 OpenStreetMap \u003c= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "cbxgooglemap",
    "type": "plugin",
    "affected_version": "* - 1.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47240",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MegaMenu \u003c= 2.3.12 - Unauthenticated Local File Inclusion",
    "slug": "stm-megamenu",
    "type": "plugin",
    "affected_version": "* - 2.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-35677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35677",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Chaty \u003c= 3.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "chaty",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47759",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wProject \u003c 5.8.0 - Reflected Cross-Site Scripting",
    "slug": "wproject",
    "type": "theme",
    "affected_version": "[*, 5.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-39365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39365",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Font Editor \u003c= 1.7 - Reflected Cross-Site Scripting",
    "slug": "admin-font-editor",
    "type": "plugin",
    "affected_version": "[*, 1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-1000126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000126",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iThemes Mobile \u003c 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "ithemes-mobile",
    "type": "theme",
    "affected_version": "[*, 1.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9376",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plugin Groups \u003c= 2.0.6 - Missing Authorization to Unauthenticated Denial of Service",
    "slug": "plugin-groups",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1108",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 6.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4565",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "* - 6.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4565",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Nomupay Payment Processing Gateway \u003c= 7.1.7 - Authenticated (Shop Manager+) Arbitrary File Download",
    "slug": "totalprocessing-card-payments",
    "type": "plugin",
    "affected_version": "* - 7.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46486",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP-Table Reloaded \u003c= 1.9.3 - Cross-Site Scripting",
    "slug": "wp-table-reloaded",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-1463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1463",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SureMembers \u003c= 1.10.6 - Sensitive Information Exposure",
    "slug": "suremembers",
    "type": "plugin",
    "affected_version": "* - 1.10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12434",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JobBoard Job listing \u003c= 1.2.7 - Authenticated (Employer+) Insecure Direct Object Reference",
    "slug": "job-board-light",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31833",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventPrime – Modern Events Calendar, Bookings and Tickets \u003c= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 4.0.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9865",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cleanfix Plugin \u003c 5.0.0 - Remote Code Execution",
    "slug": "wp-cleanfix",
    "type": "plugin",
    "affected_version": "[*, 5.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-2109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2109",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Check \u0026 Log Email \u003c= 1.0.2 - Admin+ SQL Injection via Order and OrderBy parameters",
    "slug": "check-email",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24774",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Image Popup \u003c= 1.3.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-image-popup",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47610",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPSolr \u003c= 24.0 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "wpsolr-free",
    "type": "plugin",
    "affected_version": "* - 24.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31036",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Starbox \u003c= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter URL Field",
    "slug": "starbox",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8239",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Portfolleo \u003c= 1.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "portfolleo",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49653",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Tools \u003c= 1.2.9 - Missing Authorization to Authenticated (Subscriber+)  Plugin Module Deactivation",
    "slug": "woo-tools",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1689",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventPrime \u003c= 3.1.5 - Reflected Cross-Site Scripting via 'event_id'",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45637",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Invoice \u003c= 2.1.3 - Authenticated SQL Injection",
    "slug": "web-invoice",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4371",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Aora \u003c= 1.3.9 - Unauthenticated Local File Inclusion",
    "slug": "aora",
    "type": "theme",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49260",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Admin Log \u003c= 1.50 - Cross-Site Request Forgery",
    "slug": "admin-log",
    "type": "plugin",
    "affected_version": "* - 1.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.50",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23721",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Avatar \u003c= 0.1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "avatar",
    "type": "plugin",
    "affected_version": "* - 0.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39434",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PropertyHive \u003c= 2.0.6 - Missing Authorization via activate_pro_feature",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24718",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Clone any post type \u003c= 3.5 - Open Redirect",
    "slug": "wp-clone-any-post-type",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31871",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid and Gutenberg Blocks – ComboBlocks \u003c= 2.3.6 - Unauthenticated User Information Exposure",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13796",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WebLibrarian \u003c= 3.5.8.1 - Reflected Cross-Site Scripting via multiple parameters",
    "slug": "weblibrarian",
    "type": "plugin",
    "affected_version": "* - 3.5.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29441",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ai Image Alt Text Generator for WP \u003c= 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "ai-image-alt-text-generator-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12177",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobs for WordPress \u003c= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "job-postings",
    "type": "plugin",
    "affected_version": "* - 2.7.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50050",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GigPress \u003c= 2.3.10 - Reflected Cross-Site Scripting",
    "slug": "gigpress",
    "type": "plugin",
    "affected_version": "* - 2.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9354",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GTM Kit \u003c= 2.4.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "gtm-kit",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31001",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Video Contest WordPress Plugin \u003c= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "video-contest",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45827",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Insert Post Ads \u003c= 1.3.2 - Missing Authorization",
    "slug": "insert-post-ads",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35665",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Update Theme and Plugins from Zip File \u003c= 2.0.0 - Cross-Site Request Forgery",
    "slug": "update-theme-and-plugins-from-zip-file",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25489",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rezgo Online Booking \u003c 1.8.2 - Cross-Site Scripting",
    "slug": "rezgo",
    "type": "plugin",
    "affected_version": "[*, 1.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX \u003c= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3239",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OAuth Single Sign On – SSO (OAuth Client) \u003c= 6.23.3 - Missing Authorization",
    "slug": "miniorange-login-with-eve-online-google-facebook",
    "type": "plugin",
    "affected_version": "* - 6.23.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.23.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-34155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34155",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google XML Sitemap for Mobile \u003c= 1.6.1 - Cross-Site Request Forgery via mobile_sitemap_generate",
    "slug": "google-mobile-sitemap",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23869",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WoWHead Tooltips \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wowhead-tooltips",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46449",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 2.20.2 - Sensitive Information Disclosure",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.20.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2117",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Yith WooCommerce Gift Cards Premium \u003c= 3.19.0 - Unauthenticated Arbitrary File Upload",
    "slug": "yith-woocommerce-gift-cards-premium",
    "type": "plugin",
    "affected_version": "* - 3.19.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45359",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletter \u003c= 8.2.0 - IP Spoofing",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "* - 8.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30522",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sandbox \u003c= 0.4 - Reflected Cross-Site Scripting",
    "slug": "sandbox",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13366",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Form Builder \u003c= 3.7.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "easy-form-builder",
    "type": "plugin",
    "affected_version": "* - 3.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30535",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "RomethemeKit For Elementor \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rometheme-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32956",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Polls CP \u003c 1.0.5 - Cross-Site Scripting",
    "slug": "cp-polls",
    "type": "plugin",
    "affected_version": "[*, 1.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9346",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Appbox \u003c= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode",
    "slug": "wp-appbox",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1489",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit File Manager – 100% Free \u0026 Open Source File Manager and Code Editor for WordPress \u003c= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads",
    "slug": "file-manager",
    "type": "plugin",
    "affected_version": "* - 6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1725",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TicketBAI Facturas para WooCommerce \u003c= 3.21 - Missing Authorization",
    "slug": "wp-ticketbai",
    "type": "plugin",
    "affected_version": "* - 3.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24762",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple COD Fees for WooCommerce \u003c= 2.0.2 - Missing Authorization",
    "slug": "simple-cod-fee-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35662",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mini Loops \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mini-loops",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33934",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Address Security by WebEmailProtector \u003c= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "webemailprotector",
    "type": "plugin",
    "affected_version": "* - 3.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28976",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress REST API Authentication \u003c= 3.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update",
    "slug": "wp-rest-api-authentication",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39545",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin \u003c= 3.1.1 - Sensitive Information Disclosure",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "[*, 3.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-8607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8607",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2650",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Function",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1383",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Icons Font Loader \u003c= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "icons-font-loader",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5860",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Ajax Contact Form \u003c= 2.2.2 - Reflected Cross-Site Scripting",
    "slug": "wp-ajax-contact-form",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5809",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sequel \u003c= 1.0.11 - Reflected Cross-Site Scripting",
    "slug": "sequel",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31389",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez \u003c= 3.2.4 - Reflected Cross-Site Scripting",
    "slug": "houzez",
    "type": "theme",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43244",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modal Survey \u003c= 2.0.2.0.1 - Reflected Cross-Site Scripting",
    "slug": "modal-survey",
    "type": "plugin",
    "affected_version": "* - 2.0.2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39469",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pods – Custom Content Types and Fields \u003c= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3956",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Manager \u003c= 3.0 - Cross-Site Request Forgery",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-16966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16966",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "demon image annotation \u003c= 4.7 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "demon-image-annotation",
    "type": "plugin",
    "affected_version": "1.0 - 4.7",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2864",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Snippets \u003c= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'snippet_content'",
    "slug": "post-snippets",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25459",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "W2S – Migrate WooCommerce to Shopify \u003c= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read",
    "slug": "w2s-migrate-woo-to-shopify",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12861",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Dyn Business Panel \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "dyn-business-panel",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13056",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Maps Pro \u003c= 8.1.11 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-google-maps-pro",
    "type": "plugin",
    "affected_version": "* - 8.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36871",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WCFM Frontend Manager \u003c= 6.5.13 - Cross-Site Request Forgery",
    "slug": "wc-frontend-manager",
    "type": "plugin",
    "affected_version": "* - 6.5.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4938",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry \u0026 Carousel \u003c= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 2.4.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6068",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackUpWordPress \u003c= 0.4.2b - Remote File Inclusion",
    "slug": "backupwordpress",
    "type": "plugin",
    "affected_version": "[*, 0.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2007-5800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-5800",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Project Manager \u003c= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3636",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Clever Addons for Elementor \u003c= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets",
    "slug": "cafe-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2350",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KBx Pro Ultimate \u003c= 7.9.8 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "knowledgebase-helpdesk-pro",
    "type": "plugin",
    "affected_version": "* - 7.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31053",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Best Posts Summary \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "best-posts-summary",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39374",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infographic Maker iList \u003c= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Update",
    "slug": "infographic-and-list-builder-ilist",
    "type": "plugin",
    "affected_version": "* - 4.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5858",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form Builder by vcita \u003c= 4.10.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "contact-form-with-a-meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2301",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maileon \u003c= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "xqueue-maileon",
    "type": "plugin",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46068",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.5.1.8 - Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-1002006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1002006",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Layer Slider \u003c= 1.1.9.7 - Cross-Site Request Forgery via save_slide_ajax",
    "slug": "slider-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23671",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Live Dashboard \u003c= 0.3.3 - Reflected Cross-Site Scripting",
    "slug": "live-dashboard",
    "type": "plugin",
    "affected_version": "* - 0.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23474",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyBookTable Bookstore \u003c= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "mybooktable",
    "type": "plugin",
    "affected_version": "* - 3.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29772",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Amazon Affiliates - Wordpress Plugin \u003c= 14.0.10 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "woozone",
    "type": "plugin",
    "affected_version": "* - 14.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.0.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-33549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33549",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tainacan \u003c= 0.20.6 - Unauthenticated Sensitive Information Exposure",
    "slug": "tainacan",
    "type": "plugin",
    "affected_version": "* - 0.20.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.20.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1435",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.0.4 - Privilege Escalation",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2006-4028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-4028",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Campaign Monitor Forms \u003c= 2.5.5 - Missing Authorization to Authenticated(Subscriber+) Options Update via ajax_dismiss_notice",
    "slug": "campaign-monitor-wp",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5098",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Music Sheet Viewer \u003c= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "music-sheet-viewer",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13670",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by wpcodefactory \u003c= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "eu-vat-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47504",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by wpcodefactory \u003c= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "product-quantity-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47504",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by wpcodefactory \u003c= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-checkout-fields-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47504",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by wpcodefactory \u003c= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "products-per-page-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47504",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.4.2 - Missing Authorization Checks on create_post",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-4421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4421",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "MainWP UpdraftPlus Extension \u003c= 4.0.6 - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "mainwp-updraftplus-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23640",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Cron Logger \u003c= 1.3.0 - Missing Authorization",
    "slug": "cron-logger",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53266",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CF Internal Link Shortcode \u003c= 1.1.0 - Unauthenticated SQL Injection",
    "slug": "internal-link-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12404",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SKT Blocks \u003c= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-blocks",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60138",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simplistic SEO \u003c= 2.3.0 - Reflected Cross-Site Scripting",
    "slug": "simplistic-seo",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51719",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPtouch \u003c 1.9.20 - Cross-Site Scripting",
    "slug": "wptouch",
    "type": "plugin",
    "affected_version": "[*, 1.9.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.20",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2010-4779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4779",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light \u003c= 2.4.37 - Unauthenticated Arbitrary File Download",
    "slug": "excel-like-price-change-for-woocommerce-and-wp-e-commerce-light",
    "type": "plugin",
    "affected_version": "* - 2.4.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48124",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Beds24 Online Booking \u003c= 2.0.28 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "beds24-online-booking",
    "type": "plugin",
    "affected_version": "* - 2.0.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32155",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Hover Effects – Elementor Addon \u003c= 1.4.4 - Missing Authorization",
    "slug": "image-hover-effects-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57939",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Mantenimiento web \u003c= 0.8 - Cross-Site Request Forgery",
    "slug": "mantenimiento-web",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38075",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI \u003c= 3.37.2 - Authenticated (Subscriber+) Information Exposure",
    "slug": "simple-tags",
    "type": "plugin",
    "affected_version": "* - 3.37.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.37.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-55710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-55710",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Profile Builder – User Profile \u0026 User Registration Forms \u003c 2.4.2 - Cross-Site Scripting",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10911",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Toggle Box \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "toggle-box",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31450",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meta Box – WordPress Custom Fields Framework \u003c= 5.9.3 - Authenticated (Contributor+) Information Exposure via Post Meta",
    "slug": "meta-box",
    "type": "plugin",
    "affected_version": "* - 5.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1204",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Product Import Export for WooCommerce \u003c= 2.4.1 - Authenticated(Shop Manager+) Arbitrary File Upload",
    "slug": "product-import-export-for-woo",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-30231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30231",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AIKit \u003c= 4.14.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "aikit-wordpress-ai-writing-assistant-using-gpt3",
    "type": "plugin",
    "affected_version": "* - 4.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31370",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "CM Tooltip Glossary – Powerful Glossary Plugin \u003c= 4.2.11 - Cross-Site Request Forgery",
    "slug": "enhanced-tooltipglossary",
    "type": "plugin",
    "affected_version": "* - 4.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4086",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AFI – The Easiest Integration Plugin \u003c= 1.89.4 - Cross-Site Request Forgery",
    "slug": "advanced-form-integration",
    "type": "plugin",
    "affected_version": "* - 1.89.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.89.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43340",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 7.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_color' Shortcode",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2583",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Amazon S3 \u003c= 2.1.3 - Cross-Site Scripting",
    "slug": "edd-amazon-s3",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9506",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All 404 Pages Redirect to Homepage \u003c= 1.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "all-404-pages-redirect-to-homepage",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24889",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Gallery – Vimeo and YouTube Gallery \u003c= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-grid-gallery",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48349",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wonder Video Embed \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wonderplugin-video-embed",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooSwipe WooCommerce Gallery \u003c= 3.0.2 - Missing Authorization",
    "slug": "wooswipe",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45066",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "wp-Table \u003c= 1.43 - Remote File Inclusion",
    "slug": "wp-table",
    "type": "plugin",
    "affected_version": "* - 1.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.43",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2007-2484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-2484",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Real Seguro Viagem \u003c= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "seguro-viagem",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23664",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fancy Product Designer \u003c= 6.1.4 - Authenticated (Admin+) SQL Injection",
    "slug": "fancy-product-designer",
    "type": "plugin",
    "affected_version": "* - 6.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-0365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0365",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "jAlbum Bridge \u003c= 2.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jalbum-bridge",
    "type": "plugin",
    "affected_version": "* - 2.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \u003c= 1.27.8 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "post-and-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.27.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52713",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate WP Query Search Filter \u003c= 1.0.10 - Authenticated (Contributor+) Stored Cross Site Scripting",
    "slug": "ultimate-wp-query-search-filter",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23832",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link Library \u003c= 7.6.3 - Reflected Cross-Site Scripting",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core 6.4.0 - 6.4.1 - Remote Code Execution POP Chain",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.4.0",
    "from_version": "6.4.0",
    "from_inclusive": true,
    "to_version": "6.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31211",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core 6.4.0 - 6.4.1 - Remote Code Execution POP Chain",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.4.1",
    "from_version": "6.4.1",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31211",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS Pro \u003c= 2.7.0 - Missing Authorization to SQL Injection",
    "slug": "tutor-pro",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4352",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Permalinker \u003c= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-permalinker",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11894",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ChatBot \u003c= 4.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via openai_settings_option_callback",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1651",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Abandoned Cart Lite for WooCommerce \u003c= 5.15.1 - Authentication Bypass",
    "slug": "woocommerce-abandoned-cart",
    "type": "plugin",
    "affected_version": "* - 5.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.15.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2986",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Meks Smart Author Widget \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meks-smart-author-widget",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37958",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Header Footer Code Manager \u003c= 1.1.16 - Reflected Cross-Site Scripting",
    "slug": "header-footer-code-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0710",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video \u0026 Photo Gallery for Ultimate Member \u003c= 1.1.2 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "gallery-for-ultimate-member",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Metabox \u003c= 1.5 - Missing Authorization via refresh_metabox",
    "slug": "gallery-metabox",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2562",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Wholesale Market for WooCommerce \u003c= 2.0.0 \u0026 Wholesale Market \u003c= 2.2.1 - Cross-Site Request Forgery",
    "slug": "wholesale-market",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4363",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wholesale Market for WooCommerce \u003c= 2.0.0 \u0026 Wholesale Market \u003c= 2.2.1 - Cross-Site Request Forgery",
    "slug": "wholesale-market-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4363",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blockspare \u003c= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blockspare",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43164",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Classified Listings \u003c= 1.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Title Parameter",
    "slug": "ultimate-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13748",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress \u0026 WooCommerce \u003c= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Workflow Settings",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12568",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Media Share Buttons \u003c= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "social-media-builder",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1685",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.7.1001 - Reflected Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1001",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56226",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Board Election \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "board-election",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23499",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoho Forms \u003c= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "zoho-forms",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.0, 4.0.32)",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.32",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.1, 4.1.32)",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.32",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.2, 4.2.29)",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.29",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.7, 3.7.35)",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.35",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.4, 5.4.4)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.9, 4.9.16)",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.16",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.8, 3.8.35)",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.35",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.4, 4.4.24)",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.24",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.5, 4.5.23)",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.23",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.7, 4.7.19)",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.19",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.0, 5.0.11)",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.11",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.1, 5.1.8)",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.2, 5.2.9)",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.9, 3.9.33)",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.33",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.3, 4.3.25)",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.25",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.6, 4.6.20)",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.20",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.3, 5.3.6)",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.5, 5.5.3)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.3 - PHP Object Injection Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.8, 4.8.15)",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.15",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-29476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-29476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Authors Autocomplete Meta Box \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "authors-autocomplete-meta-box",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25169",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kognetiks Chatbot for WordPress \u003c= 2.1.8 - Cross-Site Request Forgery to Authenticated (Subscriber+) Assistant Modification",
    "slug": "chatbot-chatgpt",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11143",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Butcher \u003c= 2.40 - Reflected Cross-Site Scripting",
    "slug": "butcher",
    "type": "theme",
    "affected_version": "* - 2.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32285",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Keywords \u003c= 1.1.3 - Reflected Cross-Site Scripting via google_error Parameter",
    "slug": "seo-keywords",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12126",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JSmol2WP \u003c= 1.07 - Cross-Site Scripting",
    "slug": "jsmol2wp",
    "type": "plugin",
    "affected_version": "* - 1.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.07",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20462",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chartify \u003c= 3.5.3 - Cross-Site Request Forgery",
    "slug": "chart-builder",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54673",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Passwords Manager \u003c= 1.4.8 - Unauthenticated SQL Injection",
    "slug": "passwords-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12613",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Stock Manager for WooCommerce \u003c= 2.10.0 - Cross-Site Request Forgery",
    "slug": "woocommerce-stock-manager",
    "type": "plugin",
    "affected_version": "[*, 2.11.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-35091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35091",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Top Bar \u003c= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "top-bar",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2629",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magze \u003c= 1.0.9 - Unauthenticated Local File Inclusion",
    "slug": "magze",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49282",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "File Away \u003c= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function",
    "slug": "file-away",
    "type": "plugin",
    "affected_version": "* - 3.9.9.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2512",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Document Engine \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "document-engine",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58640",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextCellent Gallery  \u003c 1.9.18 - Stored Cross-Site Scripting",
    "slug": "nextcellent-gallery-nextgen-legacy",
    "type": "plugin",
    "affected_version": "[*, 1.9.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-3123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3123",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hospital Management System \u003c= 47.0(20-11-2023) - Unauthenticated Arbitrary File Upload",
    "slug": "hospital-management",
    "type": "plugin",
    "affected_version": "[*, 47.0(20-11-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "47.0(20-11-2023)",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39380",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gutenberg \u0026 Elementor Templates Importer For Responsive \u003c= 3.1.9 - Missing Authorization",
    "slug": "responsive-add-ons",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47486",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cost Calculator Builder Pro \u003c= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload",
    "slug": "cost-calculator-builder-pro",
    "type": "plugin",
    "affected_version": "* - 3.1.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.67",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4097",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swift Performance Lite \u003c= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification",
    "slug": "swift-performance-lite",
    "type": "plugin",
    "affected_version": "* - 2.3.6.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3722",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Proof Factor \u0026#8211; Social Proof Notifications \u003c= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "proof-factor-social-proof-notifications",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58658",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Tip for WooCommerce \u003c= 1.3.1 - Missing Authorization to Unauthenticated Data Export",
    "slug": "order-tip-woo",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1119",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Export any WordPress data to XML/CSV \u003c 1.4.1 \u0026 WP ALL Export Pro \u003c 1.8.6 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "wp-all-export-pro",
    "type": "plugin",
    "affected_version": "[*, 1.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-5882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5882",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Export any WordPress data to XML/CSV \u003c 1.4.1 \u0026 WP ALL Export Pro \u003c 1.8.6 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "wp-all-export",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-5882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5882",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPMozo Addons Lite for Elementor \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpmozo-addons-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56221",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin Pro \u003c= 4.5.4 \u0026 Free \u003c= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6242",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin Pro \u003c= 4.5.4 \u0026 Free \u003c= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6242",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Product Input Fields for WooCommerce \u003c= 1.7.0 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "product-input-fields-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31431",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Revy \u003c= 1.18 - Unauthenticated SQL Injection",
    "slug": "revy",
    "type": "plugin",
    "affected_version": "* - 1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54215",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Store Locator WordPress \u003c= 1.4.5 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "agile-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41615",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP SVG Icons \u003c= 3.2.3 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "svg-vector-icon-plugin",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0863",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Icegram Collect – Easy Form, Lead Collection and Subscription plugin \u003c= 1.3.18 - Missing Authorization",
    "slug": "icegram-rainmaker",
    "type": "plugin",
    "affected_version": "* - 1.3.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47527",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appointment Booking and Online Scheduling \u003c= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5791",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Majestic Before After Image \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "majestic-before-after-image",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9030",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "CC BMI Calculator \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cc-bmi-calculator",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23516",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Motors \u003c= 1.4.71 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.71",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32142",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Colibri Page Builder \u003c 1.0.334 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "[*, 1.0.334)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.334",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-59593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59593",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5977",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Mail logging – WP Mail Catcher \u003c= 2.1.3 - Authenticated(Administrator+) SQL Injection",
    "slug": "wp-mail-catcher",
    "type": "plugin",
    "affected_version": "[*, 2.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50844",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TinyMCE Extended Config \u003c= 0.1.0 - Reflected Cross-Site Scripting",
    "slug": "tinymce-extended-config",
    "type": "plugin",
    "affected_version": "* - 0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23439",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fantastic Content Protector Free \u003c= 2.6 - Missing Authorization via update_setting_fantastic_content_protector",
    "slug": "fantastic-content-protector-free",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25048",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ResAds \u003c= 2.0.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "resads",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23779",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GS Books Showcase \u003c= 1.3.0 - Authenticator (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gs-books-showcase",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0541",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ad Inserter \u003c= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai_ajax",
    "slug": "ad-inserter",
    "type": "plugin",
    "affected_version": "* - 2.7.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4645",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Bookmarks \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-bookmarks",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31431",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Amplify \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "wpr-admin-amplify",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51691",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mingle Forum  \u003c= 1.0.33.3 - Stored Cross-Site Scripting",
    "slug": "mingle-forum",
    "type": "plugin",
    "affected_version": "* - 1.0.33.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.33.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-0734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-0734",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Audio Album \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "audio-album",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30780",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login using WordPress Users (WP as SAML IDP) \u003c= 1.13.2 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "miniorange-wp-as-saml-idp",
    "type": "plugin",
    "affected_version": "* - 1.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1010",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category SEO Meta Tags \u003c= 2.5 - Cross-Site Request Forgery via csmt_admin_options",
    "slug": "category-seo-meta-tags",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46618",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "News Element Elementor Blog Magazine \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "news-element",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32191",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rate my Post - WP Rating System \u003c= 3.4.1 - Insecure Direct Object Reference",
    "slug": "rate-my-post",
    "type": "plugin",
    "affected_version": "[*, 3.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-49765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49765",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "My Geo Posts Free \u003c= 1.2 - Unauthenticated PHP Object Injection",
    "slug": "my-geo-posts-free",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52433",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Countdown \u0026 Clock \u003c= 2.2.8 - Reflected Cross-Site Scripting",
    "slug": "countdown-builder",
    "type": "plugin",
    "affected_version": "[*, 2.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0601",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.8.21 - Reflected Cross-Site Scripting via 'image_id'",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29808",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor addons and Templates Library \u003c= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets",
    "slug": "elementskit",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5263",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simply Exclude \u003c= 2.0.6.6 - Reflected Cross-Site Scripting",
    "slug": "simply-exclude",
    "type": "plugin",
    "affected_version": "* - 2.0.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48743",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hive Support \u003c= 1.2.5 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function",
    "slug": "hive-support",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5019",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "JetSearch \u003c= 3.5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-search",
    "type": "plugin",
    "affected_version": "* - 3.5.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53996",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.6.20 - Authenticated (Subscriber+) Race Condition to Multiple Reviews",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59577",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Breakdance \u003c= 1.7.1 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "breakdance",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4605",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yet Another bol.com - \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "yabp",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38330",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Doccure \u003c= 1.4.9 - Unauthenticated Arbitrary User Password Change",
    "slug": "doccure",
    "type": "theme",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-9114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9114",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordLift \u003c= 3.54.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wordlift",
    "type": "plugin",
    "affected_version": "* - 3.54.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.54.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53582",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LH Password Changer \u003c= 1.55 - Cross-Site Request Forgery",
    "slug": "lh-password-changer",
    "type": "plugin",
    "affected_version": "* - 1.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.55",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34182",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Staff Widget",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.17.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12588",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wp-mpdf \u003c= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-mpdf",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60040",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eCommerce Shop Styling \u003c 1.8 - Remote File Inclusion",
    "slug": "wp-ecommerce-shop-styling",
    "type": "plugin",
    "affected_version": "[*, 1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-0724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-0724",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Olivia \u003c= 0.9.5 - Reflected Cross-Site Scripting",
    "slug": "olivia",
    "type": "theme",
    "affected_version": "* - 0.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56014",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Silesia \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode",
    "slug": "silesia",
    "type": "theme",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5788",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 2.9.8 - Stored Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-13864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13864",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Event RSVP and Simple Event Management Plugin \u003c= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-easy-events",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Passster – Password Protect Pages and Content \u003c= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure",
    "slug": "content-protector",
    "type": "plugin",
    "affected_version": "* - 4.2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0616",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "HTML2WP \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "html2wp",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1573",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Compare Products for WooCommerce \u003c= 3.2.1 - Unauthenticated PHP Object Injection",
    "slug": "woocommerce-compare-products",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12313",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "amCharts: Charts and Maps \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "amcharts-charts-and-maps",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36405",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Athletics \u003c= 1.1.7 - Reflected Cross-Site Scripting",
    "slug": "wp-athletics",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1773",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wanderland \u003c= 1.7.1 - Unauthenticated Local File Inclusion",
    "slug": "wanderland",
    "type": "theme",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39467",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPMobile.App — Android and iOS Mobile Application \u003c= 11.18 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpappninja",
    "type": "plugin",
    "affected_version": "* - 11.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26010",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Captcha Them All \u003c= 1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "captcha-them-all",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-30786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30786",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Product Tabs for WooCommerce \u003c= 1.7.7 - Subscriber+ Settings Update",
    "slug": "yikes-inc-easy-custom-woocommerce-product-tabs",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-28666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-28666",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Multi Step Form \u003c= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload",
    "slug": "multi-step-form",
    "type": "plugin",
    "affected_version": "* - 1.7.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12427",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Getwid – Gutenberg Blocks \u003c= 2.0.10 - Missing Authorization to Google API key update",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6489",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Avada Theme \u003c= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13346",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Statistics \u003c= 13.1.5 - Unauthenticated SQL Injection",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 13.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-25148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25148",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Maps for WP \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "maps-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13648",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seriously Simple Podcasting \u003c= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "seriously-simple-podcasting",
    "type": "plugin",
    "affected_version": "* - 2.19.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.19.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4571",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TableOn – WordPress Posts Table Filterable \u003c= 1.0.4 - Missing Authorization",
    "slug": "posts-table-filterable",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32218",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Radio Player Shoutcast \u0026 Icecast WordPress Plugin \u003c= 4.4.6 - Authenticated (Contributor+) SQL Injection",
    "slug": "audio4-html5",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32306",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Wot Elementor Widgets \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wot-elementor-widgets",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54228",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cart tracking for WooCommerce \u003c= 1.0.17 - Authenticated (Administrator+) SQL Injection",
    "slug": "cart-tracking-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47538",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Request Call Back \u003c= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "request-call-back",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32483",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImagePress - Image Gallery \u003c= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update",
    "slug": "image-gallery",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9824",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DZS Video Gallery \u003c= 12.25 - Reflected Cross-Site Scripting",
    "slug": "dzs-videogallery",
    "type": "plugin",
    "affected_version": "* - 12.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32300",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKT Blocks – Gutenberg based Page Builder \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-blocks",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43946",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salvador – AI Image Generator \u003c= 1.0.11 - Missing Authorization",
    "slug": "salvador-ai-image-generator",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23954",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HidePost \u003c= 2.3.8 - Cross-Site Request Forgery",
    "slug": "hidepost",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53310",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Admin Style \u003c= 0.1.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-admin-style",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1814",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCOM Member \u003c= 1.7.6 - Unauthenticated Time-Based SQL Injection",
    "slug": "wpcom-member",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2221",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MasterStudy LMS WordPress Plugin – for Online Courses and Education \u003c= 3.3.23 - Unauthenticated Limited Privilege Escalation to Instructor",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.3.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5973",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Code Snippets Extended \u003c= 1.4.7 - Cross-Site Request Forgery",
    "slug": "code-snippets-extended",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29435",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Schema \u0026 Structured Data for WP \u0026 AMP \u003c= 1.26 - Authenticated (Custom) Stored Cross-Site Scripting",
    "slug": "schema-and-structured-data-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1586",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme and plugin translation for Polylang \u003c= 3.2.16 - Missing Authorization",
    "slug": "theme-translation-for-polylang",
    "type": "plugin",
    "affected_version": "* - 3.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4169",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Dashboard Notes \u003c= 1.0.10 - Insecure Direct Object References to Authenticated Private Note Deletion",
    "slug": "wp-dashboard-notes",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7198",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Compfight \u003c 1.5 - Reflected Cross-Site Scripting",
    "slug": "compfight",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-5202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5202",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewsTicker \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "news-list",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13630",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10117",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cooked Pro \u003c 1.7.5.7 - Unauthenticated PHP Object Injection",
    "slug": "cooked-pro",
    "type": "plugin",
    "affected_version": "[*, 1.7.5.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-3900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3900",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MyBB Cross-Poster \u003c= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mybb-cross-poster",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39338",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cowidgets – Elementor Addons \u003c= 1.2.0 - Authenticated (Contributor+) Post Disclosure",
    "slug": "cowidgets-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10779",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.14",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.14",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.11",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.7",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.6",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.5",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.17",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.2",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.1",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.17",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.2 - Authorization Bypass to Term Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.15",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5610",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Termin-Kalender \u003c= 0.99.47 - Missing Authorization to Authenticated (Subscriber+)",
    "slug": "termin-kalender",
    "type": "plugin",
    "affected_version": "* - 0.99.47",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.99.47",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54354",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page Builder: Live Composer \u003c= 1.5.42 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "live-composer-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.42",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-35780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35780",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Martins Free Monetized Ad Exchange Network \u003c= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "martins-free-and-easy-ad-network-get-more-visitors",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47620",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Genesis Columns Advanced \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "genesis-columns-advanced",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4706",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YayExtra \u003c= 1.5.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "yayextra",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48299",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Report \u003c= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "ithemelandco-woo-report",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10711",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Forms \u003c 2.6.26 - Cross-Site Request Forgery",
    "slug": "smart-forms",
    "type": "plugin",
    "affected_version": "[*, 2.6.26)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.26",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-5924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5924",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JCH Optimize \u003c= 3.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings",
    "slug": "jch-optimize",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25491",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Dashboard \u003c= 3.7.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "ultimate-dashboard",
    "type": "plugin",
    "affected_version": "[*, 3.7.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2812",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register – User Registration Forms \u003c 2.0.19 - Reflected Cross-Site Scripting",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "[*, 2.0.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-7377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7377",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Verification \u003c= 1.0.93 - Privilege Escalation",
    "slug": "user-verification",
    "type": "plugin",
    "affected_version": "* - 1.0.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.93",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4693",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "XLTab – Accordions and Tabs for Elementor Page Builder \u003c= 1.4 - Authenticated (Contributor+) Post Disclosure",
    "slug": "xl-tab",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10689",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Stop Spammers Security | Block Spam Users, Comments, Forms \u003c= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process",
    "slug": "stop-spammer-registrations-plugin",
    "type": "plugin",
    "affected_version": "* - 2024.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7065",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP-Asambleas \u003c= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-asambleas",
    "type": "plugin",
    "affected_version": "* - 2.85.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.85.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13579",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DELUCKS SEO \u003c= 2.6.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "delucks-seo",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48165",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ajax Search Lite \u003c= 4.12.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ajax-search-lite",
    "type": "plugin",
    "affected_version": "* - 4.12.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10568",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Social Media Share Buttons \u003c= 5.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-social-buttons",
    "type": "plugin",
    "affected_version": "* - 5.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13610",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Pickup Store \u003c= 1.8.9 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "wc-pickup-store",
    "type": "plugin",
    "affected_version": "* - 1.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47634",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 1.0.353 - Authenticated Stored Cross-Site Scripting",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 1.0.353",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.353",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-7228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7228",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My auctions allegro \u003c= 3.6.24 - Cross-Site Request Forgery",
    "slug": "my-auctions-allegro-free-edition",
    "type": "plugin",
    "affected_version": "* - 3.6.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27009",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Security \u003c= 4.2 - Admin+ Stored Cross-Site Scripting",
    "slug": "wp-security-pro",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1028",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks \u0026 Patterns \u003c= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 5.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11270",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 3.9.7 - Cross-Site Scripting",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 3.9.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9293",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 \u003c 3.7.0 - Cross-Site Scripting",
    "slug": "alipay",
    "type": "plugin",
    "affected_version": "[*, 3.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4514",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics \u003c= 4.4.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission",
    "slug": "cookiebot",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1666",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bold pagos en linea \u003c= 3.1.4 - Reflected Cross-Site Scripting",
    "slug": "bold-pagos-en-linea",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22793",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Database Addon – CFDB7 plugin \u003c= 1.2.5.9 - Cross-Site Request Forgery",
    "slug": "contact-form-cfdb7",
    "type": "plugin",
    "affected_version": "* - 1.2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36886",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "EnvíaloSimple: Email Marketing y Newsletters \u003c= 2.3 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "envialosimple-email-marketing-y-newsletters-gratis",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2125",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Abandoned Cart Recovery for WooCommerce \u003c= 1.0.4 - Cross-Site Request Forgery Bypass",
    "slug": "woo-abandoned-cart-recovery",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4395",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sassy Social Share \u003c= 3.3.39 - Reflected Cross-Site Scripting",
    "slug": "sassy-social-share",
    "type": "plugin",
    "affected_version": "[*, 3.3.40)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.40",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24746",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress REST API Authentication \u003c= 2.4.0 - Cross-Site Request Forgery",
    "slug": "wp-rest-api-authentication",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45073",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dynamic AJAX Product Filters for WooCommerce \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter",
    "slug": "dynamic-ajax-product-filters-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8073",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiquidPoll \u003c= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data Parameter",
    "slug": "wp-poll",
    "type": "plugin",
    "affected_version": "* - 3.3.78",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.78",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7134",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share Buttons \u0026 Analytics Plugin – GetSocial.io \u003c= 4.3.12 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-share-buttons-analytics-by-getsocial",
    "type": "plugin",
    "affected_version": "* - 4.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49189",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointy Appointment Scheduler \u003c= 4.2.1 - Cross-Site Request Forgery to Settings Change",
    "slug": "appointy-appointment-scheduler",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31601",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mingle Forum \u003c= 1.0.32.1 - SQL Injection",
    "slug": "mingle-forum",
    "type": "plugin",
    "affected_version": "* - 1.0.32.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.32.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-5327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5327",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Do That Task \u003c= 1.5.5 - Unauthenticated Arbitrary File Upload",
    "slug": "do-that-task",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52374",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Scan External Links \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "scan-external-links",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22583",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 5.8.1.1 - Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "[*, 5.8.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-9020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-9020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Gallery – YouTube Playlist, Channel Gallery by YotuWP \u003c= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via Shortcode",
    "slug": "yotuwp-easy-youtube-embed",
    "type": "plugin",
    "affected_version": "* - 1.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4551",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Text Field For Contact Form 7 \u003c= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dynamic-text-field-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rocket Font \u003c= 1.2.3 - Cross-Site Request Forgery via update_option_check_match_default",
    "slug": "rocket-font",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46067",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Limit Login Attempts \u003c= 1.7.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "limit-login-attempts",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1912",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fluent Forms \u003c= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6957",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Live Streaming - Broadcast Live Video \u003c= 5.5.15 - Missing Authorization to Unauthenticated Remote Code Execution",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "* - 5.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-25699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25699",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Zoho Forms \u003c= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zoho-forms",
    "type": "plugin",
    "affected_version": "3.0.0",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0169",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Flash Embed \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-flash-embed",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48105",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp Slide Categorywise \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-slide-categorywise",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51690",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Typing Text \u003c= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "typing-text",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5058",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36863",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 1.2.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2004-1559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2004-1559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Toolkit for LearnDash \u003c= 3.6.4.3 - Missing Authorization via review-banner-visibility REST route",
    "slug": "uncanny-learndash-toolkit",
    "type": "plugin",
    "affected_version": "* - 3.6.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34019",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Statistics \u003c= 13.2.16 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 13.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.2.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0955",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Membership Plugin – Restrict Content \u003c= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "restrict-content",
    "type": "plugin",
    "affected_version": "* - 3.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11090",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Google Review Slider \u003c= 11.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-google-places-review-slider",
    "type": "plugin",
    "affected_version": "* - 11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4242",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ClickCease Click Fraud Protection \u003c= 3.2.7 - Cross-Site Request Forgery",
    "slug": "clickcease-click-fraud-protection",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33678",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Videopack \u003c= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "video-embed-thumbnail-generator",
    "type": "plugin",
    "affected_version": "* - 4.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54016",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk YouTube Post Creator \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "bulk-youtube-post-creator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49423",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newscrunch \u003c= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "newscrunch",
    "type": "theme",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1306",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CM Download Manager \u003c= 2.7.0 - Cross-Site Scripting",
    "slug": "cm-download-manager",
    "type": "plugin",
    "affected_version": "[*, 2.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-24145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24145",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "360 View \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "360-view",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46509",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GF Windcave Free \u003c= 1.4.3 - Reflected Cross-Site Scripting",
    "slug": "gravity-forms-dps-pxpay",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10117",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoorum Comments \u003c= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "zoorum-comments",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2163",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirecter \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcode-for-redirection",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51855",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Axioma Premium Responsive \u003c 1.1.2 - Information Disclosure",
    "slug": "axioma",
    "type": "theme",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9486",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Vertical marquee plugin \u003c= 7.1 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "vertical-marquee-plugin",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5436",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP tarteaucitron.js Self Hosted \u003c= 1.2.4 - Running a Vulnerable Dependency",
    "slug": "wp-tarteaucitron-js-self-hosted",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3620",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate WordPress Auction Plugin \u003c= 4.2.7 - Missing Authorization to Unauthenticated Email Creation",
    "slug": "ultimate-auction",
    "type": "plugin",
    "affected_version": "* - 4.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6591",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Caliris \u003c= 1.5 - Unauthenticated Local File Inclusion",
    "slug": "caliris-wp",
    "type": "theme",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48160",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "teachPress \u003c= 9.0.4 - Cross-Site Request Forgery",
    "slug": "teachpress",
    "type": "plugin",
    "affected_version": "* - 9.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48755",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rife Free \u003c= 2.4.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rife-free",
    "type": "theme",
    "affected_version": "* - 2.4.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35708",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery \u0026 Interactive Circle",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3728",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Five Star Restaurant Reviews \u003c= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Review URL",
    "slug": "good-reviews-wp",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24838",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Dummy Content Generator \u003c= 3.1.2 - Missing Authorization",
    "slug": "wp-dummy-content-generator",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24805",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WholesaleX \u003c= 1.3.1 - Authenticated(Subscriber+) Missing Authorization via multiple AJAX actions",
    "slug": "wholesalex",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30234",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.14 - Reflected Cross-Site Scripting",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30796",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Lead Capturing Pages \u003c= 2.3 - Missing Authorization to Arbitrary Content Deletion",
    "slug": "leadcapture",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31425",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Strategery Migrations \u003c= 1.0 - Unauthenticated Arbitrary File Deletion",
    "slug": "strategery-migrations",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-35745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35745",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Multiple Page Generator Plugin – MPG \u003c= 3.4.7 - Authenticated (Contributor+) SQL Injection",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47325",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1171",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP File Uploader Extension \u003c= 4.1 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "mainwp-file-uploader-extension",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23653",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Outbound Link Manager \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "outbound-link-manager",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41850",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SQL Chart Builder \u003c= 2.3.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sql-chart-builder",
    "type": "plugin",
    "affected_version": "* - 2.3.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58233",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme Demo Import \u003c= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "theme-demo-import",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28170",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booster Elite for WooCommerce \u003c 1.1.7 - Cross-Site Request Forgery",
    "slug": "booster-elite-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-3763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3763",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Best Quiz \u003c= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wp-best-quiz",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3739",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Greenshift – animation and page builder blocks \u003c= 4.9.9 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 4.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22707",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Asgaros Forum \u003c= 2.1.0 - Cross-Site Request Forgery",
    "slug": "asgaros-forum",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41608",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rucy \u003c= 0.4.4 - Cross-Site Request Forgery Bypass",
    "slug": "rucy",
    "type": "plugin",
    "affected_version": "* - 0.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4396",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3548",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload - Contact Form 7 \u003c= 1.3.6.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "drag-and-drop-multiple-file-upload-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0595",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grid Plus \u003c= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete",
    "slug": "grid-plus",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5251",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "iThemes Security \u003c= 7.6.1 - Broken Password Mechanism",
    "slug": "better-wp-security",
    "type": "plugin",
    "affected_version": "* - 7.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36176",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.65 - Missing Authorization",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.65",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31080",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "CPT Bootstrap Carousel \u003c= 1.12 - Reflected Cross-Site Scripting",
    "slug": "cpt-bootstrap-carousel",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52196",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Events Calendar Countdown Addon \u003c= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "countdown-for-the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49311",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by Ays \u003c= 5.1.6 - Reflected Cross-Site Scripting",
    "slug": "gallery-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 5.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2568",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CodeBard's Patron Button and Widgets for Patreon \u003c= 2.1.9 - Reflected Cross-Site Scripting via cb_p6_tab",
    "slug": "patron-button-and-widgets-by-codebard",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47524",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uix Shortcodes \u003c= 2.0.3 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "uix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22677",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Watu Quiz \u003c= 3.3.8.1 - Reflected Cross-Site Scripting",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 3.3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0428",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reviews Plus \u003c= 1.3.4 - Missing Authorization to Notice Dismissal",
    "slug": "reviews-plus",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32822",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OMFG Mobile Pro \u003c= 1.1.26 - Cross-Site Scripting",
    "slug": "omfg-mobile",
    "type": "plugin",
    "affected_version": "* - 1.1.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4541",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Acerola \u003c= 1.6.5 - Missing Authorization",
    "slug": "acerola",
    "type": "theme",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31066",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Additional Custom Order Status for WooCommerce \u003c= 1.6.0 - Reflected Cross-Site Scripting",
    "slug": "order-status-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11814",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.2",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.8",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.8",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.6",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.5",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.5",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wonder Slider Lite \u003c= 13.9 - Reflected Cross-Site Scripting via 'page'",
    "slug": "wonderplugin-slider-lite",
    "type": "plugin",
    "affected_version": "* - 13.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24877",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.8.21 - Reflected Cross-Site Scripting via 'current_url'",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29832",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pay With Stripe \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "payments-stripe-gateway",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51918",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPDM – Premium Packages \u003c= 6.0.2 - Cross-Site Request Forgery",
    "slug": "wpdm-premium-packages",
    "type": "plugin",
    "affected_version": "* - 6.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54732",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Upload Quota per User \u003c= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "upload-quota-per-user",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30537",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Front User Submit / Front Editor \u003c= 4.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "front-editor",
    "type": "plugin",
    "affected_version": "* - 4.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47617",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hash Form – Drag \u0026 Drop Form Builder \u003c= 1.1.0 - Unauthenticated PHP Object Injection",
    "slug": "hash-form",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5085",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.6 - Missing Authorization via save_fields_settings",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32601",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Popular Posts \u003c= 5.3.2 - Authenticated Arbitrary File Upload",
    "slug": "wordpress-popular-posts",
    "type": "plugin",
    "affected_version": "* - 5.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-42362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42362",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Dummy Content Generator \u003c= 2.3.0 - Cross-Site Request Forgery",
    "slug": "wp-dummy-content-generator",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37392",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Marketing Performance \u003c= 2.0.0 - Unauthenticated Stored Cross Site Scripting",
    "slug": "marketing-performance",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24404",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YaDisk Files \u003c= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-yadisk-files",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10709",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "My WP Translate \u003c= 1.0.3 - Unprotected AJAX Actions",
    "slug": "my-wp-translate",
    "type": "plugin",
    "affected_version": "[*, 1.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18569",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OWM Weather \u003c= 5.6.8 - Authenticated (Contributor+) SQL Injection",
    "slug": "owm-weather",
    "type": "plugin",
    "affected_version": "* - 5.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3769",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gutenberg Blocks with AI by Kadence WP – Page Builder Features \u003c= 3.2.19 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "rtMedia for WordPress, BuddyPress and bbPress \u003c= 4.6.14 - Missing Authorization via export_settings",
    "slug": "buddypress-media",
    "type": "plugin",
    "affected_version": "* - 4.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41951",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slideshow Gallery \u003c= 1.6.8 - SQL Injection",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-18018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-18018",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms \u003c= 1.82.0 - SQL Injection to Reflected Cross-Site Scripting via integration_id",
    "slug": "advanced-form-integration",
    "type": "plugin",
    "affected_version": "* - 1.82.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.82.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2387",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Upload Scanner \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "upload-scanner",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56035",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Privacy Policy Generator, Terms \u0026 Conditions Generator WordPress Plugin : WPLegalPages \u003c 1.1 - Cross-Site Scripting",
    "slug": "wplegalpages",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9428",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 5.3 - Missing Authorization to Toggle Crawler State",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46800",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Hover Effects - Elementor Addon \u003c= 1.4.1 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects Widget",
    "slug": "image-hover-effects-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1166",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeoDirectory – WordPress Business Directory Plugin, or Classified Directory \u003c= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.3.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3732",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avishi WP PayPal Payment Button \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "avishi-wp-paypal-payment-button",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7669",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sassy Social Share \u003c= 3.3.62 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sassy-social-share",
    "type": "plugin",
    "affected_version": "* - 3.3.62",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.62",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4924",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DecaLog \u003c= 3.9.0 - Authenticated (Admin+) SQL injection",
    "slug": "decalog",
    "type": "plugin",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30245",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "File Gallery \u003c= 1.8.5.4 - Reflected Cross-Site Scripting via post_id",
    "slug": "file-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48771",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Side Menu Lite – add sticky fixed buttons \u003c= 4.2 - Cross-Site Request Forgery",
    "slug": "side-menu-lite",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3476",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FAT Event Lite \u003c= 1.1 - Unauthenticated Local File Inclusion",
    "slug": "fat-event-lite",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-22508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22508",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Terms Popup \u003c= 2.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-terms-popup",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24006",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Compliance \u003c= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gdpr-cookie-compliance",
    "type": "plugin",
    "affected_version": "* - 4.15.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1621",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Button Block – Get fully customizable \u0026 multi-functional buttons \u003c= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication",
    "slug": "button-block",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12560",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Forminator \u003c= 1.14.11 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "[*, 1.14.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.12",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-36821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36821",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Title Tag \u003c= 3.5.9 - Reflected Cross-Site Scripting",
    "slug": "seo-title-tag",
    "type": "plugin",
    "affected_version": "* - 3.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31097",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EP4 More Embeds \u003c= 1.0.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "ep4-more-embeds",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-25083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25083",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.5.1.8 - Reflected Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-1002009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1002009",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoho Campaigns \u003c= 2.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "zoho-campaigns",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38752",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Football Pool \u003c= 2.12.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "football-pool",
    "type": "plugin",
    "affected_version": "* - 2.12.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30764",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ConvertKit \u003c= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "convertkit",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4508",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OpenID \u003c= 3.6.1 - Reflected Cross-Site Scripting",
    "slug": "openid",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31107",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVPMaker \u003c 5.6.4 - SQL Injection",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "[*, 5.6.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-21004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-21004",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Optimizer \u003c= 2.3.6 - Cross-Site Request Forgery",
    "slug": "wp-optimizer",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53314",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JS Job Manager \u003c= 2.0.2 - Missing Authorization",
    "slug": "js-jobs",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31868",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Scrippets \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "wp-scrippets",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38333",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search in Place \u003c= 1.0.104 - Cross-Site Request Forgery to Feedback Submission",
    "slug": "search-in-place",
    "type": "plugin",
    "affected_version": "* - 1.0.104",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.104",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26521",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Safe SVG \u003c= 1.9.4 - Denial of Service",
    "slug": "safe-svg",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-18855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-18855",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "HTACCESS IP Blocker \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "htaccess-ip-blocker",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60170",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TablePress – Tables in WordPress made easy \u003c= 2.3 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebind",
    "slug": "tablepress",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4354",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Verified Reviews (Avis Vérifiés) \u003c= 2.3.14 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "netreviews",
    "type": "plugin",
    "affected_version": "* - 2.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23720",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by Supsystic \u003c= 1.7.24 - Cross-Site Request Forgery via AJAX action",
    "slug": "contact-form-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2528",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Map Contact \u003c= 3.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "map-contact",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30588",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP \u003c= 6.1.10 - Unauthenticated Arbitrary File Deletion",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "* - 6.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26752",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Gum Elementor Addon \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget",
    "slug": "gum-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2348",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi-Column Taxonomy List \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "multi-column-taxonomy-list",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46491",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "gAppointments - Appointment booking addon for Gravity Forms \u003c= 1.9.7 - Reflected Cross-Site Scripting",
    "slug": "gAppointments",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2705",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Map Pro \u003c= 6.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "image-map-pro",
    "type": "plugin",
    "affected_version": "* - 6.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9585",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Multi by BestWebSoft – Multiple Forms Plugin for Single WordPress Website \u003c 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "contact-form-multi",
    "type": "plugin",
    "affected_version": "[*, 1.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18490",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadstreet \u003c= 1.51.1 - Cross-Site Request Forgery",
    "slug": "broadstreet",
    "type": "plugin",
    "affected_version": "* - 1.51.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.51.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32270",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Qi Blocks \u003c= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "qi-blocks",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5221",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Share Buttons – Social Media \u003c= 1.0.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "rich-web-share-button",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51845",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "StaffList \u003c= 3.2.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "stafflist",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13749",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.54 - Authenticated (Admin+) Path Traversal",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "[*, 3.2.55)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.55",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2926",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "All-in-one Floating Contact Form \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "mystickyelements",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0148",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Page Speed Extension \u003c= 4.0.2 - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "mainwp-page-speed-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23644",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Social Warfare \u003c= 4.3.1 - Cross-Site Request Forgery",
    "slug": "social-warfare",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0403",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Pubnews \u003c= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation",
    "slug": "pubnews",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10578",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "bpmn.io \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bpmnio",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51577",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Like Button \u003c= 1.6.0 - Missing Authorization",
    "slug": "wp-like-button",
    "type": "plugin",
    "affected_version": "[*, 1.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-13344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13344",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Apollo13 Framework Extensions \u003c= 1.8.10 - Missing Authorization",
    "slug": "apollo13-framework-extensions",
    "type": "plugin",
    "affected_version": "* - 1.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25959",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for WPBakery Page Builder \u003c 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "Ultimate_VC_Addons",
    "type": "plugin",
    "affected_version": "[*, 3.21.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.21.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-11814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AlT Monitoring \u003c= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "alt-monitoring",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4194",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Digirisk 6.0.0.0 - Reflected Cross-Site Scripting",
    "slug": "digirisk",
    "type": "plugin",
    "affected_version": "6.0.0.0",
    "from_version": "6.0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5946",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.13 - Missing Authorization to Plugin Data Removal in reinitialize",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1091",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.1.8 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43266",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "If-So Dynamic Content Personalization \u003c= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "if-so",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58602",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Majestic Support \u003c= 1.1.0 - Missing Authorization",
    "slug": "majestic-support",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48282",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cookie Information | Free GDPR Consent Solution \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "wp-gdpr-compliance",
    "type": "plugin",
    "affected_version": "[*, 2.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0147",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mosaic \u003c= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode",
    "slug": "mosaic",
    "type": "theme",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5965",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "flickrRSS \u003c= 5.3.1 - Cross-Site Scripting via flickrRSS_tags",
    "slug": "flickr-rss",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-6469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6469",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "illow – Cookies Consent \u003c= 0.2.0 - Cross-Site Request Forgery",
    "slug": "lgpd-compliant-cookie-banner",
    "type": "plugin",
    "affected_version": "* - 0.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39426",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.4.6 - Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "[*, 2.4.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15317",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Manager For Samandehi \u003c= 0.5 - Cross-Site Request Forgery",
    "slug": "samandehi-logo-manager",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52780",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Aioseo Multibyte Descriptions \u003c= 0.0.6 - Cross-Site Request Forgery",
    "slug": "aioseo-multibyte-descriptions",
    "type": "plugin",
    "affected_version": "* - 0.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53327",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6223",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPBot Pro Wordpress Chatbot \u003c= 13.5.4 - Unauthenticated Arbitrary File Upload",
    "slug": "wpbot-pro",
    "type": "plugin",
    "affected_version": "* - 13.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.5.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13091",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Content Blocks (Custom Post Widget) \u003c= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter",
    "slug": "custom-post-widget",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6432",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woodmart Core \u003c= 1.0.36 - PHP Object Injection",
    "slug": "woodmart-core",
    "type": "plugin",
    "affected_version": "* - 1.0.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.36",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-32242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32242",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Top Flash Embed \u003c= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "top-flash-embed",
    "type": "plugin",
    "affected_version": "* - 0.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23841",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirects \u003c= 1.2.1 - Missing Authorization via save",
    "slug": "redirects",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1566",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Newsletters \u003c= 4.9.5 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32954",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "TeleAdmin \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "teleadmin",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51709",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search \u0026 Replace \u003c= 3.2.1 - Authenticated (Administrator+) SQL injection",
    "slug": "search-and-replace",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4145",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Fields \u003c= 1.4.10 - Reflected Cross-Site Scripting",
    "slug": "simple-fields",
    "type": "plugin",
    "affected_version": "[*, 1.4.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9302",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Page Builder – Zion Builder \u003c= 3.6.9 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "zionbuilder",
    "type": "plugin",
    "affected_version": "* - 3.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30444",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Postify: Post Layout For Elementor \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "postify-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51893",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Posts for WordPress \u003c= 2.0.4 - Stored Cross-Site Scripting",
    "slug": "related-posts-for-wp",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24482",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinpoint Booking System – #1 WordPress Booking Plugin \u003c 2.1 - Authenticated SQL Injection",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9460",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woocommerce ESTO \u003c= 2.23.1 - Cross-Site Request Forgery via saveSetting",
    "slug": "woo-esto",
    "type": "plugin",
    "affected_version": "* - 2.23.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.23.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44260",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "QuickCal \u003c= 1.0.13 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "quickcal",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32310",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Job Board \u003c= 4.4.4 - SQL Injection",
    "slug": "wpjobboard",
    "type": "plugin",
    "affected_version": "[*, 4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-5695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5695",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP SmartPay \u003c= 2.7.13 - Authenticated (Subscriber+) Account Takeover",
    "slug": "smartpay",
    "type": "plugin",
    "affected_version": "* - 2.7.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-25171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25171",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Gallery by Ays \u003c= 5.1.3 - Reflected Cross-Site Scripting via ays_gpg_settings_tab",
    "slug": "gallery-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32107",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP RSS By Publishers \u003c= 0.1 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-rss-by-publishers",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4358",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Links Page \u003c= 4.9.4 - Cross-Site Request Forgery via wplf_ajax_update_screenshots",
    "slug": "wp-links-page",
    "type": "plugin",
    "affected_version": "* - 4.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47651",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.1 - Unauthenticated SQL Injection",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11711",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BackupWordPress \u003c= 3.12 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure",
    "slug": "backupwordpress",
    "type": "plugin",
    "affected_version": "3.12",
    "from_version": "3.12",
    "from_inclusive": true,
    "to_version": "3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4931",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Video Directory \u003c= 1.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-media-directory",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5811",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PropertyHive \u003c= 1.5.46 - Reflected Cross-Site Scripting via 'merge_ids'",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 1.5.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29172",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AB Google Map Travel  \u003c= 4.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ab-google-map-travel",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31613",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Temporary Login Without Password \u003c= 1.7.0 - Subscriber+ Plugin Settings Update",
    "slug": "temporary-login-without-password",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24836",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Baidu Tongji generator \u003c= 1.0.2 - Cross-Site Request Forgery",
    "slug": "baidu-tongji-generator",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31230",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1006",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1006",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0393",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PayForm \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "payform",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23872",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD \u003c= 3.1.5 - Reflected Cross-Site Scripting via cart_search",
    "slug": "cart-lift",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47449",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Slider Plugin \u003c 3.2.7 - Cross-Site Scripting",
    "slug": "royal-slider",
    "type": "plugin",
    "affected_version": "[*, 3.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9412",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ЮKassa для WooCommerce \u003c= 2.3.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "yookassa",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36379",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PHP Execution \u003c= 1.0.0 - Cross Site Request Forgery",
    "slug": "php-execution-plugin",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23879",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multimedia Playlist Slider Addon for WPBakery Page Builder \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "lbg_vp_youtube_vimeo_addon_visual_composer",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30626",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3xSocializer \u003c= 0.98.22 - Authenticated SQL Injection",
    "slug": "3xsocializer",
    "type": "plugin",
    "affected_version": "* - 0.98.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.98.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29419",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets \u0026 Elementor Templates) \u003c= 3.5.3 - Authenticated (Contributor+) Stored Cross-site Scriping via 'Sina Particle Layer'",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4373",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Event Manager \u003c= 3.1.41 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-event-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49181",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NiceJob \u003c= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nicejob",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54318",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tooltipy (tooltips for WP) \u003c= 5.0 - Reflected Cross-Site Scripting",
    "slug": "bluet-keywords-tooltip-generator",
    "type": "plugin",
    "affected_version": "[*, 5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-1000512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "image-map-pro-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3411",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) \u003c= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widget",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0837",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Plugin Tournamatch \u003c 4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "tournamatch",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5627",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Resend Welcome Email \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "resend-welcome-email",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10078",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reviews and Rating – Google My Business \u003c= 4.14 - Missing Authorization",
    "slug": "g-business-reviews-rating",
    "type": "plugin",
    "affected_version": "4.14",
    "from_version": "4.14",
    "from_inclusive": true,
    "to_version": "4.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23986",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "RVM - Responsive Vector Maps \u003c= 6.4.1 - Subscriber+ Arbitrary File Read",
    "slug": "responsive-vector-maps",
    "type": "plugin",
    "affected_version": "* - 6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24947",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Uninstall \u003c= 1.2.1 - Cross-Site Request Forgery to Site Reset",
    "slug": "uninstall",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9332",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Smush Image Compression and Optimization \u003c= 3.17.0 - Authenticated (Admin+) Directory Traversal",
    "slug": "wp-smushit",
    "type": "plugin",
    "affected_version": "* - 3.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.17.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-22288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22288",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Yoo Slider plugin \u003c= 2.0.0 - Cross-Site Request Forgery",
    "slug": "yoo-slider",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27847",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Payment Form for PayPal Pro \u003c 1.1.65 - SQL Injection",
    "slug": "payment-form-for-paypal-pro",
    "type": "plugin",
    "affected_version": "[*, 1.1.65)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.65",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-14092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-14092",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.4.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-3383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3383",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ditty 3.1.39 - 3.1.45 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "3.1.39 - 3.1.45",
    "from_version": "3.1.39",
    "from_inclusive": true,
    "to_version": "3.1.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6715",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortlinks by Pretty Links \u003c= 3.6.2 - Reflected Cross-Site Scripting via post_status",
    "slug": "pretty-link",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29770",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chronosly Events Calendar \u003c= 2.6.2 - Cross-Site Request Forgery via plugin_settings_page",
    "slug": "chronosly-events-calendar",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31093",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lead capture, gated content \u0026 newsletter opt-ins \u003c= 7.4.857 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bread-butter",
    "type": "plugin",
    "affected_version": "* - 7.4.857",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.857",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51802",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IP Metaboxes \u003c= 2.1.1 - Reflected Cross-Site Scripting",
    "slug": "ip-metaboxes",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30753",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute",
    "slug": "guten-post-layout",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8288",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myCred \u003c= 2.9.4.3 - Authenticated (Subscriber+) Race Condition",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.9.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54667",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Content Egg \u003c= 5.4.0 - Cross-Site Request Forgery",
    "slug": "content-egg",
    "type": "plugin",
    "affected_version": "* - 5.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-25952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25952",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FV Thoughtful Comments \u003c= 0.3.5 - Missing Authorization",
    "slug": "thoughtful-comments",
    "type": "plugin",
    "affected_version": "* - 0.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-24613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24613",
    "auth_type": "Auth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Categories \u003c= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-media-library-categories",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36382",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conditional Payment Methods for WooCommerce \u003c= 1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "conditional-payment-methods-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4547",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SeedProd Pro \u003c= 6.18.12 - Authenticated (Editor+) SQL Injection",
    "slug": "seedprod-coming-soon-pro-5",
    "type": "plugin",
    "affected_version": "* - 6.18.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.18.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54283",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "YITH Easy Login \u0026 Register Popup for WooCommerce \u003c= 1.8.0 - Authentication Bypass via Password Reset",
    "slug": "yith-easy-login-register-popup-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-39331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39331",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Feedify – Web Push Notifications \u003c= 2.1.8 Reflected Cross-Site Scripting",
    "slug": "push-notification-by-feedify",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38352",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kaya QR Code Generator \u003c= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via qrCode attribute",
    "slug": "kaya-qr-code-generator",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30784",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Favorite Car \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "my-favorite-cars",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23636",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Voting Record \u003c= 2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "voting-record",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7084",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Beaver Builder – Lite \u003c= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-addons-for-beaver-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43151",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.38",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.26",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.20",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.12",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.4",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.3",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.38",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.28",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.23",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.15",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.10",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.35",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.32",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.23",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.19",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.13",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.9",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.8",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.1",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.36",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.35",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.27",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.16",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.6",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4973",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Evon \u003c= 3.4 - Unauthenticated Local File Inclusion",
    "slug": "snsevon",
    "type": "theme",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-28991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28991",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Welcart e-Commerce \u003c= 1.8.2 - Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4827",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IMPress Listings \u003c= 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "wp-listings",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-11013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11013",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crafthemes Demo Import \u003c= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files",
    "slug": "crafthemes-demo-import",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9698",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MapSVG Lite \u003c= 8.6.9 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "mapsvg-lite-interactive-vector-maps",
    "type": "plugin",
    "affected_version": "* - 8.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48120",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Advanced iFrame \u003c= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 2025.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2025.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1437",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid  \u003c= 5.6.6 - Missing Authorization",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52117",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP CSV \u003c= 1.8.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-csv",
    "type": "plugin",
    "affected_version": "* - 1.8.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4368",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plant - Gardening \u0026 Houseplants WordPress Theme \u003c= 1.0.0 - Unauthenticated Information Exposure",
    "slug": "plant",
    "type": "theme",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31051",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SALERT \u003c= 1.2.1 - Missing Authorization via salert_save_settings_with_ajax()",
    "slug": "salert",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32126",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SportsPress \u003c= 2.7.1 - Cross-Site Scripting",
    "slug": "sportspress",
    "type": "plugin",
    "affected_version": "[*, 2.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-13892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13892",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Url Rewrite Analyzer \u003c= 1.3.3 - Missing Authorization",
    "slug": "url-rewrite-analyzer",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48262",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Header Footer Code Manager \u003c= 1.1.23 - Cross-Site Scripting",
    "slug": "header-footer-code-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0899",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit Assist \u003c= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bit-assist",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-51371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51371",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Tag Manager for WordPress \u003c= 1.15 - Reflected Cross-Site Scripting via Site Search",
    "slug": "duracelltomi-google-tag-manager",
    "type": "plugin",
    "affected_version": "* - 1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1707",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.1.2 - Arbitrary File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2011-3129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3129",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rara One Click Demo Import \u003c= 1.2.9 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "rara-one-click-demo-import",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29451",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EmbedSocial – Social Media Feeds, Reviews and Galleries = 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "embedalbum-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0371",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brand \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "brandy",
    "type": "theme",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54348",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF24 Articles To PDF \u003c= 4.2.2 - Cross-Site Request Forgery",
    "slug": "pdf24-posts-to-pdf",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1828",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Payments \u003c= 5.9.0 - Authenticated (Shop manager+) SQL Injection via currency parameters",
    "slug": "woocommerce-payments",
    "type": "plugin",
    "affected_version": "* - 5.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35915",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Edit WooCommerce Templates \u003c= 1.1.2 - Reflected Cross-Site Scripting via page",
    "slug": "woo-edit-templates",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10049",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Affiliate Platform \u003c= 6.3.9 - Cross-Site Request Forgery",
    "slug": "wp-affiliate-platform",
    "type": "plugin",
    "affected_version": "* - 6.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3898",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themify Portfolio Post \u003c= 1.1.6 - Reflected Cross-Site Scripting",
    "slug": "themify-portfolio-post",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0200",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VK Blocks \u003c= 1.53.0.1 - Stored (Contributor+) Cross-Site Scripting in Tag Edit",
    "slug": "vk-blocks-pro",
    "type": "plugin",
    "affected_version": "* - 1.53.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.53.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27923",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VK Blocks \u003c= 1.53.0.1 - Stored (Contributor+) Cross-Site Scripting in Tag Edit",
    "slug": "vk-blocks",
    "type": "plugin",
    "affected_version": "* - 1.53.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.53.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27923",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Deals for WooCommerce \u003c= 2.0.3.2 - Missing Authorization via vtprd_ajax_clone_rule",
    "slug": "pricing-deals-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41240",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Internal Linking for SEO traffic \u0026 Ranking – Auto internal links (100% automatic) \u003c= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id Parameter",
    "slug": "automatic-internal-links-for-seo",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11009",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Constant Contact Forms \u003c= 1.8.7 Editor+ Stored Cross-Site Scripting",
    "slug": "constant-contact-forms",
    "type": "plugin",
    "affected_version": "[*, 1.8.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24134",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c= 3.2.3 - Cross-Site Request Forgery",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24388",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Math Comment Spam Protection \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "math-comment-spam-protection",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-0205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0205",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woody code snippets – Insert Header Footer Code, AdSense Ads \u003c= 2.5.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "insert-php",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35751",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: Live Composer \u003c= 1.5.42 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "live-composer-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35779",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Top Store \u003c= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation",
    "slug": "top-store",
    "type": "theme",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10673",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Data Access – App, Table, Form and Chart Builder plugin \u003c= 5.5.22 - Unauthenticated SQL Injection",
    "slug": "wp-data-access",
    "type": "plugin",
    "affected_version": "* - 5.5.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12428",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider \u003c= 3.94.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ml-slider",
    "type": "plugin",
    "affected_version": "* - 3.94.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.94.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1203",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plainview Protect Passwords \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "plainview-protect-passwords",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47665",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page scroll to id \u003c= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "page-scroll-to-id",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support \u003c= 6.1.5 - Cross-Site Request Forgery",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51538",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CPO Shortcodes \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "cpo-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5704",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Skitter Slideshow \u003c= 2.5.2 - Unauthenticated Server-Side Request Forgery",
    "slug": "wp-skitter-slideshow",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1751",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Button Plugin MaxButtons \u003c= 9.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Button Width",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "* - 9.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10555",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.3 - Reflected Cross-Site Scripting via page parameter",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "[*, 4.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-32122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32122",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Build App Online \u003c= 1.0.21 - Authentication Bypass via Header",
    "slug": "build-app-online",
    "type": "plugin",
    "affected_version": "* - 1.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.21",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51478",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Product Catalog \u003c= 4.2.11 - Cross-Site Scripting",
    "slug": "ultimate-product-catalogue",
    "type": "plugin",
    "affected_version": "* - 4.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-12200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-12200",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Image from URL (FIFU) \u003c= 5.2.7 - Authenticated (Admin+) SQL Injection",
    "slug": "featured-image-from-url",
    "type": "plugin",
    "affected_version": "* - 5.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10036",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "360 Javascript Viewer \u003c= 1.7.29 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "360deg-javascript-viewer",
    "type": "plugin",
    "affected_version": "* - 1.7.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12271",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gestpay for WooCommerce \u003c= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_unset_default_card",
    "slug": "gestpay-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 20221130",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20221130",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0433",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads (Various Versions) - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "2.2 - 2.2.8",
    "from_version": "2.2",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads (Various Versions) - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "2.3 - 2.3.6",
    "from_version": "2.3",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads (Various Versions) - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "1.8 - 1.8.6",
    "from_version": "1.8",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads (Various Versions) - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "1.9 - 1.9.9",
    "from_version": "1.9",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads (Various Versions) - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "2.0 - 2.0.4",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads (Various Versions) - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "2.1 - 2.1.10",
    "from_version": "2.1",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wordfence \u003c= 5.1.4 - Reflected Cross-Site Scripting",
    "slug": "wordfence",
    "type": "plugin",
    "affected_version": "[*, 5.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4932",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UPDATE NOTIFICATIONS \u003c= 0.3.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "update-notifications",
    "type": "plugin",
    "affected_version": "* - 0.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51653",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content – ProfilePress \u003c= 4.14.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.14.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1519",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Just Custom Fields \u003c= 3.3.2 - Cross-Site Request Forgery via AJAX actions",
    "slug": "just-custom-fields",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6168",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Search Logger \u003c= 0.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "search-logger",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3131",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Hover Effects Ultimate \u003c= 9.7.3 - Authenticated Stored Cross-Site Scripting via Media URL",
    "slug": "image-hover-effects-ultimate",
    "type": "plugin",
    "affected_version": "* - 9.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2935",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DVS Custom Notification \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "dvs-custom-notification",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-4921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4921",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SVG Support \u003c= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "svg-support",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1755",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Local Weather \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "ultimate-weather-plugin",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4561",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Table for WooCommerce \u003c= 4.0.3 - Reflected Cross-Site Scripting",
    "slug": "woo-product-table",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22307",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Virim \u003c= 0.4 - PHP Object Injection",
    "slug": "virim",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-12240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12240",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Uncode \u003c 2.9.4.4 - Reflected Cross-Site Scripting",
    "slug": "uncode",
    "type": "theme",
    "affected_version": "[*, 2.9.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-48107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48107",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fusion \u003c= 3.1 - Arbitrary File Upload",
    "slug": "fusion-delisted",
    "type": "theme",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2194",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Activity Log \u003c= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter",
    "slug": "wp-security-audit-log",
    "type": "plugin",
    "affected_version": "* - 5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10793",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "404 Image Redirection (Replace Broken Images) \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "broken-images-redirection",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32266",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rankie \u003c= 1.8.0 - Missing Authorization",
    "slug": "valvepress-rankie",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39493",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Registrations for the Events Calendar \u003c= 2.12.1 - Missing Authorization",
    "slug": "registrations-for-the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 2.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43143",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better Messages \u003c= 1.9.9.148 - Cross-Site Request Forgery",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "* - 1.9.9.148",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.148",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29454",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Help Scout \u003c= 2.9.1 - Arbitrary File Upload to Remote Code Execution",
    "slug": "woocommerce-help-scout",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24212",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Broken Link Checker for YouTube \u003c= 1.3 - Cross-Site Request Forgery via plugin_settings_page()",
    "slug": "broken-link-checker-for-youtube",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48281",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Captcha Plugin by Captcha Bank \u003c= 4.0.36 - Reflected Cross-Site Scripting",
    "slug": "captcha-bank",
    "type": "plugin",
    "affected_version": "* - 4.0.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9375",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50515",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder \u003c= 3.6.7 - Admin+ Stored Cross-Site Scripting",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "[*, 3.6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0884",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L"
  },
  {
    "title": "Newspaper \u003c= 11.5.1 - Reflected Cross-Site Scripting",
    "slug": "Newspaper",
    "type": "theme",
    "affected_version": "* - 11.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2167",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Save as PDF plugin by Pdfcrowd \u003c= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings",
    "slug": "save-as-pdf-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40668",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.3.50 - Authenticated SQL Injection via tag_id Parameter",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.3.51)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.51",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-12977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-12977",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c= 3.5.4 - Stored Cross-Site Scripting",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "[*, 3.5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-9168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9168",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms - File Uploads \u003c= 3.0.22 - Unauthenticated Arbitrary File Upload",
    "slug": "ninja-forms-uploads",
    "type": "plugin",
    "affected_version": "[*, 3.0.23)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.23",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-10869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-10869",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mobile Bottom Menu \u003c= 1.4.0 - Missing Authorization",
    "slug": "mobile-bottom-menu-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31525",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Contest WordPress Plugin \u003c= 3.2 - Cross-Site Request Forgery",
    "slug": "video-contest",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45823",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Astra Security Suite \u003c= 0.2 - Missing Authorization",
    "slug": "getastra",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31774",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ScottCart \u003c= 1.1 - Unauthenticated Remote Code Execution",
    "slug": "scottcart",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50492",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Goodlayers Hostel \u003c= 3.1.2 - Unauthenticated PHP Object Injection",
    "slug": "gdlr-hostel",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39500",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FAQ And Answers – Create Frequently Asked Questions Area on WP Sites \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "faq-and-answers",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11882",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.9.11 - Authenticated (Subscriber+) SQL Injection via Shortcodes",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0631",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WP Posts Carousel \u003c= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-posts-carousel",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31094",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vimeography \u003c= 2.4.4 - Sensitive Information Exposure",
    "slug": "vimeography",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54366",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BetterDocs \u003c= 3.5.8 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "betterdocs",
    "type": "plugin",
    "affected_version": "* - 3.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43129",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themify Portfolio Post \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "themify-portfolio-post",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4464",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fediverse Embeds \u003c= 1.5.3 - Unauthenticated Arbitrary File Upload",
    "slug": "fediverse-embeds",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Intrepidity \u003c= 1.5.1 - Cross-Site Request Forgery via mytheme_add_admin",
    "slug": "intrepidity",
    "type": "theme",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-27634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27634",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HUSKY \u003c= 1.3.6.1 - Authenticated (Shop Manager+) Arbitrary Options Update",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43121",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All In One WP Security \u003c= 5.2.6 - Cross-Site Request Forgery to IP Blocking",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "* - 5.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30468",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Matomo Tracking Code \u003c= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-matomo-tracking-code",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58630",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPAdverts \u003c= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpadverts",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54024",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Honeypot for WP Comment \u003c= 2.2.3 - Reflected Cross-Site Scripting via page",
    "slug": "honeypot-for-wp-comment",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24933",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dr. Flex \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dr-flex",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30850",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Permalink Manager Lite \u003c= 2.4.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8195",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress \u003c= 9.0.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 9.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3592",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WPQA - Builder forms Addon For WordPress (\u003c= 5.9.2),  Himer (\u003c= 1.9.3) and Discy (\u003c= 5.5.3) - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "himer",
    "type": "theme",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3343",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPQA - Builder forms Addon For WordPress (\u003c= 5.9.2),  Himer (\u003c= 1.9.3) and Discy (\u003c= 5.5.3) - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "wpqa",
    "type": "plugin",
    "affected_version": "* - 5.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3343",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPQA - Builder forms Addon For WordPress (\u003c= 5.9.2),  Himer (\u003c= 1.9.3) and Discy (\u003c= 5.5.3) - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "discy",
    "type": "theme",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3343",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts \u003c= 4.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "cits-support-svg-webp-media-upload",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0807",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Webinar Solution: Create live/evergreen/automated/instant webinars, stream \u0026 Zoom Meetings | WebinarIgnition \u003c= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass",
    "slug": "webinar-ignition",
    "type": "plugin",
    "affected_version": "* - 4.03.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.03.32",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6441",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RabbitLoader \u003c= 2.19.13 - Missing Authorization via multiple AJAX actions",
    "slug": "rabbit-loader",
    "type": "plugin",
    "affected_version": "* - 2.19.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.19.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-21751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-21751",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "DW Question \u0026 Answer \u003c= 1.5.8 - Cross-Site Request Forgery Bypass",
    "slug": "dw-question-answer",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4408",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13425",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bulk Edit Post Titles \u003c= 5.0.0 - Missing Authorization via bulkUpdatePostTitles",
    "slug": "bulk-edit-post-titles",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0369",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ConeBlog – WordPress Blog Widgets \u003c= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "coneblog-widgets",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37918",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FunnelKit Checkout \u003c= 3.10.3 - Authenticated(Subscriber+) Missing Authorization to Settings Change",
    "slug": "woofunnels-aero-checkout",
    "type": "plugin",
    "affected_version": "* - 3.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51671",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.2",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.16",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.12",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.10",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.7",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.6",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.22",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.22",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.22",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.22",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.20",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.20",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.19",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.19",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.19",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.19",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.3 - SQL Injection due to Double Prepare approach",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.11",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-16510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WTI Like Post \u003c= 1.4.6 - IP Spoofing",
    "slug": "wti-like-post",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33917",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hide Dashboard Notifications \u003c= 1.3 - Missing Authorization to Authenticated(Contributor+) Plugin Settings Modification",
    "slug": "wp-hide-backed-notices",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1955",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Enfold \u003c= 5.6.4 - Reflected Cross-Site Scripting",
    "slug": "enfold",
    "type": "theme",
    "affected_version": "* - 5.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38400",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Manager \u003c= 8.6.4 - Unauthenticated Arbitrary Double File Extension Upload",
    "slug": "contact-manager",
    "type": "plugin",
    "affected_version": "* - 8.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1028",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VForm \u003c= 3.0.5 - Missing Authorization",
    "slug": "v-form",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24604",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPS Telegram Chat \u003c= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API",
    "slug": "wps-telegram-chat",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9628",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Ultimate Email Marketer \u003c= 1.1.0 - Stored Cross-Site Scripting",
    "slug": "wp-ultimate-email-marketer",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4600",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate FAQ \u003c= 1.8.24 - Unauthenticated Options Import/Export",
    "slug": "ultimate-faqs",
    "type": "plugin",
    "affected_version": "[*, 1.8.25)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.25",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-17232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17232",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "bbPress Toolkit \u003c= 1.0.12 - Cross-Site Request Forgery",
    "slug": "bbp-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34031",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.8.2 - Authentication Cookie Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-0166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0166",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.8.2 - Authentication Cookie Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.1",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0166",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.8.2 - Authentication Cookie Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.1",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-0166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-0166",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.21",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.19",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.18",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.18",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.15",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.11",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.10",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.21",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.9",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.5",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.1",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14722",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Surfer \u003c= 1.3.2.357 - Missing Authorization",
    "slug": "surferseo",
    "type": "plugin",
    "affected_version": "* - 1.3.2.357",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.357",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35037",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Nested Pages \u003c= 3.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-nested-pages",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24579",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support Board \u003c= 3.8.0 - Unauthenticated Arbitrary File Deletion",
    "slug": "supportboard",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4828",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pods – Custom Content Types and Fields \u003c= 3.2.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "* - 3.2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1446",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Sitemap \u003c= 3.5.13 - Cross-Site Request Forgery via admin_notices",
    "slug": "simple-sitemap",
    "type": "plugin",
    "affected_version": "* - 3.5.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6492",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OxyExtras \u003c= 1.4.4 - Unauthenticated Cross-Site Scripting",
    "slug": "oxyextras",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29129",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Subscribe button \u003c= 1.3.7 - Cross-Site Request Forgery via process_form function",
    "slug": "podlove-subscribe-button",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25481",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "DoFollow Case by Case \u003c= 3.5.1 - Cross-Site Request Forgery",
    "slug": "dofollow-case-by-case",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47624",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Workreap \u003c 2.2.2 - Cross-Site Request Forgery",
    "slug": "workreap",
    "type": "theme",
    "affected_version": "[*, 2.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24500",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Text Advertisements \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "text-advertisements",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51879",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AffiEasy \u003c= 1.1.4 - Cross-Site Request Forgery",
    "slug": "affieasy",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32435",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Appointments \u003c= 3.11.18 - Insufficient Authorization",
    "slug": "easy-appointments",
    "type": "plugin",
    "affected_version": "* - 3.11.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2844",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Content Shortcode \u003c= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "custom-content-shortcode",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0273",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Taxi Booking Manager for Woocommerce | E-cab \u003c= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover",
    "slug": "ecab-taxi-booking-manager",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-8898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8898",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appy Pie Connect for WooCommerce \u003c= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password",
    "slug": "appy-pie-connect-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-9286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9286",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GB Gallery Slideshow \u003c= 1.5 - SQL Injection",
    "slug": "gb-gallery-slideshow",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-8375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8375",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14946",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Cross-Site Request Forgery via 'wpfc_clear_cache_of_allsites_callback'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1925",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Optimizer \u003c= 1.2.7 - Cross-Site Request Forgery",
    "slug": "simple-optimizer",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30538",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Transbank Webpay REST \u003c= 1.6.6 - Authenticated (Administrator+) SQL Injection via orderby",
    "slug": "transbank-webpay-plus-rest",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-27610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27610",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Grid Gallery – Photo Image Grid Gallery \u003c= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcode",
    "slug": "new-grid-gallery",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1897",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPForms \u003c= 1.9.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 1.9.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11223",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.98 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.98",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8284",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PhpList Subber \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "phpls",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9632",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal \u003c= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update / Data Access",
    "slug": "simple-e-commerce-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12253",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7205",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Javo Core \u003c= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup",
    "slug": "javo-core",
    "type": "plugin",
    "affected_version": "* - 3.0.0.080",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0.080",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-0177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0177",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widget",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.12.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1391",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress HelpDesk \u0026 Support Ticket System Plugin – Octrace Support \u003c= 1.2.7 - Reflected Cross-Site Scripting",
    "slug": "octrace-support",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54274",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management System – WPSchoolPress \u003c= 2.2.16 - Authenticated (Teacher+) SQL Injection",
    "slug": "wpschoolpress",
    "type": "plugin",
    "affected_version": "* - 2.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1669",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PrivateContent - Mail Actions \u003c= 2.3.2 - Unauthenticated Local File Inclusion",
    "slug": "private-content-mail-actions",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47627",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HUSKY – Products Filter for WooCommerce (formerly WOOF) \u003c= 1.3.4.3 - Cross-Site Request Forgery",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50861",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DirectoryPress \u003c= 3.6.10 - Authenticated (Contributor+) SQL Injection",
    "slug": "directorypress",
    "type": "plugin",
    "affected_version": "* - 3.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-38755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38755",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Simple calendar for Elementor \u003c= 1.6.5 - Cross-Site Request Forgery",
    "slug": "simple-calendar-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47542",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.2 - Missing Authorization to Limited Privilege Escalation",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11715",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Related Posts Lite \u003c= 1.12 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "related-posts-lite",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11926",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feather Login Page \u003c= 1.1.5 - Cross-Site Request Forgery via saveData()",
    "slug": "feather-login-page",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31923",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PopularFX \u003c= 1.2.4 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "popularfx",
    "type": "theme",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31383",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Options for Twenty Seventeen \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "options-for-twenty-seventeen",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5162",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CubeWP – All-in-One Dynamic Content Framework \u003c= 1.1.15 - Missing Authorization",
    "slug": "cubewp-framework",
    "type": "plugin",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.6.8.2 - Cross-Site Request Forgery",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39641",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Churel \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "churel",
    "type": "theme",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31419",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LatePoint Plugin \u003c= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 4.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-2472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2472",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Colorful Categories \u003c 2.0.15 - Cross-Site Request Forgery",
    "slug": "colorful-categories",
    "type": "plugin",
    "affected_version": "[*, 2.0.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24802",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Motor Racing League \u003c= 1.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "motor-racing-league",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27614",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FTP Access \u003c= 1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "ftp-access",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3510",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5088",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Websimon Tables \u003c= 1.3.4 - Reflected Cross-Site Scripting",
    "slug": "websimon-tables",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9401",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.11.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0511",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce 2.6.0-2.7.7 - Information Disclosure via Arbitrary File Read",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "2.6.0 - 2.7.7",
    "from_version": "2.6.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41840",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Show All Comments \u003c= 7.0.0 - Reflected Cross-Site Scripting",
    "slug": "show-all-comments-in-one-page",
    "type": "plugin",
    "affected_version": "* - 7.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4295",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Craw Data \u003c= 1.0.0 - Server Side Request Forgery",
    "slug": "craw-data",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2912",
    "auth_type": "Unauth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Shortcodes by United Themes \u003c 5.0.5 - Reflected Cross-Site Scripting",
    "slug": "ut-shortcodes",
    "type": "plugin",
    "affected_version": "[*, 5.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-37097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37097",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Assistant \u003c= 1.5.2 - Reflected Cross-Site Scripting",
    "slug": "assistant",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53307",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 1.5.1 - Full Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 1.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2005-1688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2005-1688",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Magic Fields 1 \u003c= 1.7.1 - Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-field-css parameter",
    "slug": "magic-fields",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18611",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Job Board \u003c= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "* - 2.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-1813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1813",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS Pro \u003c= 2.7.0 - Missing Authorization",
    "slug": "tutor-pro",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4222",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Ads by WPQuads \u003c= 2.0.87.1 - Missing Authorization",
    "slug": "quick-adsense-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.0.87.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.87.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30855",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "One User Avatar \u003c= 2.3.6 - Stored Cross-Site Scripting",
    "slug": "one-user-avatar",
    "type": "plugin",
    "affected_version": "[*, 2.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24672",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Dynamic Pricing and Discounts \u003c= 2.4.1 - Stored Cross-Site Scripting",
    "slug": "wc-dynamic-pricing-and-discounts",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4372",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "wpDataTables Lite plugin \u003c= 2.0.11 - Cross-Site Scripting",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-6011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6011",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBot Pro Wordpress Chatbot \u003c= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation",
    "slug": "wpbot-pro",
    "type": "plugin",
    "affected_version": "* - 13.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12879",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Optimate Ads – Advance Ad Inserter AdSense \u0026 Ad Manager \u003c= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "optimate-ads",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25136",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "sourceplay-navermap \u003c= 0.0.2 - Missing Authorization",
    "slug": "sourceplay-navermap",
    "type": "plugin",
    "affected_version": "* - 0.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30605",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Admin and Customer Messages After Order for WooCommerce: OrderConvo \u003c= 13.5 - Unauthenticated Arbitrary File Read",
    "slug": "admin-and-client-message-after-order-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 13.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10162",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Compress \u003c= 6.30.30 - Unauthenticated Broken Authentication",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.30.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.30.30",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47479",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Testimonials Slider \u003c= 3.5.8.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "testimonial-add",
    "type": "plugin",
    "affected_version": "* - 3.5.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36851",
    "auth_type": "Privileged",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "eShop Swipe plugin \u003c= 3.7.0 - Cross-Site Scripting",
    "slug": "swipe-hq-checkout-for-eshop",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4556",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmbedPress \u003c= 3.9.8 - Missing Authorization via handle_calendly_data",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31284",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "List Urls \u003c= 0.2 - Reflected Cross-Site Scripting",
    "slug": "list-urls",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27338",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Pricing – Product Pricing \u003c= 1.0.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "woo-pricing-table",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22632",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar \u003c= 1.1.7 - Multiple Reflected Cross-Site Scripting",
    "slug": "appointment-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-7320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Peter’s Custom Anti-Spam \u003c= 3.2.3 - Cross-Site Request Forgery via cas_register_post Function",
    "slug": "peters-custom-anti-spam-image",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12554",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Sitemap Index \u003c= 1.2.3 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "sitemap-index",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23816",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp EMember \u003c= 10.6.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-eMember",
    "type": "plugin",
    "affected_version": "* - 10.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5079",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chankhe \u003c= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation",
    "slug": "chankhe",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28416",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MeinTurnierplan.de Widget Viewer \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meinturnierplande-widget-viewer",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23941",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WCFM Marketplace – Multivendor Marketplace for WooCommerce \u003c= 3.6.11 - Reflected Cross-Site Scripting",
    "slug": "wc-multivendor-marketplace",
    "type": "plugin",
    "affected_version": "* - 3.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44009",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iMember360 \u003c 3.9.001 - Missing Authorization and Sensitive Data Exposure",
    "slug": "imember360",
    "type": "plugin",
    "affected_version": "[*, 3.9.001)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.001",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-3848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3848",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Video Management System \u003c= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-video-management-system",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0692",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.10 - Reflected Cross-Site Scripting",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "[*, 3.1.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-30494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30494",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Debug Tool \u003c= 2.2 - Missing Authorization to Information Exposure",
    "slug": "debug-tool",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10588",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Elfsight Testimonials Slider \u003c= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "elfsight-testimonials-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31587",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nautic Pages \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "nautic-pages",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4100",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Gallery Grid \u003c= 2.3.13 - Cross-Site Request Forgery",
    "slug": "responsive-gallery-grid",
    "type": "plugin",
    "affected_version": "* - 2.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41659",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "TT Custom Post Type Creator \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tt-custom-post-type-creator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34430",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ldap_login_password_and_role_manager \u003c= 1.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ldap-login-password-and-role-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22548",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FP RSS Category Excluder \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "fp-rss-category-excluder",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23679",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HelloAsso \u003c= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "helloasso",
    "type": "plugin",
    "affected_version": "* - 1.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24575",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magic Embeds \u003c= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-embed-facebook",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31433",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Image Mask \u003c= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-image-mask",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48235",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Composer Website Builder \u003c= 45.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "visualcomposer",
    "type": "plugin",
    "affected_version": "* - 45.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "45.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-55709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-55709",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Széchenyi 2020 Logo \u003c= 1.1 - Unauthenticated Local File Inclusion",
    "slug": "szechenyi-2020-logo",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39429",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slideshow 2.2.8 - 2.2.21 - Information Exposure",
    "slug": "slideshow-jquery-image-gallery",
    "type": "plugin",
    "affected_version": "2.2.8 - 2.2.21",
    "from_version": "2.2.8",
    "from_inclusive": true,
    "to_version": "2.2.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3634",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "News \u0026 Blog Designer Pack \u003c= 4.0 - Unauthenticated Local File Inclusion",
    "slug": "blog-designer-pack",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31082",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MainWP Child Reports \u003c= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "mainwp-child-reports",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Us Page – Contact People \u003c= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter",
    "slug": "contact-us-page-contact-people",
    "type": "plugin",
    "affected_version": "* - 3.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5123",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Microblogs \u003c= 0.4.0 - Cross-Site Scripting",
    "slug": "wp-microblogs",
    "type": "plugin",
    "affected_version": "* - 0.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4590",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 6.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 6.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9698",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenium Blocks \u003c= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutenium",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51869",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hero Banner Ultimate \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "hero-banner-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \u003c= 4.4.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "print-invoices-packing-slip-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0957",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Carousel Slider \u0026 Grid Ultimate for WooCommerce \u003c= 1.9.7 - Authenticated(Contributor+) PHP Object Injection",
    "slug": "woo-product-carousel-slider-and-grid-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1950",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JNews - WordPress Newspaper Magazine Blog AMP Theme \u003c 8.0.6 - Reflected Cross-Site Scripting",
    "slug": "jnews",
    "type": "theme",
    "affected_version": "[*, 8.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24342",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Catapult UK Cookie Consent \u003c= 2.3.9 - Stored Cross-Site Scripting",
    "slug": "uk-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 2.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10310",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple File List \u003c= 6.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "* - 6.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1025",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RT Easy Builder \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rt-easy-builder-advanced-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8462",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager  \u003c= 4.69 - Missing Authorization",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.69",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.69",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33923",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TheGem \u003c= 5.9.1 - Reflected Cross-Site Scripting",
    "slug": "thegem",
    "type": "theme",
    "affected_version": "* - 5.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50892",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wordpress Video Gallery \u003c= 2.7 - SQL Injection",
    "slug": "contus-video-gallery",
    "type": "plugin",
    "affected_version": "[*, 2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-2065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2065",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mynx Page Builder \u003c= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "mynx-page-builder",
    "type": "plugin",
    "affected_version": "* - 0.27.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.27.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9656",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VK Blocks \u003c= 1.57.0.5 - Authenticated(Contributor+) Settings Update",
    "slug": "vk-blocks",
    "type": "plugin",
    "affected_version": "* - 1.57.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.57.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0584",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JS Job Manager \u003c= 2.0.2 - Unauthenticated SQL Injection",
    "slug": "js-jobs",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32626",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "String Locator \u003c= 2.6.6 - Unauthenticated PHP Object Injection",
    "slug": "string-locator",
    "type": "plugin",
    "affected_version": "* - 2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10936",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dessau \u003c 1.9 - Unauthenticated Local File Inclusion",
    "slug": "dessau",
    "type": "theme",
    "affected_version": "[*, 1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-39463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39463",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Bootstrap Elements for Elementor \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-bootstrap-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1398",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Back To The Top Button \u003c= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "back-to-the-top-button",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41733",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ebook Store \u003c= 5.8001 - Reflected Cross-Site Scripting",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.8001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8001",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11287",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BlogLentor \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bloglentor-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34421",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tiempo.com \u003c= 0.1.2 - Cross-Site Request Forgery to Shortcode Deletion",
    "slug": "tiempocom",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2271",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Auto More Tag \u003c= 4.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "auto-more-tag",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2411",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CMS Press \u003c= 0.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cms-press",
    "type": "plugin",
    "affected_version": "* - 0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25452",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OZ Canonical \u003c= 0.5 - Reflected Cross-Site Scripting",
    "slug": "oz-canonical",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22324",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.3.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "[*, 3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4950",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ThemeEgg ToolKit \u003c= 1.2.9 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "themeegg-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28915",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WikiPop \u003c= 2.0 - Cross-Site Scripting",
    "slug": "wikipop",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4575",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirection \u003c= 2.7.3 - Local File Inclusion",
    "slug": "redirection",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000504",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pretty Url \u003c= 1.5.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pretty-url",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2009",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Minimal Coming Soon – Coming Soon Page \u003c= 2.37 - Unauthenticated Maintenance Mode Bypass",
    "slug": "minimal-coming-soon-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 2.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.37",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-1075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1075",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Login Widget With Shortcode \u003c= 6.1.2 - Open Redirect",
    "slug": "login-sidebar-widget",
    "type": "plugin",
    "affected_version": "* - 6.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54255",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by Supsystic \u003c= 1.8.8 - Cross-Site Request Forgery",
    "slug": "gallery-by-supsystic",
    "type": "plugin",
    "affected_version": "[*, 1.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10918",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Posts Ticker \u003c= 1.1.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "simple-posts-ticker",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4646",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Limit Login Attempts \u003c= 1.7.1 - Authenticated(Subscriber+) Stored Cross-Site Scripting",
    "slug": "limit-login-attempts",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1861",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme \u003c= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "lisfinity-core",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6038",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.10 - Sensitive Information Disclosure",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-42883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42883",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Banner \u003c= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-banner",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13898",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All Bootstrap Blocks \u003c= 1.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "all-bootstrap-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13549",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chatbox Manager \u003c= 1.2.5 - Missing Authorization",
    "slug": "wa-chatbox-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48167",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Accept Stripe Payments Using Contact Form 7 \u003c= 2.5 - Unauthenticated Information Exposure",
    "slug": "accept-stripe-payments-using-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12255",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Swift Framework \u003c 2024.04.30 - Reflected Cross-Site Scripting",
    "slug": "socialdriver-framework",
    "type": "plugin",
    "affected_version": "[*, 2024.04.30)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.04.30",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-2870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2870",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Additional Custom Product Tabs for WooCommerce \u003c= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "product-tabs-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58985",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 1.6.6 - Unauthenticated Information Disclosure",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4339",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Flex Mag - Responsive WordPress News Theme \u003c= 3.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion",
    "slug": "flex-mag",
    "type": "theme",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13655",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "e2pdf \u003c= 1.20.27 - Cross-Site Request Forgery",
    "slug": "e2pdf",
    "type": "plugin",
    "affected_version": "* - 1.20.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31373",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Pocket URLs \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "wp-pocket-urls",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49176",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGet API \u003c= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "wpgetapi",
    "type": "plugin",
    "affected_version": "* - 2.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13857",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS – eLearning and online course solution \u003c= 1.7.6 - Unprotected AJAX including Privilege Escalation",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "[*, 1.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24184",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Cookie Consent \u003c 1.8 - Cross-Site Scripting",
    "slug": "responsive-cookie-consent",
    "type": "plugin",
    "affected_version": "[*, 1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-10309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10309",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Tabs \u003c= 4.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-tabs",
    "type": "plugin",
    "affected_version": "* - 4.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4096",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Affiliate Links \u003c= 6.2.1.5 - Authenticated (Subscriber+) Plugin Settings Change",
    "slug": "wp-auto-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 6.2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45840",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "CPO Companion \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cpo-companion",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33916",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tabs \u003c= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "vc-tabs",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40215",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Beaver Builder \u003c= 2.8.3.2 - Reflected Cross-Site Scripting",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.8.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43926",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpLike2Get \u003c= 1.2.9 - Unauthenticated Information Exposure",
    "slug": "wplike2get",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39439",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Woocommerce – Loi Hamon \u003c= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "loi-hamon",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27355",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iCal Feeds \u003c= 1.5.3 - Reflected Cross-Site Scripting",
    "slug": "ical-feeds",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32528",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BP Member Type Manager \u003c= 1.01 - Reflected Cross-Site Scripting",
    "slug": "bp-member-type-manager",
    "type": "plugin",
    "affected_version": "* - 1.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49634",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BookingPress \u003c= 1.0.30 - Unauthenticated Insecure Direct Object Reference",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4340",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPBookit \u003c= 1.0.2 - Missing Authorization",
    "slug": "wpbookit",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32254",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Traveler Code \u003c= 3.1.1 - Unauthenticated Arbitrary SQL Injection",
    "slug": "traveler-code",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22699",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Guest Support – Complete customer support ticket system for WordPress \u003c= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion",
    "slug": "guest-support",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5957",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Media Widget \u003c= 4.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "social-media-widget",
    "type": "plugin",
    "affected_version": "* - 4.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0974",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salat Times \u003c = 3.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "salat-times",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2983",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Pro Real Estate 7 \u003c= 3.5.4 - Authenticated (Custom) Arbitrary File Upload",
    "slug": "realestate-7",
    "type": "theme",
    "affected_version": "* - 3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2891",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GamiPress – The #1 gamification plugin to reward points, achievements, badges \u0026 ranks in WordPress \u003c= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 6.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2783",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SuperSaaS – online appointment scheduling \u003c= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via after Parameter",
    "slug": "supersaas-appointment-scheduling",
    "type": "plugin",
    "affected_version": "* - 2.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0862",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SULly \u003c= 4.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "sully",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5151",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow CK \u003c= 1.4.9 - Authenticated Stored Cross-Site Scripting",
    "slug": "slideshow-ck",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1335",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IS-theme-companion \u003c= 1.57 - Cross-Site Request Forgery",
    "slug": "weblizar-companion",
    "type": "plugin",
    "affected_version": "* - 1.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.57",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53277",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DentiCare \u003c 1.4.3 - Unauthenticated PHP Object Injection",
    "slug": "denticare",
    "type": "theme",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-54723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54723",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Expiry for WooCommerce \u003c= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update",
    "slug": "product-expiry-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0201",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Horizontal scroll image slideshow \u003c= 10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "horizontal-scroll-image-slideshow",
    "type": "plugin",
    "affected_version": "* - 10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11442",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Cross-Site Request Forgery via 'attach_rule'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1343",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ortto \u003c= 1.0.19 - Reflected Cross-Site Scripting",
    "slug": "autopilot",
    "type": "plugin",
    "affected_version": "* - 1.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52482",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZoomSounds - WordPress Wave Audio Player with Playlist \u003c= 6.91 - Unauthenticated Arbitrary File Download",
    "slug": "dzs-zoomsounds",
    "type": "plugin",
    "affected_version": "* - 6.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.91",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3431",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.4.2.6 - Reflected Cross-Site Scripting",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.4.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2571",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamically Register Sidebars \u003c= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "dynamically-register-sidebars",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31091",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.11.1 - Stored Cross-Site Scripting",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "[*, 1.11.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24259",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced File Manager \u003c= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "file-manager-advanced",
    "type": "plugin",
    "affected_version": "* - 5.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13805",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Comment Remix \u003c= 1.4.3 - SQL Injection",
    "slug": "wp-comment-remix",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-4733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-4733",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Catch Dark Mode \u003c= 2.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "catch-dark-mode",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10143",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "real.Kit \u003c= 5.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "real-kit",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0364",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TS Webfonts for SAKURA \u003c= 3.1.2 - Cross-Site Request Forgery",
    "slug": "ts-webfonts-for-sakura",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32625",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pinfinity \u003c= 1.9.2 - Reflected Cross-site Scripting",
    "slug": "pinfinity",
    "type": "theme",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SliceWP \u003c= 1.1.18 - Reflected Cross-Site Scripting",
    "slug": "slicewp",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47388",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4212",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.7 - Denial of Service",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-6767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-6767",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NextMove Lite – Thank You Page for WooCommerce \u0026 Finale Lite – Sales Countdown Timer \u0026 Discount for WooCommerce \u003c= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure",
    "slug": "woo-thank-you-page-nextmove-lite",
    "type": "plugin",
    "affected_version": "* - 2.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1120",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "NextMove Lite – Thank You Page for WooCommerce \u0026 Finale Lite – Sales Countdown Timer \u0026 Discount for WooCommerce \u003c= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure",
    "slug": "finale-woocommerce-sales-countdown-timer-discount",
    "type": "plugin",
    "affected_version": "* - 2.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1120",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "10Web Map Builder for Google Maps \u003c= 1.0.74 - Authenticated (Administrator+) SQL Injection",
    "slug": "wd-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.0.74",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.74",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31116",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Atahualpa \u003c 3.6.8 - Cross-Site Scripting",
    "slug": "atahualpa",
    "type": "theme",
    "affected_version": "[*, 3.6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-3850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3850",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smooth Accordion \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smooth-accordion",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58838",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Portfolio, Photo Gallery \u0026 Post Grid \u003c= 2.18.0 - Contributor+ CSS Injection",
    "slug": "visual-portfolio",
    "type": "plugin",
    "affected_version": "* - 2.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2597",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Backuply - Backup, Restore, Migrate and Clone \u003c= 1.2.6 -  Denial of Service",
    "slug": "backuply",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0842",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.3 - Missing Authorization in 'wpmsGGSaveInformation'",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1022",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Peter’s Random Anti-Spam Image \u003c= 1.0.6 - Cross-Site Scripting",
    "slug": "peters-random-anti-spam-image",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-6677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-6677",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Market Exporter \u003c= 2.0.19 - Missing Authorization to Arbitrary File Deletion",
    "slug": "market-exporter",
    "type": "plugin",
    "affected_version": "* - 2.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5637",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "GatorMail SmartForms \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gatormail-smart-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11386",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Robo Gallery Plugin \u003c= 3.2.11 - Cross-Site Request Forgery",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24414",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "tagDiv Composer \u003c= 5.0 - Reflected Cross-Site Scripting via envato_code[]",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3886",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Additional Logins \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-additional-logins",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23614",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Search \u003c= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "better-search",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47507",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Livemesh Addons for Elementor \u003c= 6.7.1- Contributor+ Stored Cross-Site Scripting",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 6.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24260",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Compliance \u003c= 1.2.5 - Authenticated (Subscriber+) Information Exposure",
    "slug": "gdpr-compliance",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34388",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.13.1 Cross-Site Request Forgery via 'admin_notice'",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "[*, 4.13.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.13.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-41953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41953",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contextual Related Posts \u003c= 1.8.6 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "contextual-related-posts",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-2710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2710",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "File Manager, Code editor, backup by Managefy \u003c= 1.6.1 - Unauthenticated Information Exposure",
    "slug": "softdiscover-db-file-manager",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10744",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "reCAPTCHA for all \u003c= 2.26 - Cross-Site Request Forgery",
    "slug": "recaptcha-for-all",
    "type": "plugin",
    "affected_version": "* - 2.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48243",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AutomateWoo \u003c= 5.7.1 - Authenticated (Shop manager+) SQL Injection",
    "slug": "automatewoo",
    "type": "plugin",
    "affected_version": "* - 5.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32743",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Meta Manager \u003c= 3.4.9 - Cross Site Request Forgery",
    "slug": "user-meta-manager",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23712",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mitsol Social Post Feed \u003c= 1.10 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "facebook-wall-and-social-integration",
    "type": "plugin",
    "affected_version": "* - 1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0209",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "List categories \u003c= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "list-categories",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4356",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Last Viewed Posts by WPBeginner \u003c= 1.0.1 - Unauthenticated Sensitive Information Exposure",
    "slug": "last-viewed-posts",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12294",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "3DPrint Lite \u003c=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'coating_text'",
    "slug": "3dprint-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3428",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Accordion and Accordion Slider \u003c= 1.2.4 - Missing Authorization via 'wp_aas_get_attachment_edit_form' and 'wp_aas_save_attachment_data'",
    "slug": "accordion-and-accordion-slider",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39996",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Mapbox for WP Advanced \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "mapbox-for-wp-advanced",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22772",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Empty Cart Button for WooCommerce \u003c= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "empty-cart-button-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon \u003c= 1.6.3 - Unauthenticated Information Exposure",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38756",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Dadevarzan WordPress Common \u003c= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dadevarzan-common",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58632",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eBay Product Feeds \u003c= 3.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ebay-feeds-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23722",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross-Site Scripting",
    "slug": "daggerhart-openid-connect-generic",
    "type": "plugin",
    "affected_version": "[3.8.0, 3.8.2)",
    "from_version": "3.8.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24214",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Vendors \u003c= 2.2.1 - Missing Authorization",
    "slug": "woocommerce-product-vendors",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51494",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows \u003c= 3.70.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via metaslider Shortcode",
    "slug": "ml-slider",
    "type": "plugin",
    "affected_version": "* - 3.70.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.70.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3285",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5144",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking.com Banner Creator \u003c= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bookingcom-banner-creator",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49265",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Membermouse \u003c= 2.2.8 - Blind SQL Injection",
    "slug": "membermouse",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-11309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11309",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Analytify \u003c= 5.5.1 - Missing Authorization to Authenticated (Subscriber+) Minor Settings Update",
    "slug": "wp-analytify",
    "type": "plugin",
    "affected_version": "* - 5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30897",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FPW Category Thumbnails \u003c= 1.9.5 - Missing Authorization",
    "slug": "fpw-category-thumbnails",
    "type": "plugin",
    "affected_version": "* - 1.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31841",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "InfiniteWP Client \u003c= 1.12.3 - Unauthenticated Sensitive Information Exposure",
    "slug": "iwp-client",
    "type": "plugin",
    "affected_version": "* - 1.12.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6565",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Staging (Free \u003c= 3.3.3, Pro \u003c= 5.3.3) - Authenticated (Administrator+) Stored Cross-Site-Scripting",
    "slug": "wp-staging",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2309",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Staging (Free \u003c= 3.3.3, Pro \u003c= 5.3.3) - Authenticated (Administrator+) Stored Cross-Site-Scripting",
    "slug": "wp-staging-pro",
    "type": "plugin",
    "affected_version": "* - 5.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2309",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twitget \u003c= 3.3.2 - Stored Cross-Site Scripting",
    "slug": "twitget",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-2995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2995",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP HTML Mail \u003c 2.2.11 - HTML injection",
    "slug": "wp-email-template",
    "type": "plugin",
    "affected_version": "[*, 2.2.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-25144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25144",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Fonts \u003c= 3.7.7 - Missing Authorization",
    "slug": "olympus-google-fonts",
    "type": "plugin",
    "affected_version": "* - 3.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43302",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Hack-Info \u003c= 3.17 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "hack-info",
    "type": "plugin",
    "affected_version": "* - 3.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54353",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PhastPress \u003c= 1.110 - Open Redirect",
    "slug": "phastpress",
    "type": "plugin",
    "affected_version": "* - 1.110",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.110",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24210",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoice Builder \u003c= 1.2.148 - Cross-Site Request Forgery",
    "slug": "woo-pdf-invoice-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.148",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.148",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53203",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPC Smart Wishlist for WooCommerce \u003c= 4.7.1 - Cross-Site Request Forgery via wishlist_add and wishlist_remove",
    "slug": "woo-smart-wishlist",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Show Posts \u003c= 1.1.4 - Information Exposure",
    "slug": "wp-show-posts",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1479",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) \u003c= 5.2.3 - Cross-Site Request Forgery",
    "slug": "wp-analytify",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35689",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bitcoin / Altcoin Faucet \u003c= 1.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "bitcoin-faucet",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3025",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blog2Social \u003c= 6.8.6 - Reflected Cross-Site Scripting",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "* - 6.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24956",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CopyLink \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "copy-link",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30603",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LightPress Lightbox \u003c= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-jquery-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3649",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Media Library \u003c= 4.22.11 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "real-media-library-lite",
    "type": "plugin",
    "affected_version": "* - 4.22.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.22.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2328",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Cloak Affiliate Links \u003c= 1.0.35 - Cross-Site Request Forgery",
    "slug": "woocommerce-cloak-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 1.0.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24647",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Show All Comments \u003c= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "show-all-comments-in-one-page",
    "type": "plugin",
    "affected_version": "* - 7.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47607",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 13.2.10 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 13.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38074",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins from Viszt Peter - Cross-Site Request Forgery",
    "slug": "integration-for-billingo-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3154",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins from Viszt Peter - Cross-Site Request Forgery",
    "slug": "woo-billingo-plus",
    "type": "plugin",
    "affected_version": "* - 4.4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3154",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins from Viszt Peter - Cross-Site Request Forgery",
    "slug": "integration-for-szamlazz-hu-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3154",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mediabay - WordPress Media Library Folders \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "mediabay",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28948",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AppReview \u003c= 0.2.9 - Reflected Cross-Site Scripting",
    "slug": "appreview",
    "type": "plugin",
    "affected_version": "* - 0.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23714",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qi Blocks \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Block",
    "slug": "qi-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1626",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Image from URL (FIFU) \u003c= 5.2.7 - Unauthenticated Information Exposure via Log File",
    "slug": "featured-image-from-url",
    "type": "plugin",
    "affected_version": "* - 5.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9985",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SpecFit-Virtual Try On Woocommerce \u003c= 7.0.5 - Reflected Cross-Site Scripting",
    "slug": "try-on-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 7.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23973",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Robokassa payment gateway for Woocommerce \u003c= 1.6.1 - Reflected Cross-Site Scripting",
    "slug": "robokassa",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47395",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13215",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Tour Master - Tour Booking, Travel, Hotel \u003c= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter",
    "slug": "tourmaster",
    "type": "plugin",
    "affected_version": "* - 5.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13369",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PDF for Elementor Forms + Drag And Drop Template Builder \u003c= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-for-elementor-forms",
    "type": "plugin",
    "affected_version": "* - 6.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58208",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram \u003c= 2.0.4 - Reflected Cross-Site Scripting via message_id",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "[*, 2.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24941",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WRC Pricing Tables \u003c= 2.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wrc-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38517",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Addons for Elementor \u003c= 2.0.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29911",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WCFM Marketplace \u003c= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wc-multivendor-marketplace",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4960",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GamePress – The Game Database Plugin \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "gamepress",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24617",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TheBooking \u003c= 1.4.4 - Missing Authorization",
    "slug": "thebooking",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52801",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Primary Addon for Elementor \u003c= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "primary-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44033",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Store Commerce \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "store-commerce",
    "type": "theme",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22339",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Plugin Lister \u003c= 2.1.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting",
    "slug": "wp-plugin-lister",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6503",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Civi - Job Board \u0026 Freelance Marketplace WordPress Theme \u003c= 2.1.4 - Authentication Bypass via Password Update",
    "slug": "civi",
    "type": "theme",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13771",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47357",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "searchterms-tagging-2 \u003c= 1.535 - Reflected Cross-Site Scripting",
    "slug": "searchterms-tagging-2",
    "type": "plugin",
    "affected_version": "* - 1.535",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.535",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9459",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Custom Codes \u003c= 4.80 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "add-custom-codes",
    "type": "plugin",
    "affected_version": "* - 4.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.80",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CS Framework \u003c= 7.1 - Authenticated (Subscriber+) Arbitrary File Read",
    "slug": "cs-framework",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12036",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "LearnPress \u003c= 3.0.12 - Cross-Site Scripting",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 3.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-16173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16173",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Generate PDF using Contact Form 7 \u003c= 3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "generate-pdf-using-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3070",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BSK PDF Manager \u003c= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "bsk-pdf-manager",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5110",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3D FlipBook – PDF Flipbook WordPress \u003c= 1.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Bookmarks",
    "slug": "interactive-3d-flipbook-powered-physics-engine",
    "type": "plugin",
    "affected_version": "* - 1.15.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1081",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBakery Page Builder for WordPress \u003c= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28650",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARForms \u003c= 6.4 - Missing Authorization to Arbitrary Option Deletion",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32704",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "GoCodes \u003c= 1.3.5 - Authenticated Blind SQL Injection",
    "slug": "gocodes",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9398",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EmbedPress \u003c= 4.0.4 - Missing Authorization",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38707",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Button contact VR \u003c= 4.7.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "button-contact-vr",
    "type": "plugin",
    "affected_version": "* - 4.7.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50414",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Residential Address Detection \u003c= 2.5.4 - Missing Authorization",
    "slug": "residential-address-detection",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30916",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Query Console \u003c= 1.0 - Unauthenticated Remote Code Execution",
    "slug": "wp-query-console",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50498",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Instant Appointment \u003c= 1.2 - Unauthenticated SQL Injection",
    "slug": "instant-appointment",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54361",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Enable/Disable Auto Login when Register \u003c= 1.1.0 Cross-Site Request Forgery",
    "slug": "auto-login-when-resister",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0522",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Strong Testimonials \u003c= 3.1.16 - Missing Authorization",
    "slug": "strong-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47362",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Patreon WordPress \u003c= 1.8.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "patreon-connect",
    "type": "plugin",
    "affected_version": "[*, 1.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25026",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OAuth Single Sign On – SSO (OAuth Client) \u003c= 6.24.1 - Cross-Site Request Forgery via 'delete' in mooauth_client_applist_page",
    "slug": "miniorange-login-with-eve-online-google-facebook",
    "type": "plugin",
    "affected_version": "* - 6.24.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.24.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1092",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "flashy \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "flashy",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23979",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AMP for WP – Accelerated Mobile Pages \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "accelerated-mobile-pages",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11254",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 6.8.1 - Unauthenticated SQL Injection",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "* - 6.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-0600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0600",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced File Manager Shortcodes \u003c= 2.4 - Authenticated (Contributor+) Directory Traversal",
    "slug": "file-manager-advanced-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7062",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Restful \u003c= 0.1 - Multiple Cross-Site Scripting",
    "slug": "wp-restful",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4595",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "tli.tl auto Twitter poster \u003c= 3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tlitl-auto-twitter-poster",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48324",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Survey And Quiz Tool \u003c 1.3 - Cross-Site Scripting",
    "slug": "wp-survey-and-quiz-tool",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2010-4630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4630",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IP2Location Redirection \u003c= 1.33.3 - Missing Authorization to Unauthenticated Settings Export",
    "slug": "ip2location-redirection",
    "type": "plugin",
    "affected_version": "* - 1.33.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1502",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Total Upkeep \u003c= 1.15.8 - Improper Authorization to Unauthenticated Arbitrary File Download",
    "slug": "boldgrid-backup",
    "type": "plugin",
    "affected_version": "* - 1.15.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-24869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24869",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Snippet Shortcodes \u003c= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletion",
    "slug": "shortcode-variables",
    "type": "plugin",
    "affected_version": "* - 4.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12018",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Private Messages For WordPress \u003c= 2.1.10 - Cross-Site Request Forgery",
    "slug": "private-messages-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29441",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "job-portal \u003c= 0.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "job-portal",
    "type": "plugin",
    "affected_version": "* - 0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39337",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor AI Addons – 70 Widgets, Premium Templates, Ultimate Elements \u003c= 2.2.1 - Authenticated (Contributor+) Private Templates Content Disclosure",
    "slug": "ai-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12140",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Form Generator for WordPress \u003c= 1.52 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "form-generator-powered-by-jotform",
    "type": "plugin",
    "affected_version": "* - 1.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58665",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins by itayamar - Backdoored Software",
    "slug": "pixter-image-digital-license",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-8047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8047",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Plugins by itayamar - Backdoored Software",
    "slug": "disable-right-click-powered-by-pixterme",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-8047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8047",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletters \u003c= 4.6.8.5 - Object Injection",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "[*, 4.6.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.8.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-20987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20987",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Evergreen Content Poster \u003c= 1.4.1 - Reflected Cross-Site Scripting",
    "slug": "evergreen-content-poster",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29099",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team – Team Members Showcase Plugin \u003c= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "tlp-team",
    "type": "plugin",
    "affected_version": "* - 4.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13439",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2249",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "(Simply) Guest Author Name \u003c= 4.34 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "guest-author-name",
    "type": "plugin",
    "affected_version": "* - 4.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0254",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership WP user Import \u003c= 1.7 - Authenticated (Admin+) SQL Injection",
    "slug": "simple-membership-wp-user-import",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0254",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woocommerce Blocks – Woolook \u003c= 1.7.0 - Authenticated (Admin+) Local File Inclusion",
    "slug": "woolook",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8393",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Crawlomatic Multipage Scraper Post Generator \u003c= 2.6.8.1 - Unauthenticated Arbitrary File Upload",
    "slug": "crawlomatic-multipage-scraper-post-generator",
    "type": "plugin",
    "affected_version": "* - 2.6.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4389",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Chaty \u003c= 3.0.9 - Reflected Cross-Site Scripting",
    "slug": "chaty",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25019",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Users Ultra Membership Plugin \u003c= 1.5.63 - Authenticated Blind SQL Injection",
    "slug": "users-ultra",
    "type": "plugin",
    "affected_version": "[*, 1.5.64)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.64",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9395",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "muse.ai video embedding \u003c= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via muse-ai Shortcode",
    "slug": "muse-ai",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6262",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Global Variables \u003c= 1.0.5 - Stored Cross-Site Scripting via 'name'",
    "slug": "custom-global-variables",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-3124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-3124",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happyforms \u003c= 1.26.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "happyforms",
    "type": "plugin",
    "affected_version": "* - 1.26.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10054",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Chained Products \u003c 2.12.0 - Missing Authorization to Arbitrary Options Update",
    "slug": "woocommerce-chained-products",
    "type": "plugin",
    "affected_version": "[*, 2.12.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-4872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4872",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Teleport \u003c= 1.2.4 - Reflected Cross-Site Scripting",
    "slug": "teleport",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28855",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ChatGPT Open AI Images \u0026 Content for WooCommerce \u003c= 2.2.0 - Reflected Cross-Site Scipting",
    "slug": "glasses-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23668",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vibes \u003c= 2.2.0 - Unauthenticated SQL Injection via `resource` Parameter",
    "slug": "vibes",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9172",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Videos sync PDF \u003c= 1.7.4 - Unauthenticated Local File Inclusion",
    "slug": "video-synchro-pdf",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1392",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ad Invalid Click Protector \u003c= 1.2.5 - SQL Injection",
    "slug": "ad-invalid-click-protector",
    "type": "plugin",
    "affected_version": "[*, 1.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0190",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Member \u003c= 2.10.0 - Unauthenticated SQL Injection via search Parameter",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1702",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin \u003c= 3.1.1 - Sensitive Information Disclosure",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "[*, 3.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-8604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8604",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Event Registration Calendar By vcita \u003c= 1.3.1 \u0026 Online Payments – Get Paid with PayPal, Square \u0026 Stripe \u003c= 3.10.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "event-registration-calendar-by-vcita",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2407",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Registration Calendar By vcita \u003c= 1.3.1 \u0026 Online Payments – Get Paid with PayPal, Square \u0026 Stripe \u003c= 3.10.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "paypal-payment-button-by-vcita",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2407",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Kikfyre \u003c= 2.1.8 - Missing Authorization",
    "slug": "kikfyre-events-calendar-tickets",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Maintenance \u003c= 6.0.7 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "wp-maintenance",
    "type": "plugin",
    "affected_version": "* - 6.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-30536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-30536",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Charts \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-charts",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26893",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp-D3 \u003c= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-d3",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0536",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10181",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ApplyOnline – Application Form Builder and Manager \u003c= 2.5.2 - Missing Authorization",
    "slug": "apply-online",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46080",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Logo Carousel – Clients logo carousel for WP \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-client-logo-carousel-slider",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47631",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Checkout Field Visibility for WooCommerce \u003c= 1.2.3 - Unauthenticated Local File Inclusion",
    "slug": "checkout-field-visibility-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39391",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JS Job Manager \u003c= 2.0.2 - Unauthenticated Arbitrary File Upload",
    "slug": "js-jobs",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32660",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.0.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2007-5105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-5105",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmpowerWP \u003c= 1.0.21 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "empowerwp",
    "type": "theme",
    "affected_version": "* - 1.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34809",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Agenda \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-agenda",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51924",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Ping Optimizer \u003c= 2.35.1.3.0 - Cross-Site Request Forgery to Log Clearing",
    "slug": "wordpress-ping-optimizer",
    "type": "plugin",
    "affected_version": "* - 2.35.1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.35.1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6385",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "pipDisqus \u003c= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pipdisqus",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28908",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Everest Forms \u003c= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8542",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Products Price Bulk Edit \u003c= 2.0 - Cross-Site Scripting via show_products_page_limit parameter",
    "slug": "mq-woocommerce-products-price-bulk-edit",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14796",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YourChannel \u003c= 1.2.4 - Cross-Site Request Forgery to Plugin Channel Reset",
    "slug": "yourchannel",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1866",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Multi-column Tag Map \u003c= 17.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap Shortcode",
    "slug": "multi-column-tag-map",
    "type": "plugin",
    "affected_version": "* - 17.0.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.0.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11196",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5254",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 4.7.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "[*, 4.7.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-11085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11085",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Authors List \u003c= 2.0.6.1 - Cross-Site Request Forgery",
    "slug": "authors-list",
    "type": "plugin",
    "affected_version": "* - 2.0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58792",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wSecure Lite \u003c 2.4 - Remote Code Execution",
    "slug": "wsecure",
    "type": "plugin",
    "affected_version": "[*, 2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10960",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JetElements For Elementor \u003c= 2.6.13 - Missing Authorization to Unauthenticated Arbitrary Attachment Download",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48759",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Special Text Boxes \u003c= 6.2.4 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "wp-special-textboxes",
    "type": "plugin",
    "affected_version": "* - 6.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8481",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "reCAPTCHA Jetpack \u003c= 0.2.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "recaptcha-jetpack",
    "type": "plugin",
    "affected_version": "* - 0.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3940",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Error Log Viewer \u003c= 1.1.2 - Sensitive Information Exposure",
    "slug": "error-log-viewer",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6821",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Eventify \u003c= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "eventify",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4110",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate WP Mail \u003c= 1.3.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "ultimate-wp-mail",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47490",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "TicketBAI Facturas para WooCommerce \u003c= 3.19 - Unauthenticated SQL Injection",
    "slug": "wp-ticketbai",
    "type": "plugin",
    "affected_version": "* - 3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24767",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GP Unique ID \u003c= 1.5.5 - Unauthenticated Form Submission Unique ID Modification",
    "slug": "gp-unique-id",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0710",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lazy Load for Videos \u003c= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes",
    "slug": "lazy-load-for-videos",
    "type": "plugin",
    "affected_version": "* - 2.18.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7732",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Portfolio Gallery – Photo Gallery \u003c= 1.1.8 - Authenticated (Admin+) SQL Injection",
    "slug": "portfolio-gallery",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-125101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-125101",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via id parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6570",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Listing, Classified Ads \u0026 Business Directory – uListing \u003c= 2.0.3 - Unauthenticated SQL Injection",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-36880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36880",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blocksy \u003c= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blocksy",
    "type": "theme",
    "affected_version": "* - 2.0.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5439",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Featured Image \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameter",
    "slug": "simple-featured-image",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7059",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Manager Light \u003c= 3.2 - Reflected Cross-Site Scripting",
    "slug": "content-manager-light",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24771",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Notification Bell \u003c= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wp-notification-bell",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58821",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Attesa Extra \u003c= 1.4.2 - Authenticated (Contributor+) Post Disclosure",
    "slug": "attesa-extra",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10688",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Blubrry PowerPress Podcasting plugin MultiSite add-on \u003c= 0.1.1 - Reflected Cross-Site Scripting",
    "slug": "powerpress-multisite",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31436",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BMI Adult \u0026 Kid Calculator \u003c= 1.2.2 - Reflected Cross-Site Scripting",
    "slug": "bmi-adultkid-calculator",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47618",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.8.2 - Cross-Site Request Forgery via handle_optin_optout()",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28989",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Adminify \u003c= 3.1.6 - Authenticated(Administrator+) SQL Injection",
    "slug": "adminify",
    "type": "plugin",
    "affected_version": "[*, 3.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-52132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52132",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Filr – Secure document library \u003c= 1.2.2 - Missing Authorization",
    "slug": "filr-protection",
    "type": "plugin",
    "affected_version": "[*, 1.2.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"
  },
  {
    "title": "EditionGuard for WooCommerce – eBook Sales with DRM \u003c= 3.4.2 - Reflected Cross-Site Scripting",
    "slug": "editionguard-for-woocommerce-ebook-sales-with-drm",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23452",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscribe to Download Lite \u003c= 1.2.9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "subscribe-to-download-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30785",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CG Button \u003c= 1.0.5.6 - Reflected Cross-Site Scripting",
    "slug": "content-glass-button",
    "type": "plugin",
    "affected_version": "* - 1.0.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23632",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress CRM Plugin – WP-CRM System \u003c= 3.2.9.1 - Missing Authorization",
    "slug": "wp-crm-system",
    "type": "plugin",
    "affected_version": "* - 3.2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55991",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Vrm 360 3D Model Viewer \u003c= 1.2.1 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "vrm360",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4311",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Squelch Tabs and Accordions Shortcodes \u003c= 0.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via accordions Shortcode",
    "slug": "squelch-tabs-and-accordions-shortcodes",
    "type": "plugin",
    "affected_version": "* - 0.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2499",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Plugin by Squirrly SEO \u003c= 12.3.16 - Reflected Cross-Site Scripting",
    "slug": "squirrly-seo",
    "type": "plugin",
    "affected_version": "* - 12.3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.3.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29790",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Greenshift \u003c= 11.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 11.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30873",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-FormAssembly \u003c= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "formassembly-web-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13501",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Compress Then Upload \u003c= 1.0.4 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "compress-then-upload",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8889",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elite Video Player \u003c= 10.0.5 - Reflected Cross-Site Scripting",
    "slug": "elite-video-player",
    "type": "plugin",
    "affected_version": "* - 10.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54044",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plugmatter Pricing Table Lite  \u003c= 1.0.32 - Reflected Cross-Site Scripting",
    "slug": "plugmatter-pricing-table",
    "type": "plugin",
    "affected_version": "* - 1.0.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34659",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comment Link Remove and Other Comment Tools \u003c= 2.1.4 - Arbitrary Comment Deletion via Cross-Site Request Forgery",
    "slug": "comment-link-remove",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24725",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Youtube Video Grid | Youmax \u003c= 1.9 - Reflected Cross-Site Scripting",
    "slug": "youmax-channel-embeds-for-youtube-businesses",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23634",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Funnel Builder for WordPress by FunnelKit \u003c= 3.10.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "funnel-builder",
    "type": "plugin",
    "affected_version": "* - 3.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2203",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Statistics \u003c= 13.2.1 - Reflected Cross-Site Scripting",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "[*, 13.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1005",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Hour Booking \u003c= 1.3.55 - Authenticated Stored Cross-Site Scripting",
    "slug": "appointment-hour-booking",
    "type": "plugin",
    "affected_version": "* - 1.3.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.55",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1710",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hero Mega Menu - Responsive WordPress Menu Plugin \u003c= 1.16.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "hmenu",
    "type": "plugin",
    "affected_version": "* - 1.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49333",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AI Preloader \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ai-preloader",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30530",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.3.8 - Insufficient Restrictions during Export Personal Data requests",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-20981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20981",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Accessibility Suite by Online ADA \u003c= 4.12 - Authenticated (Subscriber+) SQL Injection",
    "slug": "online-accessibility",
    "type": "plugin",
    "affected_version": "* - 4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-45830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45830",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LINE Notify \u003c= 1.4.4 - Reflected Cross-Site Scripting via 'uid'",
    "slug": "wp-line-notify",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30497",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3275",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Pro \u003c= 6.3.6 - Missing Authorization",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "* - 6.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46259",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WHMpress \u003c= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update",
    "slug": "whmpress",
    "type": "plugin",
    "affected_version": "[*, 6.3-revision-0]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3-revision-0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9193",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cryptocurrency Pricing list and Ticker \u003c= 1.5 - Reflected Cross-Site Scripting",
    "slug": "cryptocurrency-pricing-list",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25044",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Option Tree \u003c= 2.6.0 - PHP Object Injection",
    "slug": "option-tree",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15319",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Menu Swapper \u003c= 1.1.0.2 - Cross-Site Request Forgery Bypass",
    "slug": "menu-swapper",
    "type": "plugin",
    "affected_version": "* - 1.1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36746",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Opal Estate \u003c= 1.6.11 - Missing Authorization",
    "slug": "opal-estate",
    "type": "plugin",
    "affected_version": "* - 1.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4388",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Slider Plugin \u003c= 1.4.5 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "simple-slider-ssp",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29428",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Typed JS: A typewriter style animation \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via typespeed Parameter",
    "slug": "mrlegend-typedjs",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1328",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscription DNA \u003c= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "subscriptiondna",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24555",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime – Events Calendar, Bookings and Tickets \u003c= 3.4.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1320",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "QS Dark Mode \u003c= 3.0 - Missing Authorization",
    "slug": "qs-dark-mode",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47628",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CrossSlide jQuery Plugin \u003c= 2.0.5 - Multiple Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "crossslide-jquery-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2089",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Min Max Control \u003c= 4.5 - Reflected Cross-Site Scripting",
    "slug": "woo-min-max-quantity-step-control-single",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4270",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "S3 Video \u003c= 0.982 - Cross-Site Scripting",
    "slug": "s3-video",
    "type": "plugin",
    "affected_version": "* - 0.982",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.982",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-7279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7279",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TC Testimonials \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tc-testimonial",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49410",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Dashboard \u003c= 3.7.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "ultimate-dashboard",
    "type": "plugin",
    "affected_version": "* - 3.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50828",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Option Tree \u003c= 2.5.3 - Cross-Site Scripting",
    "slug": "option-tree",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GetBookingsWp - Appointments \u0026 Bookings Plugin Basic Version \u003c= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover",
    "slug": "get-bookings-wp",
    "type": "plugin",
    "affected_version": "* - 1.1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13677",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPGYM \u003c= 65.0 - Unauthenticated SQL Injection",
    "slug": "gym-management",
    "type": "plugin",
    "affected_version": "* - 65.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "65.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32643",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WoodMart - Multipurpose WooCommerce Theme \u003c= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 8.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8097",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Fast Total Search \u003c= 1.68.232 - Missing Authorization",
    "slug": "fulltext-search",
    "type": "plugin",
    "affected_version": "* - 1.68.232",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.68.232",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38714",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "School Management \u003c= 92.0.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 92.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "92.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47575",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quantity Dynamic Pricing \u0026 Bulk Discounts for WooCommerce \u003c= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wholesale-pricing-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31598",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Daily Prayer Time \u003c= 2023.03.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "daily-prayer-time-for-mosques",
    "type": "plugin",
    "affected_version": "* - 2023.03.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2023.03.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27631",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Point Maker \u003c= 0.1.4 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "point-maker",
    "type": "plugin",
    "affected_version": "* - 0.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PageLayer \u003c= 1.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43972",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZIJ KART \u003c= 1.1 - Unauthenticated Local File Inclusion",
    "slug": "zij-kart",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52381",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Most And Least Read Posts Widget \u003c=2.5.16 - Authenticated(Contributor+) SQL Injection via Widget settings",
    "slug": "most-and-least-read-posts-widget",
    "type": "plugin",
    "affected_version": "[*, 2.5.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.17",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-52133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52133",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quiz and Survey Master (QSM) \u003c= 10.2.2 - Cross-Site Request Forgery to Template Creation",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 10.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6790",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Machic Core \u003c= 1.2.6 - Reflected Cross-Site Scripting",
    "slug": "machic-core",
    "type": "theme",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49186",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy2Map \u003c= 1.2.9 - Reflected Cross-Site Scripting",
    "slug": "easy2map",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-7668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7668",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Subscription Forms PRO \u003c=  2.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "wp-subscription-forms-pro",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60166",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GamesTheme  \u003c= 1.0.3 - Sensitive Information Disclosure",
    "slug": "GamesTheme",
    "type": "theme",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9490",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "W3SCloud Contact Form 7 to Zoho CRM \u003c= 3.0 - Cross-Site Request Forgery",
    "slug": "w3s-cf7-zoho",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60169",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sky Addons for Elementor \u003c= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sky-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38687",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UsersWP \u003c= 1.2.15 - Missing Authorization",
    "slug": "userswp",
    "type": "plugin",
    "affected_version": "* - 1.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43277",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Poll Maker \u003c 3.4.2 - Unauthenticated SQL Injection",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "[*, 3.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24651",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Offload SES Lite \u003c= 1.4.4 - Stored Cross-Site Scripting",
    "slug": "wp-ses",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24494",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.7.0.56 - Unauthenticated SQL Injection",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.7.0.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.0.56",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10042",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ultimate Noindex Nofollow Tool II \u003c= 1.3.3 - Cross-Site Request Forgery",
    "slug": "ultimate-noindex-nofollow-tool-ii",
    "type": "plugin",
    "affected_version": "[*, 1.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-30474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30474",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PowerPack Lite for Beaver Builder \u003c= 1.3.0.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "powerpack-addon-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37409",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sticky Button – Click to Chat \u003c= 1.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "sticky-chat-button",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23839",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visitors Online by BestWebSoft \u003c 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "visitors-online",
    "type": "plugin",
    "affected_version": "[*, 1.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18537",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Append extensions on Pages \u003c= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "append-extensions-on-pages",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57940",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin \u003c 1.5.63 - Cross-Site Request Forgery",
    "slug": "users-ultra",
    "type": "plugin",
    "affected_version": "[*, 1.5.63)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.63",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9394",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.36",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.33",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.29",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.28",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.27",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.21",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.13",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.39",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.24",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.11",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.10",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.9",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.7",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.4",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.36",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.20",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.17",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.14",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.16",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.2",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.39",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.37",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.24",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.5",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 \u0026 Gutenberg \u003c 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks",
    "slug": "gutenberg",
    "type": "plugin",
    "affected_version": "* - 14.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Live css \u003c= 1.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "css-live",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27295",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Libro de Reclamaciones y Quejas \u003c= 0.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "libro-de-reclamaciones-y-quejas",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30989",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPZOOM Addons for Elementor (Templates, Widgets) \u003c= \u003c=1.1.35 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpzoom-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.1.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33539",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Payments – Get Paid with PayPal, Square \u0026 Stripe \u003c= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "paypal-payment-button-by-vcita",
    "type": "plugin",
    "affected_version": "* - 3.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11895",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Projectopia \u0026#8211; WordPress Project Management \u003c= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion",
    "slug": "projectopia-core",
    "type": "plugin",
    "affected_version": "* - 5.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3952",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads – Recommended Products \u003c= 1.2.3.2 - Cross-Site Scripting",
    "slug": "recommended-products-edd",
    "type": "plugin",
    "affected_version": "* - 1.2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9523",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons \u003c= 5.4.11 - Missing Authorization via bdt_duplicate_as_draft",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24840",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Themify Popup \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themify-popup",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58787",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Booking System \u003c= 2.0.19.2 - Missing Authorization",
    "slug": "wp-booking-system",
    "type": "plugin",
    "affected_version": "* - 2.0.19.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.19.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49758",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Twitter Post \u003c= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "twitterpost",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23654",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Generator \u003c= 2.7.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "contact-form-generator",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-35911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35911",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Alert Me! \u003c= 0.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "alert-me",
    "type": "plugin",
    "affected_version": "* - 0.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51825",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yoga Schedule Momoyoga \u003c= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "momoyoga-integration",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32529",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "s2Member® Framework (Membership, Member Level Roles, Access Capabilities, PayPal Members) \u003c 111220 - Cross-Site Scripting",
    "slug": "s2member",
    "type": "plugin",
    "affected_version": "[*, 111220)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "111220",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2011-5082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5082",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meris \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "meris",
    "type": "theme",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7194",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page/Post Content Shortcode \u003c= 1.0 - Missing Authorization",
    "slug": "pagepost-content-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24819",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jetpack – WP Security, Backup, Speed, \u0026 Growth \u003c= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "* - 13.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4392",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Image Lab – Free AI Image Generator \u003c= 1.0.6 - Cross-Site Request Forgery to API Key Update",
    "slug": "ai-image-generator-lab",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4592",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token Function",
    "slug": "melapress-login-security",
    "type": "plugin",
    "affected_version": "2.1.0 - 2.1.1",
    "from_version": "2.1.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6895",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Auto Featured Image (Auto Post Thumbnail) \u003c= 4.1.2 - Missing Authorization",
    "slug": "auto-post-thumbnail",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CRM Perks Forms \u003c= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "crm-perks-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51536",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdRotate – Ad manager \u0026 AdSense Ads \u003c= 5.2 - Authenticated SQL Injection",
    "slug": "adrotate",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-13570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13570",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Subscribe to Download \u003c= 2.0.9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "subscribe-to-download",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-60150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60150",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Frontend File Manager \u003c= 18.2 - Unauthenticated Arbitrary File Download",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "[*, 18.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4356",
    "auth_type": "Unauth",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.1.15 - PHP Object Injection via extractDynamicValues",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4157",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Divi Torque Lite \u003c= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "addons-for-divi",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0353",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Move Addons for Elementor \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "move-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47396",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP STAGING WordPress Backup Plugin Free \u003c= 3.1.2 and Pro \u003c= 5.1.2 - Sensitive Information Exposure",
    "slug": "wp-staging",
    "type": "plugin",
    "affected_version": "[*, 3.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6113",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP STAGING WordPress Backup Plugin Free \u003c= 3.1.2 and Pro \u003c= 5.1.2 - Sensitive Information Exposure",
    "slug": "wp-staging-pro",
    "type": "plugin",
    "affected_version": "[*, 5.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6113",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 8.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Question Title",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3575",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AWP Classifieds \u003c= 4.3.5 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "another-wordpress-classifieds-plugin",
    "type": "plugin",
    "affected_version": "* - 4.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57928",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "myCred \u003c= 2.9.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.9.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54668",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.0.5 - Improper Authorization to Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-0701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-0701",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Cost Calculator Builder \u003c= 3.2.65 - Unauthenticated SQL Injection",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "* - 3.2.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.65",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39587",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Blessing Premium Responsive WordPress Theme \u003c 1.3.2.1 - Sensitive Information Disclosure",
    "slug": "blessing",
    "type": "theme",
    "affected_version": "[*, 1.3.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9491",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Call Now Button \u003c= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "call-now-button",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2908",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jetpack Debug Tools \u003c= 2.0.0 - Missing Authorization",
    "slug": "jetpack-debug-helper",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56006",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Alert Boxes \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode",
    "slug": "simple-alert-boxes",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5937",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adaptive Images for WordPress \u003c= 0.6.66 - Arbitrary File Deletion",
    "slug": "adaptive-images",
    "type": "plugin",
    "affected_version": "[*, 0.6.67)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.67",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-14206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14206",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Oceanwp sticky header \u003c= 1.0.8 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "sticky-header-oceanwp",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-35730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-35730",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.5.6 - Unauthenticated Authorization Bypass",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3805",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"
  },
  {
    "title": "Markdown Shortcode \u003c= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "markdown-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10180",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookie Monster \u003c= 1.51 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cookiemonster",
    "type": "plugin",
    "affected_version": "* - 1.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33208",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cooked Pro \u003c 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cooked-pro",
    "type": "plugin",
    "affected_version": "[*, 1.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-49289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49289",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "About Me 3000 widget \u003c= 2.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "about-me-3000",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3369",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YouTube Gallery and Vimeo Gallery Plugin \u003c= 2.4.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "gallery-videos",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10247",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slider a SlidersPack \u003c= 2.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "sliderspack-all-in-one-image-sliders",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32152",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Subscribe2 – Form, Email Subscribers \u0026 Newsletters \u003c= 10.15 - Stored Cross-Site Scripting",
    "slug": "subscribe2",
    "type": "plugin",
    "affected_version": "[*, 10.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-6604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6604",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Meta Data and Taxonomies Filter (MDTF) \u003c= 1.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29763",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Business Data \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-business-data",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11870",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SpiderVPlayer \u003c= 1.5.1 - Cross-Site Scripting",
    "slug": "player",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-8584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8584",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Tag Manager \u003c= 1.5 - Reflected Cross-Site Scripting via default_class",
    "slug": "image-tag-manager",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22160",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "mTouch Quiz \u003c= 3.1.2 - Cross-Site Request Forgery",
    "slug": "mtouch-quiz",
    "type": "plugin",
    "affected_version": "[*, 3.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9387",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "melascrivi-plugin \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "melascrivi",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23479",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Widgets to Page \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "add-widgets-to-page",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47808",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bricks Builder \u003c= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter",
    "slug": "bricks",
    "type": "theme",
    "affected_version": "* - 1.12.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6495",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Display post meta, term meta, comment meta, and user meta \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "display-metadata",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1661",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Moneytizer \u003c= 9.6.3 - Missing Authorization via multiple AJAX actions",
    "slug": "the-moneytizer",
    "type": "plugin",
    "affected_version": "* - 9.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6966",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Themedy Toolbox \u003c= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes",
    "slug": "themedy-toolbox",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9177",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Responsive Slideshow – Image slider, Gallery slideshow \u003c= 1.4.0 - Missing Authorization",
    "slug": "slider-responsive-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35722",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "myCred \u003c= 2.7.2 - Unauthenticated PHP Object Injection",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43354",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Member \u003c= 2.1.2 - Insecure Direct Object Reference",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-6859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-6859",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Restaurant Menu \u003c= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-restaurant-menu",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58647",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase \u0026 Team Builder \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wps-team",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3521",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Forum Server \u003c= 1.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "forum-server",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-6622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6622",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.4.7 - Missing Authorization to Information Exposure",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32782",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Carousel Slider \u003c= 2.2.2 - Missing Authorization",
    "slug": "carousel-slider",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41848",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Logo Slider \u003c= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "logo-slider-wp",
    "type": "plugin",
    "affected_version": "* - 3.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3288",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Copyscape Premium \u003c= 1.3.8 - Cross-Site Request Forgery",
    "slug": "copyscape-premium",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47644",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 2.9.2 - Missing Authorization",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39920",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "The Post Grid \u003c= 7.7.4 - Missing Authorization via AJAX",
    "slug": "the-post-grid",
    "type": "plugin",
    "affected_version": "* - 7.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37482",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Console \u003c= 0.3.9 - Missing Authorization via reload.php",
    "slug": "wordpress-console",
    "type": "plugin",
    "affected_version": "* - 0.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28168",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bus Ticket Booking with Seat Reservation for WooCommerce \u003c= 1.7 - Unauthenticated SQL Injection",
    "slug": "scw-bus-seat-reservation",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31397",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Strong Testimonials \u003c= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "strong-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4717",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kiwi \u003c= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kiwi-social-share",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58790",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ditty \u003c= 3.1.24 - Reflected Cross-Site Scripting",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "[*, 3.1.25)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.25",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4148",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Link Directory \u003c= 14.7.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "qc-simple-link-directory",
    "type": "plugin",
    "affected_version": "* - 14.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32297",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Bulk Price Update for Woocommerce \u003c= 2.2.1 - Reflected Cross-Site Scripting",
    "slug": "woo-bulk-price-update",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28665",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HotelRunner Booking Widget \u003c= 1.6 - Cross-Site Request Forgery",
    "slug": "hotelrunner",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60168",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Verowa Connect \u003c= 3.0.4 - Reflected Cross-Site Scripting",
    "slug": "verowa-connect",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32609",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Porn Videos Embed \u003c= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "porn-videos-embed",
    "type": "plugin",
    "affected_version": "* - 0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Front End Profile \u003c= 0.2.1 - Privilege Escalation",
    "slug": "wp-front-end-profile",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-15111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15111",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy \u003c= 2.1.1 - Unauthenticated Arbitrary Content Deletion",
    "slug": "woo-aliexpress-dropshipping",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32724",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "tagDiv Composer \u003c 4.4 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "[*, 4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-39166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39166",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Service Box \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "service-boxs",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12699",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteGround Security \u003c= 1.3.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "sg-security",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0234",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hitsteps Web Analytics \u003c= 5.86 - Cross-Site Request Forgery via hst_optionpage",
    "slug": "hitsteps-visitor-manager",
    "type": "plugin",
    "affected_version": "* - 5.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45268",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VG WORT METIS \u003c= 2.0.1 - Missing Authorization",
    "slug": "vgw-metis",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50039",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "External Media \u003c= 1.0.35 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "external-media",
    "type": "plugin",
    "affected_version": "* - 1.0.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3832",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirect 404 to parent \u003c 1.3.1 - Reflected Cross-Site Scripting",
    "slug": "redirect-404-to-parent",
    "type": "plugin",
    "affected_version": "[*, 1.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24286",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tax Report for WooCommerce \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "tax-report-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23731",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \u003c= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widget",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.14.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5640",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Waymark \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "waymark",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26770",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stop Spam Comments \u003c= 0.2.1.2 - Protection Mechanism Bypass",
    "slug": "stop-spam-comments",
    "type": "plugin",
    "affected_version": "* - 0.2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1663",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NextScripts: Social Networks Auto-Poster \u003c= 4.4.3 - Authenticated(Subscriber+) Sensitive Information Exposure",
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "type": "plugin",
    "affected_version": "* - 4.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2088",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Form Vibes – Database Manager for Forms \u003c= 1.4.12 - Missing Authorization in Multiple Functions",
    "slug": "form-vibes",
    "type": "plugin",
    "affected_version": "* - 1.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5309",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Custom Post Template \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "wp-custom-post-template",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41851",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ListingPro - WordPress Directory \u0026 Listing Theme \u003c 2.6.1 - Sensitive Information Disclosure",
    "slug": "listingpro",
    "type": "theme",
    "affected_version": "[*, 2.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36723",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SMS Alert Order Notifications – WooCommerce \u003c= 3.6.9 - Cross-Site Request Forgery",
    "slug": "sms-alert",
    "type": "plugin",
    "affected_version": "* - 3.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1489",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Heureka \u003c= 1.1.0 - Missing Authorization",
    "slug": "heureka",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57907",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Buttons Pack by BestWebSoft \u003c 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "social-buttons-pack",
    "type": "plugin",
    "affected_version": "[*, 1.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18500",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stock History \u0026 Reports Manager for WooCommerce \u003c= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stock-snapshot-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10167",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amwerk \u003c= 1.2.0 - Unauthenticated PHP Object Injection",
    "slug": "amwerk",
    "type": "theme",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52724",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DirectoryPress Frontend \u003c= 2.7.9 - Cross-Site Request Forgery to Listing Status Update",
    "slug": "directorypress-frontend",
    "type": "plugin",
    "affected_version": "* - 2.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10581",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Concours \u003c= 1.1 - Cross-Site Scripting",
    "slug": "wp-concours",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17719",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar \u003c= 9.7.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 9.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4620",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Hotel Booking Lite \u003c= 4.11.1 - Unauthenticated PHP Object Injection",
    "slug": "motopress-hotel-booking-lite",
    "type": "plugin",
    "affected_version": "* - 4.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.11.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4413",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ldap WP Login / Active Directory Integration  \u003c= 3.0.1 - Missing Authorization",
    "slug": "ldap-wp-login-integration-with-active-directory",
    "type": "plugin",
    "affected_version": "[*, 3.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-2987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2987",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Qe SEO Handyman \u003c= 1.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "qe-seo-handyman",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4351",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Quote Calculator \u003c= 1.1 - Unauthenticated SQL Injection",
    "slug": "woo-quote-calculator-order",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50479",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Hustle – Email Marketing, Lead Generation, Optins, Popups \u003c= 7.8.5 - Missing Authorization to Unpublished Form Exposure",
    "slug": "wordpress-popup",
    "type": "plugin",
    "affected_version": "* - 7.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10579",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FAT Services Booking \u003c= 5.5 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "fat-services-booking",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47693",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "e2pdf \u003c 1.20.20 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "e2pdf",
    "type": "plugin",
    "affected_version": "[*, 1.20.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.20",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5229",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Skt NURCaptcha \u003c= 3.5.0 - Cross-Site Request Forgery  to Stored Cross-Site Scripting",
    "slug": "skt-nurcaptcha",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11342",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bigmart Elements \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bigmart-elements",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51589",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 13.2.8 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 13.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4230",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Instant CSS \u003c= 1.1.4 - Missing Authorization via AJAX Actions",
    "slug": "instant-css",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38483",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "verwei.se – WordPress – Twitter \u003c= 1.0 2 - Cross-Site Scripting",
    "slug": "verweise-wordpress-twitter",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Pocket URLs \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-pocket-urls",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51681",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Weather Effect – Christmas Santa Snow Falling \u003c= 1.3.3 - Cross-Site Request Forgery",
    "slug": "weather-effect",
    "type": "plugin",
    "affected_version": "[*, 1.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24683",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal \u003c= 3.1.2 - Reflected Cross-Site Scripting via monthly_sales_current_year Parameter",
    "slug": "simple-e-commerce-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12128",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PIXNET Plugin \u003c= 2.9.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "pixnet",
    "type": "plugin",
    "affected_version": "* - 2.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11338",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eCommerce Product Catalog Plugin for WordPress \u003c= 2.9.43 - Cross-Site Request Forgery Bypass",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "[*, 2.9.44)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.44",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4392",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12713",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Store Locator WordPress \u003c= 1.5.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "agile-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49328",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Confirm User Registration \u003c= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "confirm-user-registration",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46459",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13128",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support \u003c= 6.1.5 - Missing Authorization via wpas_load_reply_history",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51537",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress File Search \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "wpfilesearch",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23867",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Addons for Elementor \u003c= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52358",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Chat Widget \u003c= 3.1.8 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "chaty",
    "type": "plugin",
    "affected_version": "* - 3.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2972",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hive Support \u003c= 1.2.5 - Missing Authorization",
    "slug": "hive-support",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32242",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shiny Buttons – CSS3 Button Generator for WordPress \u003c= 1.1.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "shiny-buttons",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24792",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GNUCommerce \u003c= 1.5.4 - Reflected Cross-Site Scripting",
    "slug": "gnucommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26564",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ultimate Exporter \u003c= 2.9.1 - Authenticated (Admin+) Remote Code Execution",
    "slug": "wp-ultimate-exporter",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56278",
    "auth_type": "Privileged",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "BizLibrary \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "bizlibrary",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23580",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IDonatePro \u003c= 2.1.9 - Missing Authorization",
    "slug": "idonate-pro",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30639",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lightbox \u0026 Modal Popup WordPress Plugin – FooBox \u003c= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes",
    "slug": "foobox-image-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.7.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5668",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Peadig’s Google +1 Button \u003c= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-1",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46483",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \u003c= 2.8.11 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8246",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple SEO \u003c= 1.7.91 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cds-simple-seo",
    "type": "plugin",
    "affected_version": "* - 1.7.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1628",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Post After Image Upload \u003c= 1.6 - Missing Authorization",
    "slug": "auto-post-after-image-upload",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31611",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NextGEN Gallery \u003c= 2.1.56 - Authenticated Local File Inclusion \u0026 SQL injection",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.56",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-10889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10889",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple 301 Redirects by BetterLinks \u003c= 2.0.7 - Missing Authorization via clicked",
    "slug": "simple-301-redirects",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47761",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Payment Button for PayPal \u003c= 1.2.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-paypal",
    "type": "plugin",
    "affected_version": "* - 1.2.3.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13401",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tuaug4 \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "tuaug4",
    "type": "theme",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple:Press \u003c= 6.8 - Unauthenticated Stored Cross-Site Scripting via Forum Replies",
    "slug": "simplepress",
    "type": "plugin",
    "affected_version": "* - 6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4027",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP MultiTasking \u003c= 0.1.12 - Cross-Site Request Forgery to Header/Footer/Body Script Update",
    "slug": "wp-multitasking",
    "type": "plugin",
    "affected_version": "* - 0.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6857",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Manager \u003c= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6975",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Manager \u003c= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "7.0.1 - 7.0.3",
    "from_version": "7.0.1",
    "from_inclusive": true,
    "to_version": "7.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6975",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Dashboard Widget \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "create-custom-dashboard-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51860",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.6.9 - Authenticated (Admin+) Cross-Site Scripting via label",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36827",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quotes for WooCommerce \u003c= 2.0.1 - Missing Authorization",
    "slug": "quotes-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51680",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bravada \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bravada",
    "type": "theme",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43351",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple:Press Forum \u003c= 6.10.11 - Reflected Cross-Site Scripting",
    "slug": "simplepress",
    "type": "plugin",
    "affected_version": "* - 6.10.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12409",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajar in5 Embed \u003c= 3.1.5 - Unauthenticated Arbitrary File Upload",
    "slug": "ajar-productions-in5-embed",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47642",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GitSync \u003c= 1.1.0 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "git-sync",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54368",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 2.8.5 - Arbitrary File Upload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2009-3890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-3890",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MapPress Maps for WordPress \u003c= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.88.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.88.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6524",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Donate \u003c= 1.4 - Unauthenticated SQL Injection in donate-display.php",
    "slug": "wp-donate",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-10122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10122",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post SMTP \u003c= 2.9.11 - Missing Authorization via regenerate_qrcode()",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22800",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Media Plugin by Social Snap \u003c= 1.3.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "socialsnap",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13615",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.12 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32960",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Map With Fancybox \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "location-piker",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23594",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TNC PDF viewer \u003c= 3.1.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "pdf-viewer-by-themencode",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47372",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 3.6 - Authenticated Stored Cross-Site Scripting via IP setting",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-29172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-29172",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Allow SVG \u003c= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "allow-svg",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6541",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVG Support \u003c= 2.5.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "svg-support",
    "type": "plugin",
    "affected_version": "* - 2.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "my-category-order \u003c= 2.8.7 - SQL Injection",
    "slug": "my-category-order",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2009-4748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-4748",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "System Dashboard \u003c= 2.8.7 - Missing Authorization to Information Disclosure (sd_option_value)",
    "slug": "system-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5713",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CC BMI Calculator \u003c= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cc-bmi-calculator",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47442",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL \u003c= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "terms-popup-on-user-login",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47592",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Agile Privacy \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vis Shortcode",
    "slug": "myagileprivacy",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51404",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iCount Payment Gateway \u003c= 2.0.6 - Missing Authorization",
    "slug": "icount",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53295",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NewStatPress \u003c= 1.0.3 - Stored Cross-Site Scripting",
    "slug": "newstatpress",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9314",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration \u003c= 2.2.4  - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3912",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BU Slideshow \u003c= 2.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bu-slideshow",
    "type": "plugin",
    "affected_version": "* - 2.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52351",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Email \u003c= 1.2.65 - Cross-Site Request Forgery",
    "slug": "contact-form-to-email",
    "type": "plugin",
    "affected_version": "* - 1.2.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.65",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20964",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Default Post Content \u003c= 0.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "my-default-post-content",
    "type": "plugin",
    "affected_version": "* - 0.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30573",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download CloudNet360 \u003c= 3.2.0 - Reflected Cross-Site Scripting",
    "slug": "cloudnet-sync",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46643",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Borderless \u003c= 1.5.8 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "borderless",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54211",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gum Elementor Addon \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gum-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44035",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WDSocialWidgets \u003c 1.0.11 - Cross-Site Scripting",
    "slug": "spider-facebook",
    "type": "plugin",
    "affected_version": "[*, 1.0.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-1582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1582",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WP Comment Remix \u003c 1.4.4 - Cross-Site Request Forgery",
    "slug": "wp-comment-remix",
    "type": "plugin",
    "affected_version": "[*, 1.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2008-4734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-4734",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate TinyMCE \u003c= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-tinymce",
    "type": "plugin",
    "affected_version": "* - 5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8627",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential WP Real Estate \u003c= 1.1.3 - Reflected Cross-Site Scripting",
    "slug": "essential-wp-real-estate",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23857",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blogprise \u003c= 1.0.9 - Unauthenticated Local File Inclusion",
    "slug": "blogprise",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49277",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Awesome Event Booking \u003c= 2.7.2 - Missing Authorization",
    "slug": "awesome-event-booking",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22668",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Colorbox \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-colorbox",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60124",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Revo \u003c= 4.0.26 - Unauthenticated Local File Inclusion",
    "slug": "revo",
    "type": "theme",
    "affected_version": "* - 4.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39476",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Menu Image \u003c= 2.2 - Missing Authorization to Unauthenticated Menu Image Deletion",
    "slug": "wp-menu-image",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52485",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pricing Table by PickPlugins \u003c= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pricingtable",
    "type": "plugin",
    "affected_version": "* - 1.12.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13469",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Writer Helper \u003c= 3.1.6 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "writer-helper",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52399",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GamiPress \u003c= 6.8.5 - Cross-Site Request Forgery",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 6.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30455",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Scheduled \u0026amp; Automatic Order Status Controller for WooCommerce \u003c= 3.7.1 - Open Redirect",
    "slug": "order-status-rules-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30781",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Image Carousel WordPress - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-image-carousel",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0589",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CodeBard Help Desk \u003c= 1.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "codebard-help-desk",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22757",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Float menu – awesome floating side menu \u003c= 6.0 - Cross-Site Request Forgery to Menu Deletion",
    "slug": "float-menu",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2405",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GEO Redirector \u003c= 1.0.1 - Cross-Site Scripting",
    "slug": "geo-redirector",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4533",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Everest Backup \u003c= 2.2.4 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "everest-backup",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7201",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BSK Forms Validation \u003c= 1.7 - Reflected Cross-Site Scripting",
    "slug": "bsk-gravity-forms-custom-validation",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24545",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bizapp for WooCommerce \u003c= 2.0.8 - Reflected Cross-Site Scripting",
    "slug": "bizapp-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11378",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \u003c= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5382",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.5.43.7212 - Authenticated (Subscriber+) Server-side Request Forgery",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.43.7212",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.43.7212",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32955",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Viral Loops WP Integration \u003c= 3.8.1 - Missing Authorization",
    "slug": "viral-loops-wp-integration",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-28994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28994",
    "auth_type": "Auth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Lessons Manager \u003c 1.7.2 and Video Lessons Manager Pro \u003c 3.5.9 - Stored Cross-Site Scripting",
    "slug": "cm-video-lesson-manager",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24713",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Lessons Manager \u003c 1.7.2 and Video Lessons Manager Pro \u003c 3.5.9 - Stored Cross-Site Scripting",
    "slug": "cm-video-lesson-manager-pro",
    "type": "plugin",
    "affected_version": "* - 3.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24713",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PayU India \u003c= 2.1.1 - Improper Input Validation",
    "slug": "woocommerce-payu-paisa",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14978",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CMS Commander \u003c= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature",
    "slug": "cms-commander-client",
    "type": "plugin",
    "affected_version": "* - 2.287",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.287",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3325",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Attire Blocks \u003c= 1.9.6 - Cross-Site Request Forgery",
    "slug": "attire-blocks",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24696",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Markdown Editor (Formerly Dark Mode) \u003c 1.7 - Stored Cross-Site Scripting",
    "slug": "dark-mode",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5652",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdPush \u003c= 1.50 - Reflected Cross-Site Scripting",
    "slug": "adsense-plugin",
    "type": "plugin",
    "affected_version": "* - 1.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38672",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Workreap \u003c= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'",
    "slug": "workreap",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4973",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Projectopia \u003c= 5.1.7 - Missing Authorization to Privilege Escalation via pto_reset_password()",
    "slug": "projectopia-core",
    "type": "plugin",
    "affected_version": "* - 5.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54336",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Radius Blocks \u003c= 2.1.2 - Cross-Site Request Forgery",
    "slug": "radius-blocks",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24712",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Backup Guard \u003c= 1.5.9 - Authenticated Arbitrary File Upload",
    "slug": "backup",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24155",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kanban Boards for WordPress \u003c= 2.5.21 - Reflected Cross-Site Scripting",
    "slug": "kanban",
    "type": "plugin",
    "affected_version": "* - 2.5.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31103",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.5.1.8 - Reflected Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-1002002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1002002",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plugin Name: Device Theme Switcher \u003c= 3.0.2 - Cross-Site Request Forgery",
    "slug": "device-theme-switcher",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47556",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager \u003c= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "folders",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7317",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Catch Themes Demo Import \u003c= 3.0.2 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "one-click-demo-import",
    "type": "plugin",
    "affected_version": "[*, 3.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1008",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Referral \u003c= 8.0 - Reflected Cross-Site Scripting",
    "slug": "user-referral-free",
    "type": "plugin",
    "affected_version": "* - 8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56037",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Reset \u003c= 2.0 - Sensitive Information Exposure due to Insufficient Randomness",
    "slug": "wp-reset",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6799",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Oxygen Builder \u003c= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet Update",
    "slug": "oxygenbuilder",
    "type": "plugin",
    "affected_version": "* - 4.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6688",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Debug Log Manager \u003c= 2.2.0 - Cross-Site Request Forgery",
    "slug": "debug-log-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5772",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Exclusive Addons Elementor \u003c= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30232",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hacklog Remote Image Autosave \u003c= 2.1.0 - Cross-Site Request Forgery",
    "slug": "hacklog-remote-image-autosave",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30576",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NebulaX \u003c 5.0 - Unauthenticated SQL Injection",
    "slug": "NebulaX",
    "type": "plugin",
    "affected_version": "[*, 5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-25106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-25106",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "RD Station \u003c= 5.1.3 - Cross-Site Request Forgery to Plugin Log Deletion",
    "slug": "integracao-rd-station",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38139",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Optimizer, Resizer and CDN – Sirv \u003c= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "* - 7.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6392",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Font Awesome WP \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "font-awesome-wp",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1414",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Special Text Boxes \u003c= 5.9.109 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-special-textboxes",
    "type": "plugin",
    "affected_version": "* - 5.9.109",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.109",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24485",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Fixed Notice \u003c= 1.6 - Cross-Site Request Forgery",
    "slug": "dn-cookie-notice",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31840",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JobBoardWP – Job Board Listings and Submissions \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "jobboardwp",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10880",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixel Cat Lite \u003c= 2.6.2 - Admin+ Stored Cross-Site Scripting",
    "slug": "facebook-conversion-pixel",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24972",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ocim MP3 (All Versions) - Cross-Site Scripting",
    "slug": "ocim-mp3",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10998",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewsmanApp \u003c= 2.7.7 - Cross-Site Request Forgery",
    "slug": "newsmanapp",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60164",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via subscriber_email parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6578",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10091",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Volunteer Sign Up Sheets \u003c= 5.5.4 - Authenticated (Admin+) Stored Cross-site Scripting",
    "slug": "pta-volunteer-sign-up-sheets",
    "type": "plugin",
    "affected_version": "* - 5.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3704",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quizlord \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "quizlord",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4112",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.3.1 - Missing Authorization to Arbitrary Options Read",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12059",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Booking Calendar \u003c= 9.2.1 - Cross-Site Request Forgery",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 9.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-33177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33177",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ProjectHuddle Client Site \u003c= 1.0.34 - Missing Authorization via ph_child_ajax_notice_handler",
    "slug": "projecthuddle-child-site",
    "type": "plugin",
    "affected_version": "* - 1.0.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51376",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Azz Anonim Posting \u003c= 0.9 - Unauthenticated Arbitrary File Upload",
    "slug": "azz-anonim-posting",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hive Support \u003c= 1.2.5 - Reflected Cross-Site Scripting",
    "slug": "hive-support",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32666",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simply Schedule Appointments \u003c= 1.5.7.5 - Unauthenticated Sensitive Information Exposure",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.5.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2373",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Diary \u0026 Availability Calendar \u003c= 1.0.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "diary-availability-calendar",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24555",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.18.0 - Reflected Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11921",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "video carousel slider with lightbox \u003c= 1.0.22 - Reflected Cross-Site Scripting",
    "slug": "wp-responsive-video-gallery-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2710",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 7.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5638",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Neighborly \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode",
    "slug": "neighborly",
    "type": "theme",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5869",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "April's Call Posts \u003c= 2.1.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "aprils-call-posts",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53730",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Structured Content \u003c= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "structured-content",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.5.3 - Unauthenticated Privilege Escalation",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33567",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Motors \u003c= 1.4.80 - Unauthenticated Insecure Direct Object Reference",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.80",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54691",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "INK Official \u003c= 4.1.2 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "ink-official",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49669",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Real Estate Manager \u003c= 7.3 - Cross-Site Request Forgery",
    "slug": "real-estate-manager",
    "type": "plugin",
    "affected_version": "* - 7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52825",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "avalex – Automatisch sichere Rechtstexte \u003c= 3.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "avalex",
    "type": "plugin",
    "affected_version": "[*, 3.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-25059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25059",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Front End Users \u003c= 3.2.33 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "front-end-only-users",
    "type": "plugin",
    "affected_version": "* - 3.2.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58235",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "External image replace \u003c= 1.0.8 - Cross-Site Request Forgery to Settings Update",
    "slug": "external-image-replace",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30535",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Free Live Chat Support \u003c= 1.0.11 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "livesupporti",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2039",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "«Подсказки» от DaData.ru \u003c= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dadata-ru",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30931",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ecwid Shopping Cart \u003c= 6.11.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ecwid-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 6.11.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.11.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24408",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HyperComments \u003c= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options Update",
    "slug": "hypercomments",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5701",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Better Post \u0026 Filter Widgets for Elementor \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "better-post-filter-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48354",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LayerSlider \u003c= 7.7.9 - Cross-Site Request Forgery",
    "slug": "LayerSlider",
    "type": "plugin",
    "affected_version": "* - 7.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47785",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elements Plus! \u003c= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links",
    "slug": "elements-plus",
    "type": "plugin",
    "affected_version": "* - 2.16.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2335",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net \u003c= 1.112.0 - Reflected Cross-Site Scripting",
    "slug": "peachpay-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.112.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.112.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Addon for Elementor \u003c= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown Widgets",
    "slug": "events-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8150",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Authenticator \u003c= 1.3.0 - Missing Authorization",
    "slug": "authenticator",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3994",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Eco Nature - Environment \u0026 Ecology WordPress Theme \u003c= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update",
    "slug": "eco-nature",
    "type": "theme",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0952",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WooCommerce PDF Invoices \u0026 Packing Slips \u003c= 3.8.6 - Missing Authorization",
    "slug": "woocommerce-pdf-invoices-packing-slips",
    "type": "plugin",
    "affected_version": "* - 3.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50421",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form – Contact Form \u003c= 1.2.0 - Administrator+ Cross-Site Scripting",
    "slug": "form-forms",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1326",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sticky Social Icons \u003c= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sticky-social-icons",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52491",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Automator \u003c= 5.1.0.2 - Sensitive Information Exposure via Log File",
    "slug": "uncanny-automator",
    "type": "plugin",
    "affected_version": "* - 5.1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52151",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.9",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.8",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.1 - 6.1.6",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.2 - 6.2.5",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.3 - 6.3.4",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.4 - 6.4.4",
    "from_version": "6.4",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.5 - 6.5.4",
    "from_version": "6.5",
    "from_inclusive": true,
    "to_version": "6.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block",
    "slug": "gutenberg",
    "type": "plugin",
    "affected_version": "* - 18.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relevanssi \u003c= 4.24.3 (Free) and \u003c= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights",
    "slug": "relevanssi-premium",
    "type": "plugin",
    "affected_version": "* - 2.27.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.27.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4054",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relevanssi \u003c= 4.24.3 (Free) and \u003c= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "* - 4.24.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4054",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qode Essential Addons \u003c= 1.6.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "qode-essential-addons",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50457",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Searchie \u003c= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "searchie",
    "type": "plugin",
    "affected_version": "* - 1.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12819",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rocket Media Library Mime Type \u003c= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "rocket-media-library-mime-type",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22768",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Sell Digital Files \u0026 Subscriptions (eCommerce Store + Payments Made Easy) \u003c= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6691",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rover IDX \u003c= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator",
    "slug": "rover-idx",
    "type": "plugin",
    "affected_version": "* - 3.0.0.2905",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0.2905",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10002",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Organizer \u003c= 1.2.1 - Multiple Cross-Site Scripting",
    "slug": "organizer",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-6511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6511",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nasa Core \u003c= 6.3.2 - Unauthenticated Local File Inclusion",
    "slug": "nasa-core",
    "type": "plugin",
    "affected_version": "* - 6.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39506",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Power Ups for Elementor \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "power-ups-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13548",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photospace Gallery \u003c= 2.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "photospace",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3991",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Asset CleanUp \u003c= 1.3.8.4 - Reflected Cross-Site Scripting via AJAX Action",
    "slug": "wp-asset-clean-up",
    "type": "plugin",
    "affected_version": "[*, 1.3.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24983",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Database Backup \u003c= 5.5 - Unauthenticated Information Disclosure",
    "slug": "wp-database-backup",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-7241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7241",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Secure Maintenance \u003c= 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-secure-maintainance",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4753",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Wishlist \u003c= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "yith-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5238",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ListingPro \u003c= 2.9.3 - Unauthenticated SQL Injection",
    "slug": "listingpro",
    "type": "theme",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-39622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39622",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Display Future Posts \u003c= 0.2.3 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "display-future-posts",
    "type": "plugin",
    "affected_version": "* - 0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54413",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageInject \u003c= 1.15 - Cross-Site Scripting",
    "slug": "wp-inject",
    "type": "plugin",
    "affected_version": "* - 1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5284",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LH Signing \u003c= 2.83 - Cross-Site Request Forgery",
    "slug": "lh-signing",
    "type": "plugin",
    "affected_version": "* - 2.83",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.83",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9633",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.12.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10538",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapSVG \u003c= 8.5.31 - Missing Authorization",
    "slug": "mapsvg",
    "type": "plugin",
    "affected_version": "* - 8.5.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47558",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Warfare \u003c= 3.5.2 - Remote Code Execution",
    "slug": "social-warfare",
    "type": "plugin",
    "affected_version": "[*, 3.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4434",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "mFolio Lite \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mfolio-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31847",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Google Datastudio \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embed-google-data-studio",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9877",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enqueue Anything \u003c= 1.0.1 - Missing Authorization",
    "slug": "enqueue-anything",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25116",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Simple File List \u003c= 6.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "* - 6.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39924",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RumbleTalk Live Group Chat \u003c= 6.1.9 - Missing Authorization via handleRequest",
    "slug": "rumbletalk-chat-a-chat-with-themes",
    "type": "plugin",
    "affected_version": "* - 6.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-45828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45828",
    "auth_type": "Auth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"
  },
  {
    "title": "WP Blocks Hub \u003c= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "wp-blocks-hub",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9372",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BWD Elementor Addons \u003c= 4.3.18 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates",
    "slug": "bwd-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 4.3.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12532",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce Payment Gateway for Saferpay \u003c= 0.4.9 - Unauthenticated Path Traversal",
    "slug": "woocommerce-payment-gateway-for-saferpay",
    "type": "plugin",
    "affected_version": "* - 0.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48317",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "B Slider- Gutenberg Slider Block for WP \u003c= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcode",
    "slug": "b-slider",
    "type": "plugin",
    "affected_version": "* - 1.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13514",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GTranslate \u003c= 2.8.51 - Reflected Cross Site Scripting",
    "slug": "gtranslate",
    "type": "plugin",
    "affected_version": "* - 2.8.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11930",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stylish Price List \u003c= 7.0.17 - Missing Authorization",
    "slug": "stylish-price-list",
    "type": "plugin",
    "affected_version": "* - 7.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51673",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "TaxoPress \u003c= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "simple-tags",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2168",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) \u003c= 7.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "miniorange-login-openid",
    "type": "plugin",
    "affected_version": "* - 7.5.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23710",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator \u003c= 1.24.1 - Reflected Cross-Site Scripting",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.24.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3134",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eCommerce Product Catalog Plugin for WordPress \u003c= 3.0.17 - Cross-Site Request Forgery Bypass",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "[*, 3.0.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4393",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Prevent Direct Access 2.8.6 - 2.8.8.2 - Incorrect Authorization to Authenticated (Contributor+) Multiple Media Actions",
    "slug": "prevent-direct-access",
    "type": "plugin",
    "affected_version": "2.8.6 - 2.8.8.2",
    "from_version": "2.8.6",
    "from_inclusive": true,
    "to_version": "2.8.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3861",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPExperts Square For GiveWP \u003c= 1.3.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wpexperts-square-for-give",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13713",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "3D Tag Cloud \u003c= 3.8 - Cross-Site Request Forgery",
    "slug": "cardoza-3d-tag-cloud",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36417",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appointment Booking Calendar \u003c= 1.3.92 - Missing Authorization",
    "slug": "appointment-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 1.3.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.92",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46247",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Editor Button \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "cf7-editor-button",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48345",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Giga Messenger – Express \u003c= 2.3.1 - Reflected Cross-Site Scripting",
    "slug": "giga-messenger-bots",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13328",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Bootstrap Elements for Elementor \u003c= 1.4.9 - Unauthenticated Local File Inclusion",
    "slug": "ultimate-bootstrap-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32672",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Secure Copy Content Protection and Content Locking \u003c= 4.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "secure-copy-content-protection",
    "type": "plugin",
    "affected_version": "* - 4.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6889",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hercules Core \u003c= 6.4 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "hercules-core",
    "type": "plugin",
    "affected_version": "* - 6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-30228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30228",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rencontre – Dating Site \u003c= 3.11.1 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "rencontre",
    "type": "plugin",
    "affected_version": "* - 3.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51470",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lattice \u003c 1.1.5 - Cross-Site Scripting",
    "slug": "lattice",
    "type": "theme",
    "affected_version": "[*, 1.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9533",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accelerated Mobile Pages \u003c= 1.0.92.1 - Reflected Cross-Site Scripting",
    "slug": "accelerated-mobile-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.92.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.92.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0587",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Column-Matic \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "column-matic",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32578",
    "auth_type": "Auth",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Elementor (Formerly Elementor Header \u0026 Footer Builder) \u003c= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8488",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.23",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.5",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.2",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.29",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.18",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.13",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.9",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.29",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.26",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.26",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.19",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.13",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.1",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.27",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.17",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Authenticated Cross-Site Scripting via Post Previews",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.10",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16223",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share Buttons by Supsystic \u003c= 2.2.3 - Cross-Site Request Forgery",
    "slug": "social-share-buttons-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36890",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.8.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37934",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Debug Tool \u003c= 2.2 - Unauthenticated Arbitrary File Creation",
    "slug": "debug-tool",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10586",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BestWebSoft's Pinterest \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "bws-pinterest",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18517",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPress Podcasting plugin by Blubrry \u003c= 11.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 11.12.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.12.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-46264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46264",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Search Atlas SEO \u003c= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "metasync",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58019",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link Shield \u003c= 0.5.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "link-shield",
    "type": "plugin",
    "affected_version": "* - 0.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32503",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk NoIndex \u0026 NoFollow Toolkit \u003c= 2.01 - Reflected Cross-Site Scripting via tab, order, and orderby",
    "slug": "bulk-noindex-nofollow-toolkit-by-mad-fish",
    "type": "plugin",
    "affected_version": "* - 2.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29791",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nova Lite \u003c 1.3.9 - Reflected Cross-Site Scripting",
    "slug": "nova-lite",
    "type": "theme",
    "affected_version": "[*, 1.3.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-17362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-17362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4163",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4163",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Houzez \u003c= 4.1.1 - Missing Authorization",
    "slug": "houzez",
    "type": "theme",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49406",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fix Rss Feeds \u003c= 3.1 - Cross-Site Request Forgery",
    "slug": "fix-rss-feed",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30556",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Beacon Lead Magnets and Lead Capture \u003c= 1.5.7 - Reflected Cross-Site Scripting",
    "slug": "beacon-by",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24637",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Gravity Forms Keap/Infusionsoft \u003c= 1.2.4 - Open Redirect",
    "slug": "gf-infusionsoft",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58006",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpDataTables (Premium) \u003c= 3.4.1 - Improper Access Control leading to Table Permission Takeover",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "[*, 3.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24197",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder \u003c= 8.7.3 - Reflected Cross-Site Scripting",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47389",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Intuitive Custom Post Order \u003c= 3.1.3 - Missing Authorization to Authenticated Settings Change",
    "slug": "intuitive-custom-post-order",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4385",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EmbedStories \u003c= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "embedstories",
    "type": "plugin",
    "affected_version": "* - 0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0372",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress Members Only \u003c= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "buddypress-members-only",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31812",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EnvíaloSimple \u003c= 2.1 Unauthenticated PHP Object Injection",
    "slug": "envialosimple-email-marketing-y-newsletters-gratis",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51414",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "copy-me \u003c= 1.0.0 - Missing Authorization \u0026 Cross-Site Request Forgery",
    "slug": "copy-me",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10938",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Enable Media Replace \u003c= 4.0.1 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "enable-media-replace",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0255",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Nuss \u003c= 1.3.3 - Missing Authorization",
    "slug": "nuss",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52804",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcodes AnyWhere \u003c= 1.0.1 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "shortcodes-anywhere",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9581",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "PixelYourSite – Your smart PIXEL (TAG) \u0026 API Manager \u003c= 9.7.1 and PixelYourSite PRO \u003c= 10.4.2 - Unauthenticated Information Exposure and Log Deletion",
    "slug": "pixelyoursite-pro",
    "type": "plugin",
    "affected_version": "* - 10.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7870",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PixelYourSite – Your smart PIXEL (TAG) \u0026 API Manager \u003c= 9.7.1 and PixelYourSite PRO \u003c= 10.4.2 - Unauthenticated Information Exposure and Log Deletion",
    "slug": "pixelyoursite",
    "type": "plugin",
    "affected_version": "* - 9.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7870",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Booster – Pros \u0026 Cons, Notice, and CTA Blocks for Affiliates \u003c= 3.0.5 - Cross-Site Request Forgery via process_bulk_action",
    "slug": "affiliatebooster-blocks",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49148",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Log Viewer \u003c= 1.2.1 - Missing Authorization",
    "slug": "wp-log-viewer",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11085",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Zendesk Chat \u003c 1.2.6 - Cross-Site Scripting",
    "slug": "zopim-live-chat",
    "type": "plugin",
    "affected_version": "[*, 1.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-1808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1808",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Intents \u003c= 1.6.14 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "live-chat-support-by-social-intents",
    "type": "plugin",
    "affected_version": "* - 1.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32131",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapPress Maps for WordPress \u003c= 2.94.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.94.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.94.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2162",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13427",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register Premium \u003c= 3.8.3.2 - Missing Authorization",
    "slug": "pie-register-premium",
    "type": "plugin",
    "affected_version": "* - 3.8.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26948",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Include Fussball.de Widgets \u003c= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "include-fussball-de-widgets",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47643",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.3.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3005",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forms \u003c= 2.9.0 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "forms-by-made-it",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24775",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hyphenator \u003c= 5.1.5 - Cross-Site Request Forgery to Settings Update",
    "slug": "hyphenator",
    "type": "plugin",
    "affected_version": "* - 5.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32594",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile \u0026 User signup \u003c= 3.4.7 -Authentication Bypass via Password Reset Weakness",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1903",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Image Gallery, Gallery Album \u003c= 2.0.3 - Unauthenticated Cross-Site Scripting",
    "slug": "gallery-album",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45630",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Math Captcha \u003c= 3.0.0 - Reflected Cross-Site Scripting",
    "slug": "ds-cf7-math-captcha",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6517",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cryptocurrency Widgets – Price Ticker \u0026 Coins List \u003c= 2.6.8 - Missing Authorization",
    "slug": "cryptocurrency-price-ticker-widget",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27953",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MOLIE \u003c= 0.5 - SQL Injection",
    "slug": "molie-instructure-canvas-linking-tool",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25007",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress \u003c= 1.7.2 - Authenticated (Author+) SQL Injection",
    "slug": "contact-form-to-db",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-35678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35678",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.12 - Information Exposure via Meta Description",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6962",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ultimate Addons for Elementor Lite \u003c= 2.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wc Recently viewed products \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "wc-recently-viewed-products",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52484",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Flickr Slideshow \u003c= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mobile-friendly-flickr-slideshow",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22807",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode Collection \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcode-collection",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51864",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress Docs \u003c= 1.9.2 - Authorization Bypass",
    "slug": "buddypress-docs",
    "type": "plugin",
    "affected_version": "[*, 1.9.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-6954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6954",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Orders \u0026 Customers Exporter \u003c= 5.0 - Authenticated (Subscriber+) Information Exposure",
    "slug": "woocommerce-orders-customers-exporter",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48331",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Edwiser Bridge \u003c= 3.0.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "edwiser-bridge",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31260",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "DoFollow Case by Case \u003c= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dofollow-case-by-case",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47625",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cozy Blocks \u003c= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cozy-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50441",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Getwid – Gutenberg Blocks \u003c= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 2.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10872",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TriPay Payment Gateway \u003c= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tripay-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48737",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FL3R FeelBox \u003c= 8.1 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting",
    "slug": "fl3r-feelbox",
    "type": "plugin",
    "affected_version": "* - 8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4552",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "AzonBox \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "azonbox",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51931",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi Step Form \u003c= 1.7.12 - Cross-Site Request Forgery",
    "slug": "multi-step-form",
    "type": "plugin",
    "affected_version": "* - 1.7.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47758",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Accio | Responsive Onepage Parallax Agency WordPress Theme \u003c= 1.1.0 - Sensitive Information Disclosure",
    "slug": "accio",
    "type": "theme",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9484",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Zita Elementor Site Library \u003c= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "zita-site-library",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8921",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All in One SEO \u003c= 2.2.5.1 - Information Disclosure",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "[*, 2.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-0902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-0902",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Premium Packages \u003c= 6.0.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "wpdm-premium-packages",
    "type": "plugin",
    "affected_version": "* - 6.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52435",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Majestic Support – The Leading-Edge Help Desk \u0026 Customer Support Plugin \u003c= 1.0.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "majestic-support",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13600",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Miraculous Core \u003c= 2.0.7 - Unauthenticated Privilege Escalation",
    "slug": "miraculouscore",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49388",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Page Loading \u003c= 1.0.6 - Cross-Site Request Forgery",
    "slug": "wp-page-loading",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49317",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Epic Bootstrap Buttons \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icol Parameter",
    "slug": "epic-bootstrap-buttons",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Banner",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3819",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Slider – Responsive Touch Slider \u003c= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32580",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vmax Project Manager \u003c= 1.0 - Unauthenticated Local File Inclusion",
    "slug": "vmax-project-manager",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-44014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44014",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ninja Tables \u003c= 4.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "ninja-tables",
    "type": "plugin",
    "affected_version": "* - 4.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47137",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Grid \u003c= 3.1.0 - Reflected Cross-Site Scripting",
    "slug": "essential-grid",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47684",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JoomSport \u003c= 5.2.7 - Unauthenticated SQL Injection",
    "slug": "joomsport-sports-league-results-management",
    "type": "plugin",
    "affected_version": "* - 5.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4050",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tabs for WooCommerce \u003c= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs",
    "slug": "wc-tabs",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13831",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 26.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6716",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Verowa Connect \u003c= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "verowa-connect",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58257",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEOPress – On-site SEO \u003c= 8.1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 8.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9225",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happyforms \u003c= 1.26.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "happyforms",
    "type": "plugin",
    "affected_version": "* - 1.26.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44063",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IMPress Listings \u003c= 2.6.2 - Missing Authorization",
    "slug": "wp-listings",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45633",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Register Profile With Shortcode \u003c= 3.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-register-profile-with-shortcode",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23818",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider comparison image before and after \u003c= 0.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slider-comparison-image-before-and-after",
    "type": "plugin",
    "affected_version": "* - 0.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8543",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.12.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1815",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic URL SEO \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "dynamic-url-seo",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23985",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SexBundle \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "sexbundle",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23551",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Open User Map | Everybody can add locations \u003c= 1.3.26 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "open-user-map",
    "type": "plugin",
    "affected_version": "* - 1.3.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45056",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MHR-Custom-Anti-Copy \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mhr-custom-anti-copy",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23817",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPZOOM Portfolio \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wpzoom-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4789",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder \u003c= 2.8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.8.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50430",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45455",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WTI Like Post \u003c= 1.4.5 - Stored Cross-Site Scripting",
    "slug": "wti-like-post",
    "type": "plugin",
    "affected_version": "[*, 1.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-8799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8799",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile App Builder by WapPress \u003c= 1.05 - Arbitrary File Upload",
    "slug": "mobile-app-builder-by-wappress",
    "type": "plugin",
    "affected_version": "* - 1.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.05",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002001",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple-Audioplayer \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-audioplayer",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31607",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kento Post View Counter \u003c= 2.8 - Reflected Cross-Site Scripting",
    "slug": "kento-post-view-counter",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10980",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Counter \u003c= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "abwp-simple-counter",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50377",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SendPress Newsletters \u003c= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "sendpress",
    "type": "plugin",
    "affected_version": "* - 1.22.3.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.3.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5660",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Multilingual \u0026 Multicurrency \u003c= 5.3.4 - Missing Authorization",
    "slug": "woocommerce-multilingual",
    "type": "plugin",
    "affected_version": "* - 5.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30466",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CataBlog \u003c= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload",
    "slug": "catablog",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47842",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Connect \u003c= 1.2 - Authentication Bypass",
    "slug": "social-connect",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4393",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Events Calendar \u003c= 6.3.0 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31433",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LightBox Block \u003c= 1.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lightbox-block",
    "type": "plugin",
    "affected_version": "* - 1.1.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54051",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Language Switch \u003c= 1.6.10 - Reflected Cross-Site Scripting",
    "slug": "user-language-switch",
    "type": "plugin",
    "affected_version": "* - 1.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49064",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce - Social Login \u003c= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation",
    "slug": "woo-social-login",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6636",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Seraphinite Bulk Discounts for WooCommerce \u003c= 2.4.6 - Reflected Cross-Site Scripting",
    "slug": "seraphinite-discount-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12160",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Autoptimize \u003c= 2.7.7 - Unsafe File Upload to Cross-Site Scripting",
    "slug": "autoptimize",
    "type": "plugin",
    "affected_version": "[*, 2.7.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24378",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewsXpress \u003c= 1.0.7 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "newsxpress",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31938",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Footnotes for WordPress \u003c= 2016.1230 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "footnotes-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2016.1230",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2016.1230",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31735",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Video Store \u003c= 21.07 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "photo-video-store",
    "type": "plugin",
    "affected_version": "* - 21.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.07",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53782",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mihdan: Elementor Yandex Maps \u003c= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marker Pins",
    "slug": "mihdan-elementor-yandex-maps",
    "type": "plugin",
    "affected_version": "* - 1.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8608",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support \u003c= 6.1.7 - Missing Authorization",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30539",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikBooking \u003c= 1.5.8 - Reflected Cross-Site Scripting",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "[*, 1.5.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1528",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MW WP Form \u003c= 5.0.6 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "mw-wp-form",
    "type": "plugin",
    "affected_version": "* - 5.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24804",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Action Network \u003c= 1.4.2 - Reflected Cross-Site Scripting via 'search'",
    "slug": "wp-action-network",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25921",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP show more \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_more Shortcode",
    "slug": "wp-show-more",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9967",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mapa Politico España \u003c= 3.8.0 - Cross-Site Request Forgery",
    "slug": "wp-mapa-politico-spain",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48259",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CookieHub \u003c= 1.1.0 - Missing Authorization",
    "slug": "cookiehub",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32784",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Page Ordering \u003c= 2.5.0 - Missing Authorization to Information Disclosure",
    "slug": "simple-page-ordering",
    "type": "plugin",
    "affected_version": "[*, 2.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-32798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32798",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Manage Upload Limit \u003c= 1.0.4 - Reflected Cross-Site Scripting via upload_limit",
    "slug": "wpsimpletools-upload-limit",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-27432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27432",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "ReCaptcha Integration for WordPress \u003c= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-recaptcha-integration",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37946",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Secure Copy Content Protection and Content Locking \u003c= 2.8.1 - Unauthenticated SQL Injection",
    "slug": "secure-copy-content-protection",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24931",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Export Users Data CSV \u003c= 2.1 - Authenticated (Subscriber+) CSV Injection",
    "slug": "export-users-data-csv",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41616",
    "auth_type": "Auth",
    "cvss_score": 6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Easy Elementor Addons \u003c= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48295",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seed Social \u003c= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "seed-social",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3836",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IFrame Widget \u003c= 4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "iframe-widget",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30939",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Smart Links \u003c= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "seo-automatic-links",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3135",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MP3 Audio Player – Music Player, Podcast Player \u0026 Radio by Sonaar \u003c= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "mp3-music-player-by-sonaar",
    "type": "plugin",
    "affected_version": "* - 5.7.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7856",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "RSVPMaker Volunteer Roles \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "rsvpmaker-volunteer-roles",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23531",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IP Blocker Lite \u003c= 11.1.1 - IP Spoofing",
    "slug": "ip-address-blocker",
    "type": "plugin",
    "affected_version": "* - 11.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30479",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Business Directory \u003c= 1.0.2 - Cross-Site Scripting",
    "slug": "wp-ttisbdir",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Custom Checkout Fields Editor With Drag \u0026 Drop \u003c= 0.1 - Reflected Cross-Site Scripting via 'tab'",
    "slug": "woo-custom-checkout-fields",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46864",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ICDSoft Reseller Store \u003c= 2.4.5 - Reflected Cross-Site Scripting",
    "slug": "icdsoft-reseller-store",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Envo's Elementor Templates \u0026 Widgets for WooCommerce \u003c= 1.4.4 - Missing Authorization via templates_ajax_request",
    "slug": "envo-elementor-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0766",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13184",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "OAuth client Single Sign On for WordPress ( OAuth 2.0 SSO ) \u003c= 3.0.3 - Missing Authorization",
    "slug": "oauth-client-for-user-authentication",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3119",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "RD Station \u003c= 5.2.0 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "integracao-rd-station",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38139",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EduAdmin Booking \u003c= 5.2.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "eduadmin-booking",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54373",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hestia Nginx Cache \u003c= 2.4.0 - Missing Authorization",
    "slug": "hestia-nginx-cache",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56236",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Vchasno Kasa \u003c= 1.0.3 - Unauthenticated Log File Clearing",
    "slug": "mrkv-vchasno-kasa",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6720",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Edit Menu \u003c 1.5.0 - Missing Authorization to Post Deletion",
    "slug": "wp-edit-menu",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-2276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2276",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Hospital Management System \u003c= 47.0(20-11-2023) - Authenticated (Subscriber+) SQL Injection",
    "slug": "hospital-management",
    "type": "plugin",
    "affected_version": "[*, 47.0(20-11-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "47.0(20-11-2023)",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39357",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Don't Muck My Markup \u003c= 1.8 - Cross-Site Request Forgery",
    "slug": "dont-muck-my-markup",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23510",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Reservation.Studio widget \u003c= 1.0.11 - Cross-Site Request Forgery via plugin settings",
    "slug": "reservation-studio-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25468",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Login Configurator \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "login-configurator",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1893",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aklamator INfeed \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "aklamator-infeed",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12731",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP BaiDu Submit \u003c= 1.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-baidu-submit",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25796",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "th23 Social \u003c= 1.2.0 - Stored Cross-Site Scripting",
    "slug": "th23-social",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1062",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ChatBot \u003c= 4.3.0 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47613",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SMTP 1.2 - 1.2.6 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-smtp",
    "type": "plugin",
    "affected_version": "1.2 - 1.2.6",
    "from_version": "1.2",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1789",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Types \u003c= 3.4.17 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "types",
    "type": "plugin",
    "affected_version": "* - 3.4.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-27440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27440",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Porto \u003c= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta",
    "slug": "porto",
    "type": "theme",
    "affected_version": "* - 7.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3807",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Landing Page Builder \u003c= 1.5.1.5 - Open Redirect",
    "slug": "page-builder-add",
    "type": "plugin",
    "affected_version": "* - 1.5.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48325",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Morkva UA Shipping \u003c= 1.0.18 - Unauthenticated Local File Inclusion",
    "slug": "morkva-ua-shipping",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-24685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24685",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Prayer \u003c= 2.0.9 - Cross-Site Request Forgery to Arbitrary Prayer Deletion",
    "slug": "wp-prayer",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3407",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bulk Creator \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "bulk-creator",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0647",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Admin by DynamiApps Plugin \u003c= 3.18.3 - Unauthenticated Arbitrary File Upload",
    "slug": "acf-frontend-form-element",
    "type": "plugin",
    "affected_version": "* - 3.18.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51411",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty \u003c= 3.3.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "chaty",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1450",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Extended \u003c= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4963",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Events Calendar Plugin \u003c= 1.0 - SQL Injection",
    "slug": "events",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-5315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5315",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Blocks – WordPress Blocks Plugin \u003c= 3.0.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via metabox",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6692",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gravitate Automated Tester \u003c= 1.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gravitate-automated-tester",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58645",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Greek Namedays Widget From Eortologio.Net \u003c= 20191113 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "greek-namedays-widget",
    "type": "plugin",
    "affected_version": "* - 20191113",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20191113",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23783",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Invoices for WooCommerce + Drag and Drop Template Builder \u003c= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdf-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24755",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Private Content  \u003c= 8.11.5 - Missing Authorization",
    "slug": "private-content",
    "type": "plugin",
    "affected_version": "* - 8.11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.11.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26969",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Wp Ultimate Review \u003c= 2.3.6 - IP Spoofing",
    "slug": "wp-ultimate-review",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-21746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-21746",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TWChat – Send or receive messages from users \u003c= 4.0.4 - Reflected Cross-Site Scripting",
    "slug": "twchat",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11374",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Admin-Bar Favorites \u003c= 0.1 - Reflected Cross-Site Scripting",
    "slug": "admin-bookmarks",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3868",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xpro Elementor Addons \u003c= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32163",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OSM Map Widget for Elementor \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "osm-map-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4663",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TC Custom JavaScript \u003c= 1.2.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "tc-custom-javascript",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-14063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-14063",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1012",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1012",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1456",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Taggbox \u003c= 3.1 - Cross-Site Request Forgery",
    "slug": "taggbox-widget",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33214",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Login And Signup Widget \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "custom-login-and-signup-widget",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9887",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Element Condition \u003c= 1.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "ele-conditions",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58796",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Betheme | Responsive Multipurpose WordPress \u0026 WooCommerce Theme \u003c= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 27.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "27.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3998",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates",
    "slug": "beyot-framework",
    "type": "plugin",
    "affected_version": "* - 6.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13420",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates",
    "slug": "benaa-framework",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13420",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates",
    "slug": "g5plus-auteur",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13420",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Framework \u003c= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates",
    "slug": "april-framework",
    "type": "plugin",
    "affected_version": "* - 5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13420",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post to Pdf \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-to-pdf",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12446",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeproDev Ultimate Invoice \u003c= 1.9.7 - Unauthenticated Sensitive Information Exposure via init_plugin",
    "slug": "pepro-ultimate-invoice",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-25933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25933",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SocialMark \u003c= 2.0.7 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "socialmark",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29008",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate WP Mail \u003c= 1.3.9 - Open Redirect",
    "slug": "ultimate-wp-mail",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32694",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEOPress 5.0.0 - 5.0.3 - Stored Cross-Site Scripting",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "5.0.0",
    "from_version": "5.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34641",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEOPress 5.0.0 - 5.0.3 - Stored Cross-Site Scripting",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "5.0.1",
    "from_version": "5.0.1",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34641",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEOPress 5.0.0 - 5.0.3 - Stored Cross-Site Scripting",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "5.0.2",
    "from_version": "5.0.2",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34641",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEOPress 5.0.0 - 5.0.3 - Stored Cross-Site Scripting",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "5.0.3",
    "from_version": "5.0.3",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34641",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Map Professional \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "google-map-professional",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13220",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDataTables (Premium) \u003c= 3.4.1 - Blind SQL Injection via length Parameter",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "[*, 3.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24200",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1161",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Author \u003c= 1.1.1 - Cross-Site Request Forgery",
    "slug": "post-author",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28950",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gift Message for WooCommerce \u003c= 1.7.8 - Cross-Site Request Forgery",
    "slug": "gift-message-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30923",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Catalog Feed by PixelYourSite \u003c= 2.1.1 - Cross-Site Request Forgery",
    "slug": "product-catalog-feed",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49824",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Coupons \u0026amp; Add to Cart by URL Links for WooCommerce \u003c= 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "url-coupons-for-woocommerce-by-algoritmika",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48250",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetElements For Elementor \u003c= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-55714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-55714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stock Locations for WooCommerce \u003c= 2.5.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "stock-locations-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22153",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recently \u003c= 3.0.4 - Arbitrary File Upload to Remote Code Exectution",
    "slug": "recently",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4382",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Soledad \u003c= 8.4.5 - Cross-Site Request Forgery",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31369",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Plugin LBstopattack \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "lbstopattack",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3097",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Better Emails \u003c= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-better-emails",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22679",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_option_id",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4157",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_option_id",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4157",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Booking System Free version \u003c 1.5.2 - Cross-Site Request Forgery",
    "slug": "wp-booking-system",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-12239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12239",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Better Search \u003c= 2.5.2 - Cross-Site Request Forgery to Settings Import",
    "slug": "better-search",
    "type": "plugin",
    "affected_version": "[*, 2.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4373",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Activity-o-meter \u003c= 1 - Reflected Cross-Site Scripting",
    "slug": "wordpress-activity-o-meter",
    "type": "plugin",
    "affected_version": "* - 1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13668",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "vCita Online Booking \u0026 Scheduling Calendar \u003c= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35761",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radio Player Shoutcast \u0026 Icecast \u003c= 4.4.7 - Reflected Cross-Site Scripting",
    "slug": "lbg-audio4-html5-shoutcast",
    "type": "plugin",
    "affected_version": "* - 4.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53205",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YaySMTP \u003c= 2.6.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "yaysmtp",
    "type": "plugin",
    "affected_version": "* - 2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53256",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Taggbox \u003c= 3.1 - Unauthenticated PHP Object Injection",
    "slug": "taggbox-widget",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-52225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52225",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Pre-Orders \u003c= 2.0.2 - Cross-Site Request Forgery to Order Cancellation",
    "slug": "woocommerce-pre-orders",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3507",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Hover Effects Plugin - Caption Hover with Carousel \u003c= 2.8 - Unauthenticated Stored Cross Site Scripting",
    "slug": "image-hover-effects-with-carousel",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45831",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print My Blog – Print, PDF, \u0026 eBook Converter WordPress Plugin \u003c= 3.26.2 - Missing Authorization",
    "slug": "print-my-blog",
    "type": "plugin",
    "affected_version": "* - 3.26.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.26.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33907",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Bookings Calendar \u003c= 1.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woo-bookings-calendar",
    "type": "plugin",
    "affected_version": "* - 1.0.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31117",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LifterLMS \u003c= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "* - 7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-6160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6160",
    "auth_type": "Privileged",
    "cvss_score": 3.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L"
  },
  {
    "title": "BestWebSoft's Twitter \u003c= 1.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "twitter-plugin",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-125103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-125103",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.121 - Reflected Cross-Site Scripting",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.121",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.121",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45454",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery for Social Photo \u003c= 1.0.0.35 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "feed-instagram-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.0.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26742",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.4.0 - Reflected Cross-Site Scripting",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4180",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login Configurator \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "login-configurator",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34175",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sabre \u003c 1.2.2 - Cross-Site Scripting",
    "slug": "sabre",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-2916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2916",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.99 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.99",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.99",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8444",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinpoint Booking System \u003c= 2.9.9.4.0 - Cross-Site Request Forgery via initBackEndAJAX",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "* - 2.9.9.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45270",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Structured Content (JSON-LD) #wpsc \u003c= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode",
    "slug": "structured-content",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0512",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MindValley Super PageMash \u003c= 1.1 - Authenticated (Editor+) SQL Injection",
    "slug": "mindvalley-pagemash",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22502",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Stratum – Elementor Widgets \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "stratum",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5611",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cool Author Box \u003c= 3.0.0 - Cross-Site Request Forgery",
    "slug": "hm-cool-author-box-widget",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47447",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newsletter \u003c= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "* - 7.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4772",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Solidres \u003c= 0.9.4 - Reflected Cross-Site Scripting",
    "slug": "solidres",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1377",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Limit for WooCommerce \u003c= 2.0.0 - Missing Authorization",
    "slug": "wc-order-limit-lite",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32675",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Support SVG – Upload svg files in wordpress without hassle \u003c= 1.1.0 -  Authenticated (Author+) Stored Cross-site Scripting via SVG File Upload",
    "slug": "support-svg",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11091",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ViewMedica Embed \u003c= 1.4.15 - Cross-Site Request Forgery to SQL Injection",
    "slug": "viewmedica",
    "type": "plugin",
    "affected_version": "* - 1.4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12170",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Image Map Pro \u003c= 5.5.0 - Cross-Site Request Forgery",
    "slug": "image-map-pro",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45850",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "imEvent \u003c= 3.4.0 - Missing Authorization",
    "slug": "imevent",
    "type": "theme",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58243",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Simple WP Events \u003c= 1.8.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-wp-events",
    "type": "plugin",
    "affected_version": "* - 1.8.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32193",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DirectoryPress \u003c= 3.6.2 - Missing Authorization",
    "slug": "directorypress",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-37967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37967",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Content Copy Protection \u0026 No Right Click \u003c= 3.5.9 - Cross-Site Request Forgery",
    "slug": "wp-content-copy-protector",
    "type": "plugin",
    "affected_version": "* - 3.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49306",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Donation Forms by Charitable \u003c= 1.7.0.12 - Unauthenticated Privilege Escalation",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "* - 1.7.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-4404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4404",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ajax Domain Checker \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ajax-domain-checker",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47810",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Idealien Category Enhancements \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "idealien-category-enhancements",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53734",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Media Hygiene \u003c= 4.0.1 - Missing Authorization",
    "slug": "media-hygiene",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49979",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tutor LMS – eLearning and online course solution \u003c= 2.6.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1751",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GetResponse \u003c= 5.5.19 - Cross-Site Request Forgery",
    "slug": "getresponse-integration",
    "type": "plugin",
    "affected_version": "* - 5.5.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-35277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-35277",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Black Widgets For Elementor \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "black-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51662",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom WooCommerce Checkout Fields Editor \u003c= 1.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "add-fields-to-checkout-page-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1697",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PlugVersions – Easily rollback to previous versions of your plugins \u003c= 0.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation",
    "slug": "plugversions",
    "type": "plugin",
    "affected_version": "* - 0.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12881",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "uListing \u003c= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4341",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Comments Like Dislike \u003c= 1.2.2 - IP Spoofing",
    "slug": "comments-like-dislike",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25906",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Move Addons for Elementor \u003c= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "move-addons",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2131",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 1.9.6 - Open Redirect",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24406",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom CSS Pro \u003c= 1.0.3 - Cross-site Request Forgery",
    "slug": "custom-css-pro",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-5984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5984",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Uploading SVG, WEBP and ICO files \u003c= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "uploading-svgwebp-and-ico-files",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4460",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AMP for WP – Accelerated Mobile Pages \u003c= 1.0.77.31 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "accelerated-mobile-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.77.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.77.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-23150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-23150",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Masteriyo LMS – eLearning and Online Course Builder for WordPress \u003c= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation",
    "slug": "learning-management-system",
    "type": "plugin",
    "affected_version": "* - 1.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10008",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wProject \u003c 5.8.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wproject",
    "type": "theme",
    "affected_version": "[*, 5.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-39366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39366",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Master Slider Pro \u003c= 3.6.5 - Unauthenticated PHP Object Injection",
    "slug": "masterslider",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-47507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47507",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booking Calendar Contact Form \u003c 1.0.24 - Blind SQL Injection",
    "slug": "booking-calendar-contact-form",
    "type": "plugin",
    "affected_version": "[*, 1.0.24)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.24",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10909",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Posts in Page \u003c= 1.2.4 - Authenticated Directory Traversal leading to Local File Inclusion",
    "slug": "posts-in-page",
    "type": "plugin",
    "affected_version": "[*, 1.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18585",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Giveaways and Contests by RafflePress \u003c= 1.12.17 - Missing Authorization",
    "slug": "rafflepress",
    "type": "plugin",
    "affected_version": "* - 1.12.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49997",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP eStore \u003c= 8.5.4 - Cross-Site Request Forgery to Coupon Deletion",
    "slug": "wp-cart-for-digital-products",
    "type": "plugin",
    "affected_version": "* - 8.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6075",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MStore API – Create Native Android \u0026 iOS Apps On The Cloud \u003c= 4.15.3 - Unauthorized User Registration",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.15.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8269",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP JobSearch \u003c= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8614",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "PSW Front-end Login \u0026 Registration \u003c= 1.12 - Authentication Bypass",
    "slug": "psw-login-and-registration",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47646",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easing Slider \u003c= 2.2.0.6 - Cross-Site Scripting",
    "slug": "easing-slider",
    "type": "plugin",
    "affected_version": "[*, 2.2.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-1436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1436",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Evergreen Content Poster \u003c= 1.4.2 - Missing Authorization",
    "slug": "evergreen-content-poster",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32824",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Member Subscriptions \u003c= 2.15.9 - Missing Authorization",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.15.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58600",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EAN for WooCommerce \u003c= 5.3.5 - Missing Authorization",
    "slug": "ean-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22673",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hero Maps Premium - Customizable Google Maps Plugin \u003c= 2.3.9 - Authenticated (Subscriber+) SQL Injection",
    "slug": "hmapsprem",
    "type": "plugin",
    "affected_version": "* - 2.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13781",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BackupBuddy 8.5.8.0 - 8.7.4.1 - Arbitrary File Download",
    "slug": "backupbuddy",
    "type": "plugin",
    "affected_version": "8.5.8.0 - 8.7.4.1",
    "from_version": "8.5.8.0",
    "from_inclusive": true,
    "to_version": "8.7.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-31474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-31474",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Apa Banner Slider \u003c= 1.0.0 - Cross-Site Request Forgery to SLQ Injection",
    "slug": "apa-banner-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49622",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Comments On Feed \u003c= 1.2.1 - Reflected Cross-Site Scripting",
    "slug": "comments-on-feed",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54406",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \u003c= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload",
    "slug": "post-and-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.26.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6848",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Code Snippets \u003c= 2.14.2 - Reflected Cross-Site Scripting",
    "slug": "code-snippets",
    "type": "plugin",
    "affected_version": "[*, 2.14.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25008",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mapa Politico España \u003c 3.7.0 - Stored Cross-Site Scripting",
    "slug": "wp-mapa-politico-spain",
    "type": "plugin",
    "affected_version": "[*, 3.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24609",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Page With Google Map \u003c= 1.6.1 - Unauthenticated Arbitrary File Deletion",
    "slug": "contact-page-with-google-map",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52447",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Like in Vk.com \u003c= 0.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "like-on-vkontakte",
    "type": "plugin",
    "affected_version": "* - 0.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54424",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPress \u003c= 11.0.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Media URL",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "[*, 11.0.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4820",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stepbyteservice-openstreetmap",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30450",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit File Manager \u003c= 5.2.7 - Authenticated (Admin+) PHP Object Injection",
    "slug": "file-manager",
    "type": "plugin",
    "affected_version": "* - 5.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47599",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LTL Freight Quotes – Day \u0026 Ross Edition \u003c= 2.1.11 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "ltl-freight-quotes-day-ross-edition",
    "type": "plugin",
    "affected_version": "* - 2.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58642",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Media Cleaner: Clean your WordPress! \u003c= 6.7.2 - Unauthenticated Information Exposure",
    "slug": "media-cleaner",
    "type": "plugin",
    "affected_version": "* - 6.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33922",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Compress – Image Optimizer [All-In-One] \u003c= 6.10.33 - Unauthenticated Directory Traversal via css",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.10.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10.33",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6699",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "TheGem \u003c 5.8.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "thegem",
    "type": "theme",
    "affected_version": "[*, 5.8.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-32237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32237",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Password Reset with Code \u003c= 0.0.16 - Unauthenticated Privilege Escalation via Weak OTP Codes",
    "slug": "bdvs-password-reset",
    "type": "plugin",
    "affected_version": "* - 0.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5305",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hotel Booking \u003c= 3.7 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "nd-booking",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53259",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Builder: Pagelayer \u003c= 1.8.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8618",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bad Behavior \u003c 2.0.47 \u0026 2.2.0 - 2.2.4 - Cross-Site Scripting",
    "slug": "bad-behavior",
    "type": "plugin",
    "affected_version": "[*, 2.0.47)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.47",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-4271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4271",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bad Behavior \u003c 2.0.47 \u0026 2.2.0 - 2.2.4 - Cross-Site Scripting",
    "slug": "bad-behavior",
    "type": "plugin",
    "affected_version": "[2.2.0, 2.2.5)",
    "from_version": "2.2.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-4271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4271",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spreadr Woocommerce \u003c= 1.0.4 - Missing Authorization to Arbitrary Content Deletion",
    "slug": "spreadr-for-woocomerce",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56008",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Classifieds Plugin – Ad Directory \u0026 Listings by AWP Classifieds \u003c 2.0 - Arbitrary File Upload",
    "slug": "another-wordpress-classifieds-plugin",
    "type": "plugin",
    "affected_version": "[*, 2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-4874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4874",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GTranslate \u003c= 3.0.3 - Authenticated (Administrator+) Cross-Site Scripting via Multiple Parameters",
    "slug": "gtranslate",
    "type": "plugin",
    "affected_version": "[*, 3.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4502",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Posts by Zemanta \u003c= 1.3.1 - Cross-Site Request Forgery",
    "slug": "related-posts-by-zemanta",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-3477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3477",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Directory Kit \u003c= 1.2.3 - Reflected Cross-Site Scripting via 'search'",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2835",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UltraAddons \u003c= 2.0.0 - Cross-Site Request Forgery",
    "slug": "ultraaddons-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32264",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JH 404 Logger \u003c= 1.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "jh-404-logger",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24176",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wBounce \u003c= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wbounce",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31451",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PIMP - Creative MultiPurpose \u003c= 1.7 - Unauthenticated PHP Object Injection",
    "slug": "pimp",
    "type": "theme",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31398",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yes/No Chart \u003c 1.0.12 - Authenticated SQL Injection",
    "slug": "yesno",
    "type": "plugin",
    "affected_version": "[*, 1.0.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24360",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Widget Options – The #1 WordPress Widget \u0026 Block Control Plugin \u003c= 4.0.7 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "widget-options",
    "type": "plugin",
    "affected_version": "* - 4.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8672",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "User Password Reset \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "user-password-reset",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51714",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EZ SQL Reports Shortcode Widget and DB Backup \u003c= 5.25.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via SQLREPORT Shortcode",
    "slug": "elisqlreports",
    "type": "plugin",
    "affected_version": "* - 5.25.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.25.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6462",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Translate This gTranslate Shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "translate-this-google-translate-web-element-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58880",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9867",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OWM Weather \u003c= 5.6.11 - Cross-Site Request Forgery",
    "slug": "owm-weather",
    "type": "plugin",
    "affected_version": "* - 5.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47179",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PDF Generator for Wordpress \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "pdf-generator-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4321",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto iFrame \u003c= 1.7 - Authenticated (Author+) Stored Cross-Site Scripting via tag Parameter",
    "slug": "auto-iframe",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9449",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rank Math SEO with AI Best SEO Tools \u003c= 1.0.218 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.218",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.218",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4617",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget Bundle \u003c= 2.0.0 - Cross-Site Request Forgery to Widget Disable/Enable",
    "slug": "wp-widget-bundle",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4969",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FlatNews \u003c= 5.8 - Reflected Cross-Site Scripting",
    "slug": "flatnews",
    "type": "theme",
    "affected_version": "* - 5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32305",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FooGallery \u003c= 2.2.35 - Reflected Cross-Site Scripting",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 2.2.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29439",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram Email Subscribers \u0026 Newsletters \u003c= 4.5.0 - Authenticated SQL Injection",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "[*, 4.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-5768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5768",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Backuply – Backup, Restore, Migrate and Clone \u003c= 1.2.3 - Authenticated (Administrator+) Directory Traversal",
    "slug": "backuply",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0697",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \u003c= 2.0.5.9 - Contributor+ Stored Cross-Site Scripting",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4265",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Roadmap \u003c= 2.1.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-roadmap",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52822",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Himer \u003c= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "himer",
    "type": "theme",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2234",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Widget Creator \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "custom-widget-creator",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23750",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Subtitle \u003c= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-subtitle",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57986",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chessgame Shizzle \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "chessgame-shizzle",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11446",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Loginizer \u003c= 1.7.5 - Reflected Cross-Site Scripting via 'name'",
    "slug": "loginizer",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45084",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager \u003c= 4.71 - Authenticated (Author+) SQL Injeciton",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.71",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32551",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H"
  },
  {
    "title": "Intuitive Custom Post Order \u003c= 3.1.4.1 - Authenticated (Admin+) SQL Injection",
    "slug": "intuitive-custom-post-order",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1016",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PowerPack Pro for Elementor \u003c= 2.10.6 - Missing Authorization to Settings Reset",
    "slug": "powerpack-elements",
    "type": "plugin",
    "affected_version": "* - 2.10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-24844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24844",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "cSlider \u003c= 2.4.2 - Cross-Site Request Forgery",
    "slug": "cslider",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget",
    "slug": "essential-addons-elementor",
    "type": "plugin",
    "affected_version": "* - 5.8.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5086",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FiboSearch - AJAX Search for WooCommerce \u003c= 1.23.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ajax-search-for-woocommerce",
    "type": "plugin",
    "affected_version": "1.23.0",
    "from_version": "1.23.0",
    "from_inclusive": true,
    "to_version": "1.23.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2450",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP AdCenter – Ad Manager \u0026 Adsense Ads \u003c= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_alignment Attribute",
    "slug": "wpadcenter",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8317",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SM CountDown Widget \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smcountdown",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11880",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Block Collection for You – WP Block Pack \u003c= 1.1.6 - Reflected Cross-Site Scripting",
    "slug": "wp-block-pack",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23874",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tourfic \u003c= 2.11.20 - Cross-Site Request Forgery in Multiple Functions",
    "slug": "tourfic",
    "type": "plugin",
    "affected_version": "* - 2.11.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8319",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Evenium \u003c= 1.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "evenium",
    "type": "plugin",
    "affected_version": "* - 1.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9850",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.1 - 6.1.6",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.2 - 6.2.5",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.3 - 6.3.4",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.4 - 6.4.4",
    "from_version": "6.4",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.5 - 6.5.4",
    "from_version": "6.5",
    "from_inclusive": true,
    "to_version": "6.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.9",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.8",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Virtual Robots.txt \u003c 1.10 - Authenticated Stored Cross-Site Scripting",
    "slug": "virtual-robotstxt-littlebizzy",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-28121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-28121",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clean Retina \u003c= 3.0.6 - Unauthenticated Local File Inclusion",
    "slug": "clean-retina",
    "type": "theme",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50436",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.59 - Insufficient Access Control to Import Deletion",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4703",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Download Monitor \u003c 3.3.6.2 - Cross-Site Scripting via p Parameter",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "[*, 3.3.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-3262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3262",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 6.0.0.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 6.0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-39643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39643",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WOO Codice Fiscale \u003c= 1.6.3 - Reflected Cross-Site Scripting",
    "slug": "woo-codice-fiscale",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27275",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blox Page Builder \u003c= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "blox-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.65",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6315",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP 2FA – Two-factor authentication for WordPress \u003c= 2.6.2 - Reflected Cross-Site Scripting",
    "slug": "wp-2fa",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32568",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Portfolio Builder \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "portfolio-builder-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52486",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LottieFiles – JSON Based Animation Lottie \u0026 Bodymovin for Elementor \u003c= 1.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "include-lottie-animation-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.10.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5060",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS Aggregator by Feedzy \u003c= 4.4.2 - Authenticated(Contributor+) SQL Injection",
    "slug": "feedzy-rss-feeds",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "News Magazine X \u003c= 1.2.37 - Unauthenticated Local File Inclusion",
    "slug": "news-magazine-x",
    "type": "theme",
    "affected_version": "* - 1.2.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24766",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP SendFox \u003c= 1.3.1 - Unauthenticated Information Disclosure",
    "slug": "wp-sendfox",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49284",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Project Manager \u003c= 2.4.13 - Authenticated Stored Cross-Site Scripting",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.4.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36826",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.112",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.112",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13869",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Import Export Lite \u003c= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-import-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.9.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.29",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5061",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Download PDF \u0026 Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin \u003c= 1.9.3 - Cross-Site Scripting",
    "slug": "pdf-print",
    "type": "plugin",
    "affected_version": "[*, 1.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18528",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Evaluate \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "evaluate",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3753",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Social Widget \u003c= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-social-widget",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0074",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BP Email Assign Templates \u003c= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bp-email-assign-templates",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28875",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Super Cache \u003c= 1.2 - Remote Code Execution",
    "slug": "wp-super-cache",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-2009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2009",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.971",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.971",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3675",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Widgets \u003c= 1.5.10 - Cross-Site Scripting",
    "slug": "dynamic-widgets",
    "type": "plugin",
    "affected_version": "[*, 1.5.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9436",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pondol Carousel \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "pondol-carousel",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000145",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel Gutenberg Blocks \u003c= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-travel-blocks",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43284",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VK Block Patterns \u003c= 1.31.0 - Missing Authorization",
    "slug": "vk-block-patterns",
    "type": "plugin",
    "affected_version": "* - 1.31.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32826",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Field Suite \u003c= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "custom-field-suite",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0689",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UserPlus \u003c= 2.0 - Missing Authorization via Multiple Functions",
    "slug": "userplus",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9520",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "IP Based Login \u003c= 2.4.0 - Cross-Site Request forgery to Log Deletion",
    "slug": "ip-based-login",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13118",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Infinite Scroll – Ajax Load More \u003c= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 7.4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4775",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Himer - Social Questions and Answers \u003c= 2.1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "himer",
    "type": "theme",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2231",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1327",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newspaper - News \u0026 WooCommerce WordPress Theme \u003c 6.7.2 - Cross-Site Scripting",
    "slug": "Newspaper",
    "type": "theme",
    "affected_version": "[*, 6.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18634",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GDPR/CCPA Cookie Consent Banner \u003c= 3.2 - Missing Authorization via handle_consent_toggle()",
    "slug": "uk-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35692",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Classified Listing \u003c= 5.0.6 - Missing Authorization",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 5.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58601",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MasterBip para Elementor \u003c= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "masterbip-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51571",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Member \u003c= 7.4 - Authenticated (Editor+) Local File Inclusion",
    "slug": "team-showcase-supreme",
    "type": "plugin",
    "affected_version": "* - 7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52385",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Magee Shortcodes \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magee-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4783",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Asgaros Forum \u003c= 1.15.12 - Unauthenticated SQL Injection",
    "slug": "asgaros-forum",
    "type": "plugin",
    "affected_version": "* - 1.15.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24827",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pretty Google Calendar \u003c= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pretty-google-calendar",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33640",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup addon for Ninja Forms \u003c= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "popup-addon-for-ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53279",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TeraWallet – For WooCommerce \u003c= 1.3.24 - Cross-Site Request Forgery via admin_options",
    "slug": "woo-wallet",
    "type": "plugin",
    "affected_version": "* - 1.3.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40198",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ARForms \u003c= 1.5.8 - Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_url",
    "slug": "arforms-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6828",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.9.25 - Authenticated (Administrator+) SQL Injection",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "* - 3.9.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24663",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce – Store Exporter \u003c= 1.8.3 - Missing Authorization",
    "slug": "woocommerce-exporter",
    "type": "plugin",
    "affected_version": "[*, 1.8.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10935",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Mobile-Friendly Tooltip \u003c= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-mobile-friendly-tooltip",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48316",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPshop 2 – E-Commerce \u003c 1.3.9.6 - Arbitrary File Upload",
    "slug": "wpshop",
    "type": "plugin",
    "affected_version": "[*, 1.3.9.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-10135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10135",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress File Upload \u003c= 2.4.6 - Arbitrary File Upload",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9338",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Visitor Counter \u003c= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "the-visitor-counter",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31449",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 3.0.1 - Cross-Site Request Forgery",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3215",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Payeezy Pay \u003c 2.98 - Local File Inclusion",
    "slug": "wp-payeezy-pay",
    "type": "plugin",
    "affected_version": "[*, 2.98)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.98",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-20985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20985",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premmerce Product Filter for WooCommerce \u003c= 3.7.2 - Missing Authorization",
    "slug": "premmerce-woocommerce-product-filter",
    "type": "plugin",
    "affected_version": "* - 3.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31359",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Helper Premium \u003c 4.6.0 - Reflected Cross-Site Scripting",
    "slug": "wp-helper-lite",
    "type": "plugin",
    "affected_version": "[*, 4.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-32595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32595",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Social Share Buttons for Whatsapp and Viber \u003c 1.1 - Cross-Site Request Forgery",
    "slug": "add-social-share-buttons",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-11632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11632",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Leyka \u003c= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "* - 3.30.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.30.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4917",
    "auth_type": "Auth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "UsersWP \u003c= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "userswp",
    "type": "plugin",
    "affected_version": "* - 1.2.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9344",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Serious Slider \u003c= 1.2.4 - Cross-Site Request Forgery",
    "slug": "cryout-serious-slider",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33650",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Demo Awesome \u003c= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation",
    "slug": "demo-awesome",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13637",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Bookster – WordPress Appointment Booking Plugin \u003c= 1.1.0 - Unauthenticated Appointment Manipulation",
    "slug": "bookster",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5071",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 1.6.6 - Unauthenticated SQL Injection",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4340",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Pack Elementor addons (Header Footer \u0026 WooCommerce Builder, Template Library) \u003c= 2.0.8.2 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "the-pack-addon",
    "type": "plugin",
    "affected_version": "* - 2.0.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gift Up Gift Cards for WordPress and WooCommerce \u003c= 2.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gift-up",
    "type": "plugin",
    "affected_version": "* - 2.20.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FoodBakery | Delivery Restaurant Directory WordPress Theme \u003c= 4.7 - Missing Authorization in Multiple Functions",
    "slug": "wp-foodbakery",
    "type": "theme",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12920",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JetMenu \u003c= 2.4.11.1 - Authenticated (Subscriber+) Information Exposure",
    "slug": "jet-menu",
    "type": "plugin",
    "affected_version": "* - 2.4.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53987",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Financio \u003c= 1.1.3 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "financio",
    "type": "theme",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33690",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Portfolio Manager Pro  3.8 - Unauthenticated Arbitrary File Upload",
    "slug": "otw-portfolio-manager",
    "type": "plugin",
    "affected_version": "3.8",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49410",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modernize \u003c= 3.4.0 - Missing Authorization",
    "slug": "modernize",
    "type": "theme",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53343",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.59 - Insufficient Access Control to Template Kit Import",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4709",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Processing Projects \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "processing-projects",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31624",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscribers Text Counter \u003c= 1.7 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting",
    "slug": "subscribers-text-counter",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3356",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mmm Unity Loader \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributes Parameter",
    "slug": "mmm-unity-loader",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8399",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extensions for Elementor \u003c= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter",
    "slug": "extensions-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5666",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Random Text \u003c= 0.3.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "randomtext",
    "type": "plugin",
    "affected_version": "* - 0.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0388",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Simple Social Media Share Buttons \u003c= 3.2.2 - Contributor+ Stored Cross-Site Scripting",
    "slug": "simple-social-buttons",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24486",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Virtual Room Configurator \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "configure-conference-room",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51907",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Eggdrop \u003c= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-eggdrop",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2968",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Administrator Z \u003c= 2024.10.14 - Authenticated (Subscriber+) SQL Injection",
    "slug": "administrator-z",
    "type": "plugin",
    "affected_version": "* - 2024.10.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.10.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50524",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan \u003c= 4.51 - Missing Authorization to Unauthenticated IP Address Whitelist",
    "slug": "antihacker",
    "type": "plugin",
    "affected_version": "* - 4.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1860",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple Booking Calendar \u003c= 2.0.13 - Missing Authorization",
    "slug": "wp-simple-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 2.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39541",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "miniOrange's Google Authenticator \u003c= 5.6.1 - Missing Authorization to Plugin Settings Change",
    "slug": "miniorange-2-factor-authentication",
    "type": "plugin",
    "affected_version": "* - 5.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-42461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42461",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Advanced File Manager \u003c= 5.1 - Authenticated (Administrator+) Arbitrary File and Folder Access",
    "slug": "file-manager-advanced",
    "type": "plugin",
    "affected_version": "* - 5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3814",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MailMunch – Grow your Email List \u003c= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mailmunch",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31349",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP jQuery Lightbox \u003c= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute",
    "slug": "wp-jquery-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5425",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InWave Jobs \u003c= 3.5.1 - Unauthenticated Privilege Escalation via Password Reset",
    "slug": "iwjob",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1315",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Indeed Membership Pro \u003c= 12.7 - Unauthenticated Privilege Escalation",
    "slug": "indeed-membership-pro",
    "type": "plugin",
    "affected_version": "* - 12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43240",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Memberful \u003c= 1.75.0 - Missing Authorization",
    "slug": "memberful-wp",
    "type": "plugin",
    "affected_version": "* - 1.75.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.75.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58000",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Coupons \u003c= 1.7.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "affiliate-coupons",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26957",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Error Monitoring by Bugsnag \u003c= 1.6.3 - Cross-Site Request Forgery",
    "slug": "bugsnag",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58806",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AnyClip Luminous Studio \u003c= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "anyclip-media",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58271",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comment Approved Notifier Extended \u003c= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "comment-approved-notifier-extended",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30792",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NGG Smart Image Search \u003c= 3.4.1 - Unauthenticated SQL Injection",
    "slug": "ngg-smart-image-search",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52832",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "LiveChat \u003c= 4.5.15 - Cross-Site Request Forgery",
    "slug": "wp-live-chat-software-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49821",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Members Membership Plugin \u003c= 3.4.9.5 - Reflected Cross-Site Scripting",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.4.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9231",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection via id Parameter",
    "slug": "wp-bannerize",
    "type": "plugin",
    "affected_version": "2.0.0 - 4.0.2",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39351",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CM On Demand Search And Replace \u003c= 1.3.0 - Cross-Site Request Forgery",
    "slug": "cm-on-demand-search-and-replace",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28749",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Material Design Iconic Font Integration \u003c= 2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "material-design-iconic-font-integration",
    "type": "plugin",
    "affected_version": "* - 2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11872",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Restriction WordPress (WP) – Protect WP Pages/Post \u003c= 1.3.4 - Protection Mechanism Bypass",
    "slug": "page-and-post-restriction",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0681",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Search engine keywords highlighter \u003c= 0.1.3 - Reflected Cross-Site Scripting",
    "slug": "keywords-highlight-tool",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31442",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PressForward \u003c= 5.9.1 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "pressforward",
    "type": "plugin",
    "affected_version": "* - 5.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28987",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xagio SEO \u003c= 7.1.0.16 - Unauthenticated Stored Cross-Site Scripting via 'HTTP_REFERER'",
    "slug": "xagio-seo",
    "type": "plugin",
    "affected_version": "* - 7.1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3302",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Frequently Bought Together for WooCommerce \u003c= 7.0.3 - Missing Authorization",
    "slug": "woo-bought-together",
    "type": "plugin",
    "affected_version": "* - 7.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32687",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget _id attribute",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2539",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapPress Maps for WordPress \u003c= 2.94.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.94.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.94.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2055",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leopard - WordPress offload media \u003c= 2.0.36 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "leopard-wordpress-offload-media",
    "type": "plugin",
    "affected_version": "* - 2.0.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43257",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Colorbox Lightbox \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-colorbox",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49397",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ashe Extra \u003c= 1.2.92 - Missing Authorization",
    "slug": "ashe-extra",
    "type": "plugin",
    "affected_version": "* - 1.2.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.92",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56244",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Vertical scroll image slideshow gallery \u003c= 11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter",
    "slug": "vertical-scroll-image-slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5752",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stream \u003c= 3.9.2 - Cross-Site Request Forgery",
    "slug": "stream",
    "type": "plugin",
    "affected_version": "* - 3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43490",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "spideranalyse \u003c= 0.0.1 - Reflected Cross-Site Scripting",
    "slug": "spideranalyse",
    "type": "plugin",
    "affected_version": "* - 0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38350",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Psychological tests \u0026 quizzes \u003c= 0.21.19 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "wp-testing",
    "type": "plugin",
    "affected_version": "* - 0.21.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.21.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27854",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "meks-smart-social-widget",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0664",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event post \u003c= 5.9.5 - Unauthenticated Local File Inclusion",
    "slug": "event-post",
    "type": "plugin",
    "affected_version": "* - 5.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-38735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38735",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Recipe Maker For Your Food Blog from Zip Recipes \u003c= 8.0.7 - Cross-Site Request Forgery",
    "slug": "zip-recipes",
    "type": "plugin",
    "affected_version": "* - 8.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35089",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Delicious Recipes – WordPress Recipe Plugin \u003c= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "delicious-recipes",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43935",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonials Widget \u003c= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "testimonials-widget",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37553",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Support Plus Responsive Ticket System \u003c= 9.0.2 - SQL Injection",
    "slug": "wp-support-plus-responsive-ticket-system",
    "type": "plugin",
    "affected_version": "* - 9.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-1000131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000131",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SVG Case Study \u003c= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "case-study",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9850",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grand Tour | Travel Agency WordPress \u003c= 5.5.1 - Unauthenticated PHP Object Injection",
    "slug": "grandtour",
    "type": "theme",
    "affected_version": "* - 5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39485",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "String Locator \u003c= 2.6.5 - Reflected Cross-Site Scripting",
    "slug": "string-locator",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6987",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Addons for Elementor \u003c= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "8.0.0",
    "from_version": "8.0.0",
    "from_inclusive": true,
    "to_version": "8.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5944",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link Library \u003c= 7.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1559",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.14.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1408",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ziston \u003c 1.4.5 - Unauthenticated Local File Inclusion",
    "slug": "ziston",
    "type": "theme",
    "affected_version": "[*, 1.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-58215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58215",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Rights Access Manager \u003c= 1.1.2 - Missing Authorization",
    "slug": "user-rights-access-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37209",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Export Import Menus \u003c= 1.8.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "export-import-menus",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-34385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34385",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Nexter \u003c= 2.0.3 - Missing Authorization",
    "slug": "nexter",
    "type": "theme",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45658",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Accordion \u003c= 2.2.29 - Reflected Cross-Site Scripting",
    "slug": "accordions",
    "type": "plugin",
    "affected_version": "[*, 2.2.30)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.30",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24283",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-35944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35944",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JobSearch \u003c= 2.3.4 - Authentication Bypass to Account Takeover",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43245",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6340",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link Whisper Free \u003c= 0.6.8 - Reflected Cross-Site Scripting",
    "slug": "link-whisper",
    "type": "plugin",
    "affected_version": "* - 0.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27992",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tainacan Interface \u003c= 2.7.2 - Reflected Cross-Site Scripting",
    "slug": "tainacan-interface",
    "type": "theme",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3867",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Boot Store \u003c= 1.6.4 - Reflected Cross-Site Scripting",
    "slug": "boot-store",
    "type": "theme",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-4582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4582",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mailster \u003c= 1.8.16.0 - Authenticated (Contributor+) SQL Injection via orderby",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.16.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-53807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53807",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.1.5 - Missing Authorization in ajaxCalculateSeveralProducts function",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40203",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.20.2 - Authenticated Arbitrary File Read",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.20.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-31475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-31475",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Permalink Manager Lite \u003c= 2.4.3 - Reflected Cross-Site Scripting",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29092",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mojoomla Hospital Management System for WordPress Theme \u003c 22-05-2018 - SQL Injection",
    "slug": "hospital-management",
    "type": "plugin",
    "affected_version": "[*, 08-03-2018]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "08-03-2018",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-14846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14846",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widget",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0376",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReviewX \u003c= 1.6.22 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "reviewx",
    "type": "plugin",
    "affected_version": "* - 1.6.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29812",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Find Your Nearest \u003c= 0.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-find-your-nearest",
    "type": "plugin",
    "affected_version": "* - 0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25161",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Display Medium Posts \u003c= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_medium_posts Shortcode",
    "slug": "display-medium-posts",
    "type": "plugin",
    "affected_version": "* - 5.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sinatra \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sinatra",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37116",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blogvy \u003c= 1.0.7 - Unauthenticated Local File Inclusion",
    "slug": "blogvy",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49279",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CoSchedule \u003c= 3.3.8 - Cross-Site Request Forgery",
    "slug": "coschedule-by-todaymade",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47165",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Avada (Fusion) Builder \u003c= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "fusion-builder",
    "type": "plugin",
    "affected_version": "* - 3.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3925",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Employee Directory \u003c= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter",
    "slug": "employee-directory",
    "type": "plugin",
    "affected_version": "* - 4.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8295",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles'",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4275",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar Contact Form \u003c= 1.2.40 - Reflected Cross-Site Scripting",
    "slug": "booking-calendar-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.2.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36384",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "turboSMTP \u003c= 4.6 - Reflected Cross-Site Scripting",
    "slug": "turbosmtp",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22753",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Srbtranslatin \u003c= 3.2.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "srbtranslatin",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31421",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Gallery Transforation \u003c 0.7 - SQL Injection",
    "slug": "wordpress-gallery-transformation",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002028",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WOOEXIM – WooCommerce Export Import Plugin \u003c= 5.0.0 - Reflected Cross-Site Scripting",
    "slug": "wooexim",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1288",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Last Viewed Posts by WPBeginner \u003c= 1.0.0 - Unauthenticated PHP Object Injection",
    "slug": "last-viewed-posts",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3070",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Puller \u003c= 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "product-puller",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23550",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Domain Redirect \u003c= 1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-domain-redirect",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24401",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI Power: Complete AI Pack \u003c= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "gpt3-ai-content-generator",
    "type": "plugin",
    "affected_version": "* - 1.8.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.96",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13360",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "VikRentCar Car Rental Management System \u003c 1.1.10 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "vikrentcar",
    "type": "plugin",
    "affected_version": "[*, 1.1.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24519",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate FAQ \u003c= 1.8.24 - Cross-Site Scripting",
    "slug": "ultimate-faqs",
    "type": "plugin",
    "affected_version": "[*, 1.8.25)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.25",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17233",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "[*, 0.9.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.0.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36836",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-GraphViz \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-graphviz",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58870",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Picture Gallery \u003c= 1.5.11 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "picture-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34759",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZeroBounce Email Verification \u0026 Validation \u003c= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "zerobounce",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51374",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.5.45 - Multiple Cross-Site Scripting Issues",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-9335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9335",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-FormAssembly \u003c= 2.0.5  - Authenticated (Contributor+) Arbitrary File Read",
    "slug": "formassembly-web-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45852",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced AJAX Page Loader \u003c 2.7.7 - Arbitrary File Upload",
    "slug": "advanced-ajax-page-loader",
    "type": "plugin",
    "affected_version": "[*, 2.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10929",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AnyMind Widget \u003c= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "anymind-widget",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2435",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress \u003c 2.0.6 -  Username Enumeration via Error Messages",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-0109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-0109",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Google Calendar Outlook Events Block Widget \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-google-icalendar-widget",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22497",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PT Sign Ups \u003c= 1.0.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "ptoffice-sign-ups",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24848",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Video Lightbox \u003c= 1.9.4 - Reflected Cross-Site Scripting",
    "slug": "wp-video-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2189",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Countdown \u0026 Clock \u003c= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "countdown-builder",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29420",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Loading Effects \u003c= 2.0.0 - Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "page-loading-effects",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23718",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stream \u003c= 3.9.2 - Missing Authorization via load_alerts_settings",
    "slug": "stream",
    "type": "plugin",
    "affected_version": "[*, 3.9.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-43450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43450",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Woo Store Mode \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "woo-store-mode",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23687",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brute Force Login Protection \u003c= 1.5.1 - Cross-Site Request Forgery",
    "slug": "brute-force-login-protection",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5034",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Autoship Cloud for WooCommerce Subscription Products \u003c= 2.8.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "autoship-cloud",
    "type": "plugin",
    "affected_version": "* - 2.8.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26878",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZoomSounds \u003c= 2.0 - Arbitrary File Upload",
    "slug": "dzs-zoomsounds",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9471",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Font Farsi \u003c= 1.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "font-farsi",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1752",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sirat \u003c= 1.5.1 - Missing Authorization",
    "slug": "sirat",
    "type": "theme",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39385",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Post Type Order \u003c= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode",
    "slug": "multiple-post-type-order",
    "type": "plugin",
    "affected_version": "* - 1.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4055",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ni CRM Lead \u003c= 1.3.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "ni-crm-lead",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54258",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Recover Abandoned Cart \u003c= 24.4.0 - Unauthenticated PHP Object Injection",
    "slug": "rac",
    "type": "plugin",
    "affected_version": "* - 24.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0956",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms and User Login \u003c= 4.6.0.3 - Cross-Site Request Forgery to Settings Modification",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "[*, 4.6.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-9454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9454",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Soccer Engine – Soccer Plugin for WordPress \u003c= 1.12 - Cross-Site Request Forgery",
    "slug": "soccer-engine-lite",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4312",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Terms descriptions \u003c= 3.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "terms-descriptions",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47336",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Financial Calculator \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "finance-calculator-with-application-form",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11783",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AppPresser \u003c= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass",
    "slug": "apppresser",
    "type": "plugin",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4611",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ZoomSounds - WordPress Wave Audio Player with Playlist \u003c= 6.91 - Unauthenticated PHP Object Injection",
    "slug": "dzs-zoomsounds",
    "type": "plugin",
    "affected_version": "* - 6.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.91",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13777",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Client Invoicing by Sprout Invoices \u003c= 19.9.6 - Authenticated Stored Cross-Site Scripting",
    "slug": "sprout-invoices",
    "type": "plugin",
    "affected_version": "[*, 19.9.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.9.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24787",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nextend Facebook Connect  \u003c= 3.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nextend-facebook-connect",
    "type": "plugin",
    "affected_version": "* - 3.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58031",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Contact Form \u003c= 1.6 - Cross-Site Request Forgery via wpcf_adminpage",
    "slug": "wp-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24929",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.334",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.334",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9560",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Instant Images \u003c= 6.1.0 - Authenticated (Author+) Arbitrary Options Update",
    "slug": "instant-images",
    "type": "plugin",
    "affected_version": "* - 6.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0869",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Your Simple SVG Support \u003c= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "your-simple-svg-support",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2542",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VK All in One Expansion Unit \u003c= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in CTA Post",
    "slug": "vk-all-in-one-expansion-unit",
    "type": "plugin",
    "affected_version": "* - 9.88.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.88.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy \u003c= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4370",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Brooklyn \u003c= 4.9.9.2 - PHP Object Injection",
    "slug": "brooklyn",
    "type": "theme",
    "affected_version": "* - 4.9.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-24926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24926",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stop Spammers Security \u003c= 2022.5 - Unauthenticated PHP Object Injection",
    "slug": "stop-spammer-registrations-plugin",
    "type": "plugin",
    "affected_version": "* - 2022.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2022.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4120",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ShiftController Employee Shift Scheduling \u003c= 4.9.23 - Cross-Site Request Forgery via get",
    "slug": "shiftcontroller",
    "type": "plugin",
    "affected_version": "* - 4.9.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29425",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Event Espresso Core \u003c= 4.10.6.p - Reflected Cross-Site Scripting",
    "slug": "event-espresso-core",
    "type": "plugin",
    "affected_version": "* - 4.10.6.p",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.6.p",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-26153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-26153",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKT Addons for Elementor \u003c= 3.3 - Authenticated (Contributor+) Post Disclosure",
    "slug": "skt-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10693",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Spare \u003c= 1.7 - Cross-Site Request Forgery",
    "slug": "spare",
    "type": "theme",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31639",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Base64 Encoder/Decoder \u003c= 0.9.2 - Cross-Site Request Forgery to Setting Reset",
    "slug": "base64-encoderdecoder",
    "type": "plugin",
    "affected_version": "* - 0.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3824",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "sitetweet \u003c= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "sitetweet-tweets-user-behaviors-on-your-site-on-twitter",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5767",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "File Manager Advanced Shortcode WordPress \u003c= 2.3.2 - Unauthenticated Arbitrary File Upload to Remote Code Execution via Shortcode",
    "slug": "file-manager-advanced-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2068",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1536",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Directorist \u003c= 7.0.6.1 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24981",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Notibar \u003c= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "notibar",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1672",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Headline Analyzer \u003c= 1.3.1 - Missing Authorization via REST APIs",
    "slug": "headline-analyzer",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46195",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ZoomSounds - WordPress Wave Audio Player with Playlist \u003c= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation",
    "slug": "dzs-zoomsounds",
    "type": "plugin",
    "affected_version": "* - 6.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.91",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13776",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "BBS e-Popup \u003c= 2.4.5 - Missing Authorization",
    "slug": "bbs-e-popup",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36504",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stratum – Elementor Widgets \u003c= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets",
    "slug": "stratum",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7845",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extensions For CF7 \u003c= 3.0.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "extensions-for-cf7",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-29102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29102",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OSM – OpenStreetMap \u003c= 6.0.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "osm",
    "type": "plugin",
    "affected_version": "* - 6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3604",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Rank Math SEO with AI SEO Tools \u003c= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.216",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.216",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3665",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Horizontal Line Shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "horizontal-line-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23791",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Manager for Icomoon \u003c= 2.0 - Unauthenticated Arbitrary File Upload via 'upload'",
    "slug": "manager-for-icomoon",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-29386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29386",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI Engine: ChatGPT Chatbot \u003c= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_upload",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 1.9.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.98",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51409",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Passbeemedia Web Push Notification \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "passbeemedia-web-push-notifications",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13877",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple User Registration \u003c= 5.5 - Missing Authorization to User Deletion",
    "slug": "wp-registration",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-53810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53810",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "CSS3 Tooltips for WordPress \u003c= 1.8 - Missing Authorization",
    "slug": "css3_tooltips",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32180",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PropertyHive \u003c 1.4.15 - Cross-Site Scripting",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "[*, 1.4.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-6465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6465",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yellow Yard Searchbar \u003c= 2.7.27 - Reflected Cross-Site Scripting",
    "slug": "yellow-yard",
    "type": "plugin",
    "affected_version": "* - 2.7.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BookingPress \u003c= 1.0.81 - Authenticated (Customer+) Insecure Direct Object Reference",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.81",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.81",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31296",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.3 - Missing Authorization",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36516",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.39 - Unauthorized Profile Modification",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-10271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-10271",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Yoast Duplicate Post \u003c= 2.5 - SQL Injection",
    "slug": "duplicate-post",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-10379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10379",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARMember \u003c= 4.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47421",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebLibrarian \u003c 3.4.8.7 - Cross-Site Scripting",
    "slug": "weblibrarian",
    "type": "plugin",
    "affected_version": "[*, 3.4.8.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18540",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "System Dashboard \u003c= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameter",
    "slug": "system-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.8.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12299",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebinarIgnition \u003c= 3.05.0 - Authenticated(Subscriber+) PHP Object Injection",
    "slug": "webinar-ignition",
    "type": "plugin",
    "affected_version": "* - 3.05.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.05.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51422",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MBE eShip \u003c= 2.2.4 - Reflected Cross-Site Scripting",
    "slug": "mail-boxes-etc",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37953",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.9.4 - Contributor+ Stored Cross-Site Scripting via File Thumbnail",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "* - 3.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24693",
    "auth_type": "Auth",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Smart Docs \u003c= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "smart-docs",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9333",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.4.3 - Missing Authorization",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30463",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Announce from the Dashboard \u003c= 1.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "announce-from-the-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3030",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UXsniff \u003c= 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "ux-sniff",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32532",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Adminimize \u003c= 1.7.21 - Cross-Site Scripting",
    "slug": "adminimize",
    "type": "plugin",
    "affected_version": "* - 1.7.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-4926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4926",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Video \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wordpress-video",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49231",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Like Button Rating \u003c= 2.6.37 - Unauthorised Vote Export to Email \u0026 IP Addresses Disclosure",
    "slug": "likebtn-like-button",
    "type": "plugin",
    "affected_version": "* - 2.6.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24945",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Admin side data storage for Contact Form 7 \u003c= 1.1.1 - Authenticated (Admin+) SQL Injection",
    "slug": "admin-side-data-storage-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1776",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Duplicator \u003c 1.3.0 - Unauthenticated Remote Code Execution",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "[*, 1.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-25095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-25095",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Copy Anything to Clipboard \u003c= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "copy-the-code",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5086",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPAdverts – Classifieds Plugin \u003c= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add Shortcode",
    "slug": "wpadverts",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10108",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mail Catcher \u003c= 2.1.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject",
    "slug": "wp-mail-catcher",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3080",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \u003c= 2.8.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6620",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MachForm Shortcode \u003c= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "machform-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24636",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Petito \u003c= 1.6.2 - Unauthenticated Local File Inclusion",
    "slug": "bw-petito",
    "type": "theme",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-27362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27362",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OS Our Team \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "os-our-team",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52341",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Help Desk \u003c= 2.7.1 - Missing Authorization to Plugin Settings Update",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "2.7.1",
    "from_version": "2.7.1",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-46838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46838",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Elegant Addons for elementor \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags",
    "slug": "elegant-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3066",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-PostRatings \u003c= 1.86 - Cross-Site Scripting",
    "slug": "wp-postratings",
    "type": "plugin",
    "affected_version": "* - 1.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25117",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category Discount Woocommerce \u003c= 4.11 - Cross-Site Request Forgery via wpcd_save_discount()",
    "slug": "woo-product-category-discount",
    "type": "plugin",
    "affected_version": "* - 4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0617",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gutentor \u003c= 3.4.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "gutentor",
    "type": "plugin",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1986",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ApexChat \u003c= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "apexchat",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28414",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 3.5.5 - Unauthenticated SQL Injection",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 3.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24666",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Form Maker \u003c= 1.15.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3300",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Landing Page Builder \u003c= 1.5.1.7 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "page-builder-add",
    "type": "plugin",
    "affected_version": "* - 1.5.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30452",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Lesson Booking \u003c= 0.8.6 - Cross-Site Scripting",
    "slug": "online-lesson-booking-system",
    "type": "plugin",
    "affected_version": "* - 0.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-5972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5972",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Tables \u003c= 4.3.4 - Cross-Site Request Forgery",
    "slug": "ninja-tables",
    "type": "plugin",
    "affected_version": "* - 4.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47136",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Tools \u003c= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "media-library-tools",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10482",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Attachments \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "download-attachments",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3230",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Classifieds \u0026 Directory Pro \u003c= 3.1.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "advanced-classifieds-and-directory-pro",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37501",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Solace Extra \u003c= 1.3.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "solace-extra",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32652",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WOOCS \u003c= 1.3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4431",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration \u003c= 2.3.2.1 - Missing Authorization via send_test_email",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 2.3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29429",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1172",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Register Plus \u003c= 3.5.11 - Stored Cross-Site Scripting",
    "slug": "register-plus",
    "type": "plugin",
    "affected_version": "* - 3.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2010-4402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4402",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ubigeo de Perú para Woocommerce y WordPress \u003c= 3.6.3 - Unauthenticated SQL Injection",
    "slug": "ubigeo-peru",
    "type": "plugin",
    "affected_version": "[*, 3.6.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0814",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Content text slider on post \u003c 6.9 - Cross-Site Scripting",
    "slug": "content-text-slider-on-post",
    "type": "plugin",
    "affected_version": "[*, 6.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-20019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-20019",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enfold \u003c 3.0.1 - Unspecified Vulnerability",
    "slug": "enfold",
    "type": "theme",
    "affected_version": "[*, 3.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-7297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7297",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Thim Elementor Kit \u003c= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "thim-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34415",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flexmls® IDX Plugin \u003c= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters",
    "slug": "flexmls-idx",
    "type": "plugin",
    "affected_version": "* - 3.14.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10552",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Abandoned Contact Form 7 \u003c= 2.0 - Missing Authorization",
    "slug": "abandoned-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52817",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SimpleForm – Contact form made simple \u003c= 2.2.0 - Reflected Cross-Site Scripting",
    "slug": "simpleform",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10883",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fluent Support \u003c= 1.9.1 - Cross-Site Request Forgery",
    "slug": "fluent-support",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57885",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Listing, Classified Ads \u0026 Business Directory – uListing \u003c= 2.0.5 - Reflected Cross-Site Scripting",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36875",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPB Show Core \u003c= 2.6 - Reflected Cross-Site Scripting via 'file'",
    "slug": "wpb-show-core",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1958",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SQL Chart Builder \u003c= 2.3.7.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "sql-chart-builder",
    "type": "plugin",
    "affected_version": "* - 2.3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11430",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "HostFact bestelformulier integratie \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hostfact-bestelformulier-integratie",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11413",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVPMaker  \u003c= 10.5.4 - Authenticated (Administrator+) SQL Injection via 'resend'",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "[*, 10.5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.5.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-29095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29095",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IMPress Listings \u003c= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Listing Fields",
    "slug": "wp-listings",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22711",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Sky Addons for Elementor \u003c= 2.4.0 - Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URL",
    "slug": "sky-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2286",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Registration Calendar By vcita \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "event-registration-calendar-by-vcita",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11870",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Showcase \u003c= 1.22.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "team",
    "type": "plugin",
    "affected_version": "* - 1.22.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43321",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Slider \u003c 7.4.2 - SQL Injection",
    "slug": "social-slider",
    "type": "plugin",
    "affected_version": "[*, 7.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2011-5286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5286",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ImageBoss – Images Up To 60% Smaller \u0026 CDN \u003c 3.0.6 - Cross-Site Scripting",
    "slug": "imageboss",
    "type": "plugin",
    "affected_version": "[*, 3.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24888",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Submitted Posts \u003c= 20230901 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "user-submitted-posts",
    "type": "plugin",
    "affected_version": "* - 20230901",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20230901",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7251",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "External Media without Import \u003c 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "external-media-without-import",
    "type": "plugin",
    "affected_version": "[*, 1.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-20183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20183",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Logos \u003c= 1.2 - Cross-Site Request Forgery to SQL Injection",
    "slug": "awesome-logos",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30528",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.1.5 - Cross-Site Request Forgery",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43491",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Online Order for Clover \u003c= 1.5.6 - Missing Authorization",
    "slug": "clover-online-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43254",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ABC Notation \u003c= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "abc-notation",
    "type": "plugin",
    "affected_version": "* - 6.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31895",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WonderPlugin Audio Player \u003c= 2.0 - Blind SQL Injection",
    "slug": "wonderplugin-audio",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2199",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wizhi Multi Filters by Wenprise \u003c= 1.8.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wizhi-multi-filters",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22336",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Nice Loader \u003c= 0.1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-nice-loader",
    "type": "plugin",
    "affected_version": "* - 0.1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56232",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.5.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-2399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2399",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fancy Elementor Flipbox \u003c= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Elementor Flipbox Widget",
    "slug": "fancy-elementor-flipbox",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2349",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TGG WP Optimizer \u003c= 1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tgg-wp-optimizer",
    "type": "plugin",
    "affected_version": "* - 1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31463",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Language Switcher for Transposh \u003c= 1.5.9 - Reflected Cross-Site Scripting",
    "slug": "language-switcher-for-transposh",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32695",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Service Finder Bookings \u003c= 6.0 - Authentication Bypass via User Switch Cookie",
    "slug": "sf-booking",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5947",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bit Form Pro \u003c= 2.6.4 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "bitformpro",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Accessibility Checker by Equalize Digital \u003c= 1.30.0 - Authenticated (Contributor+) Insecure Direct Object Reference",
    "slug": "accessibility-checker",
    "type": "plugin",
    "affected_version": "* - 1.30.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57886",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Our Team Members \u003c= 2.2 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure",
    "slug": "our-team-members",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30802",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "iControlWP – Multiple WordPress Site Manager \u003c= 4.4.5 - Unauthenticated PHP Object Injection",
    "slug": "worpit-admin-dashboard-plugin",
    "type": "plugin",
    "affected_version": "* - 4.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13742",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Subscribe to Unlock Lite \u003c= 1.3.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "subscribe-to-unlock-lite",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39592",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Enquiry for WooCommerce \u003c= 2.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "enquiry-quotation-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29170",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML5 Video Player – mp4 Video Player Plugin and Block \u003c= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter",
    "slug": "html5-video-player",
    "type": "plugin",
    "affected_version": "* - 2.5.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13156",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Two Factor Authentication \u003c= 1.3.12 - Cross-Site Request Forgery",
    "slug": "two-factor-authentication",
    "type": "plugin",
    "affected_version": "[*, 1.3.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.13",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-20231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20231",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RSS Feed Widget \u003c= 2.8.0 - Reflected Cross-Site Scripting",
    "slug": "rss-feed-widget",
    "type": "plugin",
    "affected_version": "[*, 2.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-24314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24314",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks with AI by Kadence WP \u003c= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4481",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PressForward \u003c= 5.2.3 - Cross-Site Scripting",
    "slug": "pressforward",
    "type": "plugin",
    "affected_version": "[*, 5.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-12948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-12948",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Static Cache \u003c= 3.3.5 - Cross-Site Request Forgery",
    "slug": "super-static-cache",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30568",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54053",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Myflash \u003c 1.11 - Remote File Inclusion",
    "slug": "myflash",
    "type": "plugin",
    "affected_version": "* - 1.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.00",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2007-2485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-2485",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Resume Builder \u003c= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "resume-builder",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0078",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "REVIEWS.io \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "reviewscouk-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38677",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The School Management Pro \u003c= 9.9.6 - Remote Code Execution",
    "slug": "school-management-pro",
    "type": "plugin",
    "affected_version": "* - 9.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.9.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1609",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Doofinder for WooCommerce \u003c= 1.5.49 - Unauthenticated Open Redirect",
    "slug": "doofinder-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.49",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40602",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Make Column Clickable Elementor \u003c= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "make-column-clickable-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59592",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-HR Manager: The Human Resources Plugin for WordPress \u003c= 3.1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-hr-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23843",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DirectoriesPro Plugin by SabaiApps \u003c= 1.3.45 - Cross-Site Scripting via _drts_form_build_id, _t_ Parameters",
    "slug": "directories",
    "type": "plugin",
    "affected_version": "[*, 1.3.46)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.46",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-29303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-29303",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4830",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mikado Core \u003c= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "mikado-core",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9058",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Betheme \u003c= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 26.5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.5.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3861",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPeMatico RSS Feed Fetcher \u003c= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function",
    "slug": "wpematico",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8103",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "CMP \u003c= 3.8.1 - Missing Authorization",
    "slug": "cmp-coming-soon-maintenance",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36730",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Quote-O-Matic \u003c= 1.0.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "quote-o-matic",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4373",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RSVPMaker \u003c= 9.2.5 - Unauthenticated SQL Injection",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 9.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1453",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery – Image and Video Gallery with Thumbnails \u003c= 1.9.9 - Reflected Cross-Site Scripting",
    "slug": "gallery-album",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1946",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration",
    "slug": "peprodev-ups",
    "type": "plugin",
    "affected_version": "1.9.1 - 7.5.2",
    "from_version": "1.9.1",
    "from_inclusive": true,
    "to_version": "7.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3924",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Post Views Counter \u003c= 1.4.4 - Cross-Site Request Forgery via save_bulk_post_views()",
    "slug": "post-views-counter",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31264",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Sync \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "post-sync",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13634",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TinyMCE Professional Formats and Styles \u003c= 1.1.2 - Cross-Site Request Forgery via bb_taps_backend_page",
    "slug": "tinymce-and-tinymce-advanced-professsional-formats-and-styles",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25904",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JoomSport \u003c= 5.6.17 - Reflected Cross-Site Scripting via page",
    "slug": "joomsport-sports-league-results-management",
    "type": "plugin",
    "affected_version": "* - 5.6.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12633",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "GEO My WordPress \u003c= 4.4.0.2 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "geo-my-wp",
    "type": "plugin",
    "affected_version": "4.0 - 4.4.0.2",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.4.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9422",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GEO My WordPress \u003c= 4.4.0.2 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "gmw-premium-settings",
    "type": "plugin",
    "affected_version": "[*, 3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-9422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9422",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "pt-elementor-addons-lite",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "subscribe2",
    "type": "plugin",
    "affected_version": "* - 10.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wepos",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "easy-video-reviews",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "worth-the-read",
    "type": "plugin",
    "affected_version": "* - 1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "woostify-sites-library",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "sheets-to-wp-table-live-sync",
    "type": "plugin",
    "affected_version": "* - 2.12.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "post-grid-carousel-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wp-edit-password-protected",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "woo-product-carousel-slider-and-grid-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "woo-product-gallery-slider",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "dark-mode",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "dashboard-welcome-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wp-dark-mode",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "fuse-social-floating-sidebar",
    "type": "plugin",
    "affected_version": "* - 5.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "stylish-cost-calculator",
    "type": "plugin",
    "affected_version": "* - 7.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "ml-slider",
    "type": "plugin",
    "affected_version": "* - 3.28.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.28.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "woo-category-slider-by-pluginever",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "webinar-and-video-conference-with-jitsi-meet",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "w4-post-list",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wemail",
    "type": "plugin",
    "affected_version": "* - 1.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "stax-buddy-builder",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "legal-pages",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "woocommerce-conversion-tracking",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "gs-testimonial",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wp-maximum-upload-file-size",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wedocs",
    "type": "plugin",
    "affected_version": "1.6 - 1.7.5",
    "from_version": "1.6",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "bangladeshi-payment-gateways",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "texty",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "visibility-logic-elementor",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "webappick-pdf-invoice-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "darklup-lite-wp-dark-mode",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "exclusive-team-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "click-to-top",
    "type": "plugin",
    "affected_version": "* - 1.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "update-alt-attribute",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "magical-posts-display",
    "type": "plugin",
    "affected_version": "* - 1.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "gs-pinterest-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wp-mail-logging",
    "type": "plugin",
    "affected_version": "* - 1.10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wp-user-frontend",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "zero-bs-accounting",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "boostify-header-footer-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "stax-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "easy-sticky-sidebar",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "gallery-box",
    "type": "plugin",
    "affected_version": "* - 1.7.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "unlimited-elementor-inner-sections-by-boomdevs",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "woo-reviews-by-wiremo",
    "type": "plugin",
    "affected_version": "* - 1.4.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.96",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "cart-lift",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wpfunnels",
    "type": "plugin",
    "affected_version": "2.6.4",
    "from_version": "2.6.4",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "wc-category-showcase",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Business Card \u003c= 1.0.0 - Cross-Site Request Forgery to Category Deletion",
    "slug": "business-card-by-esterox-100",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4529",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CMC MIGRATE \u003c= 0.0.3 - Reflected Cross-Site Scripting",
    "slug": "cmc-migrate",
    "type": "plugin",
    "affected_version": "* - 0.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23746",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobWP \u003c= 2.4.0 - Cross-Site Request Forgery",
    "slug": "jobwp",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49975",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Frontend Content Forms for User Submissions (UGC) \u003c= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ContentStudio \u003c= 1.2.5 - Information Exposure",
    "slug": "contentstudio",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0557",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Store Locator WordPress \u003c= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "agile-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4832",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Robin image optimizer \u003c= 1.6.9 - Missing Authorization",
    "slug": "robin-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43122",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Mighty Classic Pros And Cons \u003c= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "joomdev-wp-pros-cons",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30556",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Validated \u003c= 1.0.2 - Cross-Site Scripting",
    "slug": "validated",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4564",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Station Pro \u003c= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height Parameters",
    "slug": "station-pro",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7959",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Absolutely Glamorous Custom Admin \u003c= 6.8 - Authenticated Stored Cross-Site Scripting",
    "slug": "ag-custom-admin",
    "type": "plugin",
    "affected_version": "* - 6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36823",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Restrict Categories \u003c= 2.6.4 - Reflected Cross-Site Scripting via rc-search",
    "slug": "restrict-categories",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47518",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Builder for WooCommerce reviews shortcodes – ReviewShort \u003c= 1.01.3 - Cross-Site Request Forgery",
    "slug": "woo-product-reviews-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.01.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29093",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Split Test For Elementor \u003c= 1.8.3 - Authenticated (Editor+) SQL Injection",
    "slug": "split-test-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32204",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPMobile.App \u003c= 11.56 - Open Redirect via 'redirect' Parameter",
    "slug": "wpappninja",
    "type": "plugin",
    "affected_version": "* - 11.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.56",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13888",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Post Notes \u003c= 1.7.6 - Cross-Site Request Forgery",
    "slug": "simple-post-notes",
    "type": "plugin",
    "affected_version": "[*, 1.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-31935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31935",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.5",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5623",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.5",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5623",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.2",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5623",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5623",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.8",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5623",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.8",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5623",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.3 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.6",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5623",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "The Pack Elementor addons \u003c= 2.0.8.8 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "the-pack-addon",
    "type": "plugin",
    "affected_version": "* - 2.0.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47383",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conditional Payments for WooCommerce \u003c= 2.3.1 - Cross-Site Request Forgery",
    "slug": "conditional-payments-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46805",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Remote Content Shortcode \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "remote-content-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2089",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "jQuery Manager for WordPress \u003c= 1.10.4 \u0026  jQuery Migrate Helper \u003c= 1.4.1- Running Vulnerable Dependency",
    "slug": "jquery-manager",
    "type": "plugin",
    "affected_version": "* - 1.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11023",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "jQuery Manager for WordPress \u003c= 1.10.4 \u0026  jQuery Migrate Helper \u003c= 1.4.1- Running Vulnerable Dependency",
    "slug": "enable-jquery-migrate-helper",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-11023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11023",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Rife Elementor Extensions \u0026 Templates \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Widget",
    "slug": "rife-elementor-extensions",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5504",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Vehicle Manager \u003c= 3.1 - Unauthenticated Local File Inclusion",
    "slug": "js-vehicle-manager",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-25109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25109",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Vertical scroll recent post \u003c= 14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "vertical-scroll-recent-post",
    "type": "plugin",
    "affected_version": "* - 14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23862",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Automation By Autonami \u003c= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-marketing-automations",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2580",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Auto Linker \u003c= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpa-seo-auto-linker",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58791",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Tag and Category Manager – AI Autotagger \u003c= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-tags",
    "type": "plugin",
    "affected_version": "* - 3.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2830",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Buddyboss Platform \u003c= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Link on Private Post",
    "slug": "buddyboss-platform",
    "type": "plugin",
    "affected_version": "* - 2.5.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4750",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "POST SMTP Mailer \u003c= 2.5.6 - Cross-Site Request Forgery to Arbitrary Log Deletion",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3178",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Accept Donations with PayPal \u003c= 1.3.0 Cross-Site Request Forgery to Post Deletion",
    "slug": "easy-paypal-donation",
    "type": "plugin",
    "affected_version": "[*, 1.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24572",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Charitable \u003c= 1.8.1.7 - Missing Authorization via ajax_license_check()",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "* - 1.8.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37510",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PHP to Page \u003c= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode",
    "slug": "php-to-page",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5199",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Maps for WP \u003c= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "maps-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57952",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Joli Table of Contents \u003c= 1.3.9 - Cross-Site Request Forgery",
    "slug": "joli-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46820",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Lava Directory Manager \u003c= 1.1.34 - Unauthenticated Stored Cross-Site Scripting via New Listing",
    "slug": "lava-directory-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46081",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frndzk Expandable Bottom Bar \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via text Parameter",
    "slug": "frndzk-expandable-bottom-bar",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2510",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX  \u003c= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32564",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Gallery – YouTube Playlist, Channel Gallery by YotuWP \u003c= 1.3.8 - Missing Authorization",
    "slug": "yotuwp-easy-youtube-embed",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-35726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-35726",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate WP Mail \u003c= 1.3.5 - Missing Authorization",
    "slug": "ultimate-wp-mail",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49288",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Espresso 4 Decaf \u003c= 4.10.11 - Cross-Site Request Forgery Bypass",
    "slug": "event-espresso-decaf",
    "type": "plugin",
    "affected_version": "* - 4.10.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4404",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Content Control \u003c= 2.1.0 - Missing Authorization to Sensitive Information Exposure",
    "slug": "content-control",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0615",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Categories Widget \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "wp-categories-widget",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31220",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Serial Numbers for WooCommerce – License Manager \u003c= 1.6.3 - Cross-Site Request Forgery",
    "slug": "wc-serial-numbers",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46078",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SmartMag \u003c= 9.3.0 - Unauthenticated Sensitive Information Exposure via Log Files",
    "slug": "smartmag-responsive-retina-wordpress-magazine",
    "type": "theme",
    "affected_version": "* - 9.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37930",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact List – Easy Business Directory, Staff Directory and Address Book Plugin \u003c= 2.9.87 - Missing Authorization to Notice Dismissal",
    "slug": "contact-list",
    "type": "plugin",
    "affected_version": "* - 2.9.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34821",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CubeWP – All-in-One Dynamic Content Framework \u003c= 1.1.24 - Cross-Site Request Forgery",
    "slug": "cubewp-framework",
    "type": "plugin",
    "affected_version": "* - 1.1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30994",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ARPrice \u003c= 4.0.3 - Unauthenticated SQL Injection",
    "slug": "arprice",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49655",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "XML for Google Merchant Center \u003c= 3.0.1 - Reflected Cross-Site Scripting via page parameter",
    "slug": "xml-for-google-merchant-center",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30877",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5605",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "binlayerpress \u003c= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "binlayerpress",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2076",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wordpress vertical image slider plugin \u003c= 1.2.16 - Reflected Cross-Site Scripting",
    "slug": "wp-vertical-image-slider",
    "type": "plugin",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24413",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YayCurrency \u003c= 3.2 - Authenticated (Administrator+) Remote Code Execution",
    "slug": "yaycurrency",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-60114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60114",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "qTranslate X Cleanup and WPML Import \u003c= 3.0.1 - Missing Authorization via clean_ajx",
    "slug": "qtranslate-to-wpml-export",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29431",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FM Notification Bar \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "fm-notification-bar",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22641",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Keep \u003c= 1.1 - Cross-Site Request Forgery to Email Deletion",
    "slug": "email-keep",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13826",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.5.68 - Reflected Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.68",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.68",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-46889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-46889",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chat2 \u003c= 4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "chat2",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32584",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via list_id parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6577",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.0.2 - Authenticated (Contributor+) Information Disclosure",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 6.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40696",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Grid Gallery – Photo Image Grid Gallery \u003c= 1.2.4 - Stored Cross-Site Scripting",
    "slug": "new-grid-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24529",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Genie WP Favicon \u003c= 0.5.2 - Cross-Site Request Forgery",
    "slug": "genie-wp-favicon",
    "type": "plugin",
    "affected_version": "* - 0.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24674",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Real Estate \u003c= 5.2.1 - Unauthenticated Local File Inclusion",
    "slug": "essential-real-estate",
    "type": "plugin",
    "affected_version": "* - 5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48126",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Userlike \u003c= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "userlike",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23734",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Photo Gallery Final Tiles Grid \u003c= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "final-tiles-grid-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6261",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Project Manager \u003c= 2.6.25 - Unauthenticated Sensitive Information Exposure",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58269",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Lightbox \u0026 Modal Popup WordPress Plugin – FooBox \u003c= 2.7.34 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "foobox-image-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.7.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5537",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Who Hit The Page – Hit Counter \u003c= 1.4.14.3 - Reflected Cross-Site Scripting",
    "slug": "who-hit-the-page-hit-counter",
    "type": "plugin",
    "affected_version": "* - 1.4.14.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.14.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25466",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Regpack \u003c= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "regpack",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41855",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 1.9.35 - PHP Object Injection",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 1.9.36)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.36",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-28339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28339",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Payment Forms for Paystack \u003c= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "payment-forms-for-paystack",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5665",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BAN Users \u003c= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update \u0026 Privilege Escalation",
    "slug": "ban-users",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4153",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dropdown Multisite selector \u003c= 0.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "dropdown-multisite-selector",
    "type": "plugin",
    "affected_version": "* - 0.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29910",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetBlocks \u003c= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7147",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stout Google Calendar \u003c= 1.2.3 - Cross-Site Request Forgery via sgc_plugin_options",
    "slug": "stout-google-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45273",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Propovoice Pro \u003c= 1.7.0.3 - Unauthenticated SQL Injection",
    "slug": "propovoice-pro",
    "type": "plugin",
    "affected_version": "* - 1.7.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43941",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Time Based Greeting \u003c= 2.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "time-based-greeting",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gravity Upload Ajax \u003c= 1.1 - Unrestricted File Upload",
    "slug": "gravity-file-ajax-upload-free",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-4972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4972",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Login by Auth0 \u003c= 3.11.3 - Stored Cross-Site Scripting",
    "slug": "auth0",
    "type": "plugin",
    "affected_version": "* - 3.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-6753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-6753",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Posts Carousel \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-posts-carousel",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30920",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Graphina \u003c= 1.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "graphina-elementor-charts-and-graphs",
    "type": "plugin",
    "affected_version": "* - 1.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43124",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Token Login \u003c= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "token-login",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50488",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EWWW Image Optimizer \u003c= 7.2.3 - Cross-Site Request Forgery",
    "slug": "ewww-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 7.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31924",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Yet Another Stars Rating \u003c= 3.4.3 - Missing Authorization via init",
    "slug": "yet-another-stars-rating",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39305",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Dewplayer \u003c= 1.6 - Missing Authorization",
    "slug": "advanced-dewplayer",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30592",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Compliance \u003c= 4.15.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gdpr-cookie-compliance",
    "type": "plugin",
    "affected_version": "* - 4.15.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1624",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Builder \u003c= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "cssjockey-add-ons",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9457",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Dashboard Page \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "custom-dashboard-page",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28912",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PGS Core \u003c= 5.8.0 - Missing Authorization via Multiple Functions",
    "slug": "pgs-core",
    "type": "plugin",
    "affected_version": "* - 5.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0856",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "RSVPMaker \u003c= 9.3.2 - Unauthenticated SQL Injection",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 9.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1768",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Portfolio Builder – Portfolio Gallery \u003c= 1.1.7 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "uber-grid",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53788",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Namaste! LMS \u003c= 2.6.4.1 - Cross-Site Request Forgery",
    "slug": "namaste-lms",
    "type": "plugin",
    "affected_version": "* - 2.6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53809",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-32243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32243",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP微信机器人 \u003c= 5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-weixin-robot",
    "type": "plugin",
    "affected_version": "* - 5.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54392",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CHATLIVE \u003c= 2.0.1 - Unauthenticated SQL Injection",
    "slug": "chatlive",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27302",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Cost Calculator Builder \u003c= 3.2.74 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "* - 3.2.74",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.74",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48277",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks \u003c= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-gutenberg",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49032",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classipress \u003c= 3.1.4 - Stored Cross-Site Scripting",
    "slug": "classipress",
    "type": "theme",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-5257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5257",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Slider and Showcase \u003c= 1.3.36 - Settings Update",
    "slug": "wp-logo-showcase",
    "type": "plugin",
    "affected_version": "[*, 1.3.37)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.37",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24742",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "PeepSo Core: Photos \u003c 6.3.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "peepso-photos",
    "type": "plugin",
    "affected_version": "[*, 6.3.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-22158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22158",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bridge Core \u003c= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "bridge-core",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9292",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Countdown Timer Plugin by TechMix \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "event-countdown-timer",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23699",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Checkout \u0026 Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce \u003c= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cartflows",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4632",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yellow Swordfish Simple Forum \u003c= 1.11 - SQL Injection",
    "slug": "simple-forum",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-7040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-7040",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Annie \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "annie",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23886",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HC Custom WP-Admin URL \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "hc-custom-wp-admin-url",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1594",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "3DVieweronline \u003c= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "3dvieweronline-wp",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12514",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jquery accordion slideshow \u003c= 8.1 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "jquery-accordion-slideshow",
    "type": "plugin",
    "affected_version": "* - 8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5464",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Broken Link Manager \u003c= 0.4.5 - Cross-Site Scripting",
    "slug": "broken-link-manager",
    "type": "plugin",
    "affected_version": "* - 0.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9468",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Ads Manager 2.5.94 \u0026 2.5.96 - Information Disclosure",
    "slug": "simple-ads-manager",
    "type": "plugin",
    "affected_version": "2.5.96",
    "from_version": "2.5.96",
    "from_inclusive": true,
    "to_version": "2.5.96",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-2826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2826",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Ads Manager 2.5.94 \u0026 2.5.96 - Information Disclosure",
    "slug": "simple-ads-manager",
    "type": "plugin",
    "affected_version": "2.5.94",
    "from_version": "2.5.94",
    "from_inclusive": true,
    "to_version": "2.5.94",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-2826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2826",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "PowerPack for Beaver Builder \u003c= 2.37.3 - Reflected Cross-Site Scripting",
    "slug": "bbpowerpack",
    "type": "plugin",
    "affected_version": "* - 2.37.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.37.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43330",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myLinksDump \u003c= 1.2 - SQL Injection",
    "slug": "mylinksdump",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2010-2924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-2924",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Persian WooCommerce \u003c= 7.1.6 - Missing Authorization",
    "slug": "persian-woocommerce",
    "type": "plugin",
    "affected_version": "* - 7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Phlox PRO \u003c= 5.16.4 - Reflected Cross-Site Scripting via Search Parameters",
    "slug": "phlox-pro",
    "type": "theme",
    "affected_version": "* - 5.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.16.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6339",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HieCOR Payment Gateway Plugin \u003c= 1.5.11 - Unauthenticated SQL Injection",
    "slug": "hcv4-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 1.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52773",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c 0.9.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "[*, 0.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24870",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cover WP \u003c= 1.6.5 - Cross-Site Scripting",
    "slug": "cover-wp",
    "type": "theme",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3860",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lightweight Accordion \u003c= 1.5.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "lightweight-accordion",
    "type": "plugin",
    "affected_version": "* - 1.5.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2436",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wallet System for WooCommerce \u003c= 2.5.9 - Cross-Site Request Forgery",
    "slug": "wallet-system-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32446",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Testimonial Post type \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play Parameter",
    "slug": "testimonial-post-type",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5800",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kadence WooCommerce Email Designer \u003c= 1.5.16 - Authenticated (Shop Manager+) Arbitrary Options Update",
    "slug": "kadence-woocommerce-email-designer",
    "type": "plugin",
    "affected_version": "* - 1.5.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54697",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Loginizer Security and Loginizer \u003c= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider",
    "slug": "loginizer-security",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10097",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Loginizer Security and Loginizer \u003c= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider",
    "slug": "loginizer",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10097",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wow Forms – create any form with custom style \u003c= 3.1.3 - Authenticated (Admin+) SQL Injection",
    "slug": "mwp-forms",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24628",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Automatic Plugin - AI content generator and auto poster plugin \u003c= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-automatic",
    "type": "plugin",
    "affected_version": "* - 3.118.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.118.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6247",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.1.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-1622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1622",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.1.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "2.1 - 2.1.1",
    "from_version": "2.1",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-1622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1622",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Multi Currency \u003c= 2.1.17 - Missing Authorization",
    "slug": "woo-multi-currency",
    "type": "plugin",
    "affected_version": "* - 2.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4376",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SimplyRETS Real Estate IDX \u003c= 3.0.3 - Reflected Cross-Site Scripting",
    "slug": "simply-rets",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31011",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple:Press \u003c= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Modification",
    "slug": "simplepress",
    "type": "plugin",
    "affected_version": "* - 6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-4031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4031",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Auto Attachments \u003c= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "auto-attachments",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6012",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WordPress File Upload \u003c 2.4.2 - Cross-Site Request Forgery",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-5199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5199",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Ultimate Email Marketer \u003c= 1.2.0 - Authentication Bypass",
    "slug": "wp-ultimate-email-marketer",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-3264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3264",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Envo's Elementor Templates \u0026 Widgets for WooCommerce \u003c= 1.4.4 - Cross-Site Request Forgery via ajax_theme_activation",
    "slug": "envo-elementor-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0768",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tutor LMS Elementor Addons \u003c= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widget",
    "slug": "tutor-lms-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5576",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy PayPal Buy Now Button \u003c= 1.8.1 - Cross-Site Request Forgery",
    "slug": "wp-ecommerce-paypal",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51683",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MainWP Rocket Extension \u003c= 4.0.3 - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "mainwp-rocket-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23648",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Pure Chat – Live Chat Plugin \u0026 More! \u003c= 2.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "pure-chat",
    "type": "plugin",
    "affected_version": "* - 2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3595",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Click to Chat – WP Support All-in-One Floating Widget \u003c= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode",
    "slug": "support-chat",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10055",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Go Maps \u003c= 9.0.40 - Cross-Site Request Forgery",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24742",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfect Survey \u003c= 1.5.2 - Reflected Cross-Site Scripting",
    "slug": "perfect-survey",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24764",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BulletProof Security \u003c .47.1 - Reflected Cross-Site Scripting",
    "slug": "bulletproof-security",
    "type": "plugin",
    "affected_version": "[*, .47.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": ".47.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-4268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4268",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Void Contact Form 7 Widget For Elementor Page Builder \u003c= 2.3 - Missing Authorization",
    "slug": "cf7-widget-elementor",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52214",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Animator \u003c= 3.0.10 - Missing Authorization to Plugin Settings Update",
    "slug": "scroll-triggered-animations",
    "type": "plugin",
    "affected_version": "* - 3.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47689",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NitroPack \u003c= 1.16.7 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "nitropack",
    "type": "plugin",
    "affected_version": "* - 1.16.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43922",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Meta News \u003c= 1.1.7 - Unauthenticated Local File Inclusion",
    "slug": "meta-news",
    "type": "theme",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50435",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "School Management \u003c= 92.0.0 - Reflected Cross-Site Scripting",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 92.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "92.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47613",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Guten Free Options \u003c= 0.9.5 - Reflected Cross-Site Scripting",
    "slug": "guten-free-options",
    "type": "plugin",
    "affected_version": "* - 0.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Editor.md – The Perfect WordPress Markdown Editor \u003c= 10.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-editormd",
    "type": "plugin",
    "affected_version": "* - 10.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31035",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeoDirectory \u003c= 2.1.1.2 - Authenticated (admin+) Stored Cross-Site Scripting",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better RSS Widget \u003c= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "better-rss-widget",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47813",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery 1.9.10 - 1.9.11 - Full Path Disclosure",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "1.9.10 - 1.9.11",
    "from_version": "1.9.10",
    "from_inclusive": true,
    "to_version": "1.9.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-0291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-0291",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "TAKETIN To WP Membership \u003c= 2.8.12 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "taketin-to-wp-membership",
    "type": "plugin",
    "affected_version": "* - 2.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49226",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Custom Cursors | WordPress Cursor \u003c= 3.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-custom-cursors",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5911",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ScoreMe \u003c= 2016-04-01 - Cross-Site Scripting",
    "slug": "scoreme",
    "type": "theme",
    "affected_version": "[*, 2016-04-01]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2016-04-01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10993",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Customer Area \u003c= 7.4.2 - Cross-Site Scripting",
    "slug": "customer-area",
    "type": "plugin",
    "affected_version": "[*, 7.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Security \u003c= 1.1.5 - Authenticated Stored Cross-Site Scripting",
    "slug": "simple-security",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9570",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder Pro \u003c= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.20.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1364",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 6.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8493",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FunnelKit Checkout \u003c= 3.10.3 - Authenticated(Subscriber+) Missing Authorization to Arbitrary Plugin Activation",
    "slug": "woofunnels-aero-checkout",
    "type": "plugin",
    "affected_version": "* - 3.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51670",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikRestaurants Table Reservations and Take-Away \u003c= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "vikrestaurants",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57968",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform \u003c= 3.9.2 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30914",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShiftNav – Responsive Mobile Menu \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shiftnav-responsive-mobile-menu",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49243",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Ribbon Shortcode \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "add-ribbon",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51823",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Marketplace \u003c= 4.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24706",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register - Social Sites Login (Add on) \u003c= 1.7.7 - Authentication Bypass",
    "slug": "pie-register-social-site",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4544",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Xpro Elementor Addons \u003c= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58195",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Carousel Widget",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1465",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gum Elementor Addon \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price Table and Post Slider Widgets",
    "slug": "gum-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4668",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AR For WordPress \u003c= 6.6 - Unauthenticated Arbitrary File Upload",
    "slug": "ar-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50496",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wp Cookie Choice \u003c= 1.1.0 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "wp-cookiechoise",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24595",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "LeadBoxer \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "leadboxer",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52468",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Org Chart \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-org-chart",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36355",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Strong Testimonials \u003c= 3.2.3 - Missing Authorization",
    "slug": "strong-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26975",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP MLM \u003c= 4.0 - Unauthenticated Arbitrary File Upload",
    "slug": "wp-mlm",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51475",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stock Exporter for WooCommerce \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "stock-exporter-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30871",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPack Elementor Addons (Free Widgets, Extensions and Templates) \u003c= 2.8.1 - Authenticated (Contributor+) Post Disclosure",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10692",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Bonway Static Block Editor \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bonway-static-block-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50549",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers \u003c= 1.12.13 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "rafflepress",
    "type": "plugin",
    "affected_version": "* - 1.12.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3963",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Job Manager \u003c= 1.0.6 - Cross-Site Request Forgery",
    "slug": "js-jobs",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-20974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20974",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Support Plus Responsive Ticket System \u003c= 9.1.1 - Stored Cross-Site Scripting",
    "slug": "wp-support-plus-responsive-ticket-system",
    "type": "plugin",
    "affected_version": "[*, 9.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-7299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-7299",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twenty Fifteen Theme \u003c= 1.1 \u0026 WordPress Core \u003c 4.2.2 - Cross-Site Scripting via example.html",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.7",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twenty Fifteen Theme \u003c= 1.1 \u0026 WordPress Core \u003c 4.2.2 - Cross-Site Scripting via example.html",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.7",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twenty Fifteen Theme \u003c= 1.1 \u0026 WordPress Core \u003c 4.2.2 - Cross-Site Scripting via example.html",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.5",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twenty Fifteen Theme \u003c= 1.1 \u0026 WordPress Core \u003c 4.2.2 - Cross-Site Scripting via example.html",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.4",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twenty Fifteen Theme \u003c= 1.1 \u0026 WordPress Core \u003c 4.2.2 - Cross-Site Scripting via example.html",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.4",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twenty Fifteen Theme \u003c= 1.1 \u0026 WordPress Core \u003c 4.2.2 - Cross-Site Scripting via example.html",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.1",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twenty Fifteen Theme \u003c= 1.1 \u0026 WordPress Core \u003c 4.2.2 - Cross-Site Scripting via example.html",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-3429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twenty Fifteen Theme \u003c= 1.1 \u0026 WordPress Core \u003c 4.2.2 - Cross-Site Scripting via example.html",
    "slug": "twentyfifteen",
    "type": "theme",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML5 Video Player \u003c= 2.5.24 - Unauthenticated SQL Injection via id",
    "slug": "html5-video-player",
    "type": "plugin",
    "affected_version": "* - 2.5.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1061",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ajax Load More plugin \u003c 5.3.2 - SQL Injection",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "[*, 5.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24140",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.8 - Missing Authorization",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37921",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Page Builder – Zion Builder \u003c= 3.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zionbuilder",
    "type": "plugin",
    "affected_version": "* - 3.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54213",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mega Elements \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mega-elements-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37466",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Trackback Disabler \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "simple-trackback-disabler",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31448",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Airbnb Review Slider \u003c= 3.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-airbnb-review-slider",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0262",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MapSVG \u003c 8.7.4 - Unauthenticated SQL Injection",
    "slug": "mapsvg",
    "type": "plugin",
    "affected_version": "[*, 8.7.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.7.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-54669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54669",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "W3Counter Free Real-Time Web Stats \u003c= 4.1 - Cross-Site Request Forgery",
    "slug": "blog-stats-by-w3counter",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28856",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GenerateBlocks \u003c= 1.8.2 - Sensitive Information Exposure",
    "slug": "generateblocks",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1452",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Responsive Column Widgets \u003c= 1.2.7 - Reflected Cross-Site Scripting via tab",
    "slug": "responsive-column-widgets",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47520",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Compress \u003c= 6.30.30 - Cross-Site Request Forgery",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.30.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.30.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47546",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive HTML5 Audio Player PRO With Playlist \u003c= 3.5.8 - Reflected Cross-Site Scripting",
    "slug": "lbg-audio2-html5",
    "type": "plugin",
    "affected_version": "* - 3.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54056",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic QR Code Generator \u003c= 0.0.5 - Reflected Cross-Site Scripting",
    "slug": "dynamic-qr-code-generator",
    "type": "plugin",
    "affected_version": "* - 0.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34022",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CPO Shortcodes \u003c= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cpo-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40672",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spiritual Gifts Survey \u003c= 0.9.10 - Reflected Cross-Site Scripting",
    "slug": "spiritual-gifts-survey",
    "type": "plugin",
    "affected_version": "* - 0.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0688",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integrate Google Drive \u003c= 1.3.93 - Missing Authorization",
    "slug": "integrate-google-drive",
    "type": "plugin",
    "affected_version": "* - 1.3.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35670",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2563",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Toolkit Pro for LearnDash \u003c= 4.1.4 - Cross-Site Request Forgery",
    "slug": "uncanny-toolkit-pro",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37438",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Da Reactions \u003c= 5.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "da-reactions",
    "type": "plugin",
    "affected_version": "* - 5.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49255",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Tabs \u003c 4.0.6 - Authenticated (Contributor+) Content Injection",
    "slug": "responsive-tabs",
    "type": "plugin",
    "affected_version": "[*, 4.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-45635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45635",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.1",
    "from_version": "12.1",
    "from_inclusive": true,
    "to_version": "12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.2 - 7.2.3",
    "from_version": "7.2",
    "from_inclusive": true,
    "to_version": "7.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.2 - 8.2.4",
    "from_version": "8.2",
    "from_inclusive": true,
    "to_version": "8.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.0 - 9.0.3",
    "from_version": "9.0",
    "from_inclusive": true,
    "to_version": "9.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.4 - 4.4.3",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.7",
    "from_version": "10.7",
    "from_inclusive": true,
    "to_version": "10.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.6 - 2.6.5",
    "from_version": "2.6",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.7 - 2.7.4",
    "from_version": "2.7",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.8 - 2.8.4",
    "from_version": "2.8",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "3.6 - 3.6.3",
    "from_version": "3.6",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.7 - 9.7.1",
    "from_version": "9.7",
    "from_inclusive": true,
    "to_version": "9.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.9 - 9.9.1",
    "from_version": "9.9",
    "from_inclusive": true,
    "to_version": "9.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.0 - 4.0.5",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.2 - 4.2.3",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.6 - 4.6.1",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.0 - 5.0.1",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.6",
    "from_version": "11.6",
    "from_inclusive": true,
    "to_version": "11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "3.5 - 3.5.5",
    "from_version": "3.5",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.8 - 7.8.2",
    "from_version": "7.8",
    "from_inclusive": true,
    "to_version": "7.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.5 - 8.5.1",
    "from_version": "8.5",
    "from_inclusive": true,
    "to_version": "8.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.0",
    "from_version": "11.0",
    "from_inclusive": true,
    "to_version": "11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "3.0 - 3.0.5",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "3.7 - 3.7.4",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "3.9 - 3.9.8",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.3 - 5.3.2",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.4 - 5.4.2",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.3 - 6.3.5",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.6 - 6.6.3",
    "from_version": "6.6",
    "from_inclusive": true,
    "to_version": "6.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.3 - 11.3.2",
    "from_version": "11.3",
    "from_inclusive": true,
    "to_version": "11.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.2",
    "from_version": "11.2",
    "from_inclusive": true,
    "to_version": "11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "3.1 - 3.1.4",
    "from_version": "3.1",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.1 - 7.1.3",
    "from_version": "7.1",
    "from_inclusive": true,
    "to_version": "7.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.9 - 7.9.2",
    "from_version": "7.9",
    "from_inclusive": true,
    "to_version": "7.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.8 - 8.8.3",
    "from_version": "8.8",
    "from_inclusive": true,
    "to_version": "8.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.1 - 9.1.1",
    "from_version": "9.1",
    "from_inclusive": true,
    "to_version": "9.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.8 - 9.8.1",
    "from_version": "9.8",
    "from_inclusive": true,
    "to_version": "9.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "3.3 - 3.3.5",
    "from_version": "3.3",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.9 - 4.9.1",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.1 - 6.1.3",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.2 - 6.2.3",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.3 - 9.3.3",
    "from_version": "9.3",
    "from_inclusive": true,
    "to_version": "9.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.1 - 2.1.6",
    "from_version": "2.1",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.4",
    "from_version": "10.4",
    "from_inclusive": true,
    "to_version": "10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.7 - 11.7.1",
    "from_version": "11.7",
    "from_inclusive": true,
    "to_version": "11.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.3 - 8.3.1",
    "from_version": "8.3",
    "from_inclusive": true,
    "to_version": "8.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.9 - 8.9.2",
    "from_version": "8.9",
    "from_inclusive": true,
    "to_version": "8.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.6 - 10.6.1",
    "from_version": "10.6",
    "from_inclusive": true,
    "to_version": "10.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.9 - 10.9.1",
    "from_version": "10.9",
    "from_inclusive": true,
    "to_version": "10.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.4",
    "from_version": "11.4",
    "from_inclusive": true,
    "to_version": "11.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.5 - 5.5.3",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.0 - 6.0.2",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.0 - 7.0.3",
    "from_version": "7.0",
    "from_inclusive": true,
    "to_version": "7.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.7 - 8.7.2",
    "from_version": "8.7",
    "from_inclusive": true,
    "to_version": "8.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.1 - 4.1.2",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.8 - 4.8.3",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.5 - 10.5.1",
    "from_version": "10.5",
    "from_inclusive": true,
    "to_version": "10.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "3.2 - 3.2.4",
    "from_version": "3.2",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "3.4 - 3.4.5",
    "from_version": "3.4",
    "from_inclusive": true,
    "to_version": "3.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.7 - 5.7.3",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.9 - 6.9.2",
    "from_version": "6.9",
    "from_inclusive": true,
    "to_version": "6.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.3 - 7.3.3",
    "from_version": "7.3",
    "from_inclusive": true,
    "to_version": "7.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.3 - 4.3.3",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.5 - 4.5.1",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.5 - 2.5.4",
    "from_version": "2.5",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.3",
    "from_version": "10.3",
    "from_inclusive": true,
    "to_version": "10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.8",
    "from_version": "10.8",
    "from_inclusive": true,
    "to_version": "10.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "12.0",
    "from_version": "12.0",
    "from_inclusive": true,
    "to_version": "12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.2 - 2.2.9",
    "from_version": "2.2",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "3.8 - 3.8.4",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.5 - 11.5.1",
    "from_version": "11.5",
    "from_inclusive": true,
    "to_version": "11.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.3 - 2.3.9",
    "from_version": "2.3",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "4.7 - 4.7.2",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.8 - 6.8.3",
    "from_version": "6.8",
    "from_inclusive": true,
    "to_version": "6.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.6 - 7.6.2",
    "from_version": "7.6",
    "from_inclusive": true,
    "to_version": "7.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.0 - 8.0.1",
    "from_version": "8.0",
    "from_inclusive": true,
    "to_version": "8.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.4 - 8.4.3",
    "from_version": "8.4",
    "from_inclusive": true,
    "to_version": "8.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.4 - 9.4.2",
    "from_version": "9.4",
    "from_inclusive": true,
    "to_version": "9.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.0",
    "from_version": "10.0",
    "from_inclusive": true,
    "to_version": "10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.1 - 11.1.2",
    "from_version": "11.1",
    "from_inclusive": true,
    "to_version": "11.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.9 - 11.9.1",
    "from_version": "11.9",
    "from_inclusive": true,
    "to_version": "11.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.0 - 2.0.8",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.9 - 2.9.5",
    "from_version": "2.9",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.1 - 5.1.2",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.6 - 5.6.3",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.2 - 9.2.2",
    "from_version": "9.2",
    "from_inclusive": true,
    "to_version": "9.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.2 - 5.2.3",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.8 - 5.8.2",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.4 - 6.4.4",
    "from_version": "6.4",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.5 - 6.5.2",
    "from_version": "6.5",
    "from_inclusive": true,
    "to_version": "6.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.1 - 8.1.2",
    "from_version": "8.1",
    "from_inclusive": true,
    "to_version": "8.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.6 - 9.6.2",
    "from_version": "9.6",
    "from_inclusive": true,
    "to_version": "9.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.1",
    "from_version": "10.1",
    "from_inclusive": true,
    "to_version": "10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "2.4 - 2.4.6",
    "from_version": "2.4",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.7 - 7.7.4",
    "from_version": "7.7",
    "from_inclusive": true,
    "to_version": "7.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "8.6 - 8.6.2",
    "from_version": "8.6",
    "from_inclusive": true,
    "to_version": "8.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "10.2 - 10.2.1",
    "from_version": "10.2",
    "from_inclusive": true,
    "to_version": "10.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "5.9 - 5.9.2",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "6.7 - 6.7.2",
    "from_version": "6.7",
    "from_inclusive": true,
    "to_version": "6.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.4 - 7.4.3",
    "from_version": "7.4",
    "from_inclusive": true,
    "to_version": "7.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "7.5 - 7.5.5",
    "from_version": "7.5",
    "from_inclusive": true,
    "to_version": "7.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "9.5 - 9.5.3",
    "from_version": "9.5",
    "from_inclusive": true,
    "to_version": "9.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Jetpack \u003c= 12.1 - Authenticated (Author+) Arbitrary File Manipulation",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "11.8 - 11.8.4",
    "from_version": "11.8",
    "from_inclusive": true,
    "to_version": "11.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2996",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37446",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Footer Flyout Widget \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "footer-flyout-widget",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53732",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Checkout Manager \u003c= 4.2.6 - Unauthenticated Arbitrary Media Deletion",
    "slug": "woocommerce-checkout-manager",
    "type": "plugin",
    "affected_version": "* - 4.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-11807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11807",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "CPT Bootstrap Carousel \u003c= 1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "cpt-bootstrap-carousel",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aparat for WordPress \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-aparat",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29765",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar Contact Form \u003c= 1.0.23 - Reflected Cross-Site Scripting",
    "slug": "booking-calendar-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10908",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arkhe Blocks \u003c= 2.22.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "arkhe-blocks",
    "type": "plugin",
    "affected_version": "* - 2.22.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.22.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38675",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IMDB Info Box \u003c= 2.0 - Stored Cross-Site Scripting",
    "slug": "imdb-info-box",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1294",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prevent Direct Access – Protect WordPress Files \u003c= 2.8.8 - Unauthenticated Sensitive Information Exposure",
    "slug": "prevent-direct-access",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3923",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Locations \u003c= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "locations",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41797",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SearchWP Live Ajax Search \u003c= 1.6.2 - Directory Traversal and Local File Inclusion",
    "slug": "searchwp-live-ajax-search",
    "type": "plugin",
    "affected_version": "1.0 - 1.6.2",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3227",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "PDF Poster - PDF Embedder Plugin for WordPress \u003c= 2.1.17 - Reflected Cross-Site Scripting",
    "slug": "pdf-poster",
    "type": "plugin",
    "affected_version": "* - 2.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23508",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Discord Post \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-discord-post",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26554",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages \u003c= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request",
    "slug": "wc4bp",
    "type": "plugin",
    "affected_version": "* - 3.4.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2025",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Community Events \u003c 1.4 - SQL Injection",
    "slug": "community-events",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-3313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3313",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Welcome Bar \u003c= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "intelly-welcome-bar",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32129",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cordobo Green Park (All Versions) - Cross-Site Scripting",
    "slug": "cordobo-green-park",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-3241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-3241",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Slider 3 \u003c= 3.5.1.22 - Missing Authorization to Limited File Upload",
    "slug": "smart-slider-3",
    "type": "plugin",
    "affected_version": "* - 3.5.1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3027",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Poll Builder \u003c= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "poll-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54276",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Box – Best WordPress Popup Plugin \u003c= 3.7.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "* - 3.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5343",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Change WooCommerce Add To Cart Button Text \u003c= 1.3 - Missing Authorization via rexvs_settings_submit",
    "slug": "change-woocommerce-add-to-cart-button-text",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34376",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Webcamconsult \u003c= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "webcamconsult",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13432",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Apptha Slider Gallery \u003c= 2.5 - Unauthenticated Arbitrary File Read",
    "slug": "apptha-slider-gallery",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31050",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "User Blocker \u003c= 1.5.5 - Authenticated (Admin+) CSV Injection",
    "slug": "user-blocker",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45078",
    "auth_type": "Privileged",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "mwp-herd-effect",
    "type": "plugin",
    "affected_version": "* - 5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "popup-box",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "mwp-skype",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "float-menu",
    "type": "plugin",
    "affected_version": "* - 5.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "side-menu-lite",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "profit-button",
    "type": "plugin",
    "affected_version": "* - 5.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "sticky-buttons",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "counter-box",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "bubble-menu",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "calculator-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "wp-coder",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "button-generation",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smartarget Message Bar \u003c= 1.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "smartarget-message-bar",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35646",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flo Forms \u003c= 1.0.43 - Missing Authorization",
    "slug": "flo-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32213",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Homepage PopUp \u003c= 1.2.5 - Cross-Site Request Forgery",
    "slug": "homepage-pop-up",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-44585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44585",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Job Board Manager \u003c= 2.1.61 - Authenticated (Job Poster+) Arbitrary Shortcode Execution",
    "slug": "job-board-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58827",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder – User Profile \u0026 User Registration Forms \u003c= 3.6.4 - Cross-Site Request Forgery",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36915",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pricing Table by Supsystic \u003c= 1.8.1 - Missing Authorization on AJAX Actions",
    "slug": "pricing-table-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-9392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9392",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Quebely \u003c= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Option",
    "slug": "qubely",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0376",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Captcha Code \u003c= 2.9 - Captcha Bypass",
    "slug": "captcha-code-authentication",
    "type": "plugin",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48745",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Recommendation Quiz for eCommerce \u003c= 2.1.0 - Missing Authorization in prq_set_token",
    "slug": "product-recommendation-quiz-for-ecommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46631",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "HDW WordPress Video Gallery \u003c= 1.2 - Reflected Cross-Site Scripting via channel parameter",
    "slug": "hdw-tube",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000135",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kento Splash Screen \u003c= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "kento-splash-screen",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48351",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin \u003c= 5.7.14 - Unauthenticated SQL Injection",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.14",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-2876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2876",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mailto Links – Protect Email Addresses \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-mailto-links",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5109",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Send From \u003c= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "send-from",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46469",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Reactions Lite \u003c= 1.3.8 - Cross-Site Request Forgery via AJAX action",
    "slug": "wp-reactions-lite",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32587",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.6.21 - Reflected Cross-Site Scripting via 'title'",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1835",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zalo Live Chat \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "zalo-live-chat",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26542",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 4.0.5 - Cross-Site Scripting",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 4.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10867",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FormCraft \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "formcraft-form-builder",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15114",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Team \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "adl-team",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-34650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34650",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Asgaros Forum \u003c= 2.8.0 - Cross-Site Request Forgery",
    "slug": "asgaros-forum",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32440",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Charitable \u003c= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings",
    "slug": "charitable",
    "type": "plugin",
    "affected_version": "* - 1.8.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5275",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons PRO \u003c= 2.9.0 - Missing Authorization",
    "slug": "premium-addons-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37869",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WOLF \u003c= 1.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpbe_update_page_field",
    "slug": "bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31218",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "spam-stopper \u003c= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "spam-stopper",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Custom Fields Search \u003c= 0.3.28 - Cross-Site Scripting",
    "slug": "wp-custom-fields-search",
    "type": "plugin",
    "affected_version": "[*, 1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-9419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9419",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 5.7 - Unauthenticated SQL Injection",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "* - 5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-33965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33965",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page scroll to id \u003c= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "page-scroll-to-id",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4449",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "URL Shortener by MyThemeShop \u003c= 1.0.16 - Missing Authorization",
    "slug": "mts-url-shortener",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23896",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Polo Video Gallery – Best wordpress video gallery plugin \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "polo-video-gallery",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24415",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobeleon Theme \u003c= 1.9.1 - Reflected Cross-Site Scripting",
    "slug": "jobeleon-wpjobboard",
    "type": "theme",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47153",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Tynt \u003c= 0.2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "easy-tynt",
    "type": "plugin",
    "affected_version": "* - 0.2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23445",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Package \u003c= 1.5.10 - Reflected Cross-Site Scripting",
    "slug": "booking-package",
    "type": "plugin",
    "affected_version": "[*, 1.5.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-20840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20840",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Downloable by American Osteopathic Association \u003c= 0.1.0 - Unauthenticated Arbitrary File Download",
    "slug": "aoa-downloadable",
    "type": "plugin",
    "affected_version": "* - 0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13617",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Elementor Website Builder 3.6.0 - 3.6.2  - Missing Authorization to Remote Code Execution",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "3.6.0 - 3.6.2",
    "from_version": "3.6.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1329",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPBakery Page Builder \u003c= 8.6.1 - Stored Cross-Site Scripting via vc_custom_heading Shortcode",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 8.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11161",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Word Balloon \u003c= 4.19.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "word-balloon",
    "type": "plugin",
    "affected_version": "* - 4.19.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4751",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mosaic Generator \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter",
    "slug": "mosaic-generator",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8621",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button – Chaty \u003c= 2.8.3 - Admin+ Stored Cross-Site Scripting",
    "slug": "chaty",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36846",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsify WP \u003c= 1.9.11 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "responsify-wp",
    "type": "plugin",
    "affected_version": "* - 1.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30937",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crelly Slider \u003c= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "crelly-slider",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3752",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder Gutenberg Blocks – CoBlocks \u003c= 3.1.11 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "coblocks",
    "type": "plugin",
    "affected_version": "* - 3.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4260",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Cookielay \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay Shortcode",
    "slug": "cookielay",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10320",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Secure Copy Content Protection and Content Locking \u003c= 4.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "secure-copy-content-protection",
    "type": "plugin",
    "affected_version": "* - 4.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6888",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.0.9 - Cross-Site Request Forgery",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40192",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS \u003c= 2.7.3 - Authenticated (Instructor+) Stored Cross-Site Scripting",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43231",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extensions for Elementor \u003c= 2.0.40 - Reflected Cross-Site Scripting",
    "slug": "extensions-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52471",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PropertyHive \u003c= 2.0.19 - Cross-Site Request Forgery via save_account_details",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8490",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Tabs \u003c= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-tabs",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1846",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Feed \u003c= 6.5.4 - Cross-Site Request Forgery",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 6.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1213",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Awesome Support \u003c= 6.1.4 - Missing Authorization via wpas_edit_reply_ajax()",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48324",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Magical Addons For Elementor \u003c= 1.1.41 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magical-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38681",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Echo Sign \u003c 1.2 - Reflected Cross-Site Scripting",
    "slug": "echosign",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10984",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Post List  \u003c= 0.5.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-post-list",
    "type": "plugin",
    "affected_version": "* - 0.5.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33642",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9 - Insecure Deserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-1000600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000600",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Salon booking system \u003c= 9.6.5 - Cross-Site Request Forgery to Settings Update",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 9.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2429",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP EasyCart \u003c= 5.4.8 - Cross-Site Request Forgery via process_delete_product",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2891",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Auto Limit Posts Reloaded \u003c= 2.5 - Cross-Site Request Forgery",
    "slug": "auto-limit-posts-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46778",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Affiliates Plugin — SliceWP Affiliates \u003c= 1.1.20 - Reflected Cross-Site Scripting",
    "slug": "slicewp",
    "type": "plugin",
    "affected_version": "* - 1.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8714",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LinkedIn Company Updates \u003c= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "company-updates-for-linkedin",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2148",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dominion – Domain Checker for WPBakery \u003c= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dominion-domain-checker-wpbakery-addon",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12520",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Forms for Mailchimp \u003c= 6.8.8 - Reflected Cross-Site Scripting",
    "slug": "yikes-inc-easy-mailchimp-extender",
    "type": "plugin",
    "affected_version": "* - 6.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2518",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGYM \u003c= 67.1.0 - Unauthenticated Arbitrary File Upload",
    "slug": "gym-management",
    "type": "plugin",
    "affected_version": "* - 67.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "67.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9942",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Material Dashboard \u003c= 1.4.6 - Unauthenticated Privilege Escalation",
    "slug": "material-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32486",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms and User Login \u003c= 4.6.0.3 - Authenticated Privilege Escalation",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "[*, 4.6.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-9456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9456",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Google News Editors Picks Feed Generator \u003c= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "google-news-editors-picks-news-feeds",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28860",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Social Widget \u003c= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "wp-social-widget",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27189",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "jQuery T(-) Countdown Widget \u003c= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode",
    "slug": "jquery-t-countdown-widget",
    "type": "plugin",
    "affected_version": "* - 2.3.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4783",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Find Content IDs \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "find-content-ids",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23645",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Form Builder \u003c= 3.0.7 - Cross-Site Request Forgery to Data Modification",
    "slug": "visual-form-builder",
    "type": "plugin",
    "affected_version": "[*, 3.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0141",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sassy Social Share \u003c= 3.3.73 - Open Redirect",
    "slug": "sassy-social-share",
    "type": "plugin",
    "affected_version": "* - 3.3.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39404",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom iFrame for Elementor \u003c= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-iframe",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59553",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woody Ad Snippets \u003c= 2.2.4 - Missing Authorization to Settings Import",
    "slug": "insert-php",
    "type": "plugin",
    "affected_version": "[*, 2.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15858",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Christmasify! \u003c= 1.5.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "christmasify",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7574",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sydney Toolbox \u003c= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sydney-toolbox",
    "type": "plugin",
    "affected_version": "* - 1.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4036",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ganohrs Toggle Shortcode \u003c= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ganohrs-toggle-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12459",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donation Thermometer \u003c= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "donation-thermometer",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3128",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Dashboard \u003c= 3.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Modules Activation/Deactivation",
    "slug": "ultimate-dashboard",
    "type": "plugin",
    "affected_version": "* - 3.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2276",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Promotion Slider \u003c= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "promotion-slider",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29440",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "cformsII \u003c 14.8 - Arbitrary File Upload",
    "slug": "cforms2",
    "type": "plugin",
    "affected_version": "[*, 14.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-9473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9473",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Editor.md – The Perfect WordPress Markdown Editor \u003c 10.0.4 - Cross-Site Scripting",
    "slug": "wp-editormd",
    "type": "plugin",
    "affected_version": "[*, 10.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-18919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-18919",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Glossary \u003c= 3.1.2 - Missing Authorization",
    "slug": "wp-glossary",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46633",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appointment Calendar \u003c= 2.9.6 - Cross-Site Request Forgery",
    "slug": "appointment-calendar",
    "type": "plugin",
    "affected_version": "* - 2.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46198",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Simple PayPal Shopping Cart \u003c 3.6 - Cross-Site Request Forgery",
    "slug": "wordpress-simple-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "[*, 3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-2705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2705",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Full Circle \u003c= 0.5.7.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "full-circle",
    "type": "plugin",
    "affected_version": "* - 0.5.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23980",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XEN Carousel \u003c= 0.12.2 - Cross-Site Scripting",
    "slug": "xen-carousel",
    "type": "plugin",
    "affected_version": "* - 0.12.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.12.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4602",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Automatic Featured Images from Videos \u003c= 1.2.4 - Missing Authorization",
    "slug": "automatic-featured-images-from-videos",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31820",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FavIcon Switcher \u003c= 1.2.11 - Cross-Site Request Forgery",
    "slug": "favicon-switcher",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40219",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Pay Counter \u003c= 2.789 - Reflected Cross-Site Scripting",
    "slug": "post-pay-counter",
    "type": "plugin",
    "affected_version": "* - 2.789",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.789",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47673",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ocean Extra \u003c= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1277",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Archive List \u003c= 6.1.5 - Unauthenticated SQL Injection via build_sql_where Function",
    "slug": "jquery-archive-list-widget",
    "type": "plugin",
    "affected_version": "* - 6.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7670",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Flickr Justified Gallery \u003c 3.4.0 - Reflected Cross-Site Scripting",
    "slug": "flickr-justified-gallery",
    "type": "plugin",
    "affected_version": "[*, 3.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9327",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor  \u003c= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4449",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hotel Booking \u003c= 2.0.7 - Unauthenticated SQL Injection",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5652",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Membership \u003c= 4.3.8 - Reflected Cross-Site Scripting",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "[*, 4.3.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50376",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iQ Block Country \u003c= 1.2.13 - Protection Bypass due to IP Spoofing",
    "slug": "iq-block-country",
    "type": "plugin",
    "affected_version": "* - 1.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1762",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Panoramio \u003c= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-panoramio",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23662",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elastik Page Builder \u003c= 0.27.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "elastik-page-builder",
    "type": "plugin",
    "affected_version": "* - 0.27.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.27.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9274",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myCred \u003c= 2.9.4.2 - Missing Authorization",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.9.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49857",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover",
    "slug": "wpshop",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.6.0",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3852",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woffice Core \u003c= 5.4.8 - Reflected Cross-Site Scripting",
    "slug": "woffice-core",
    "type": "plugin",
    "affected_version": "* - 5.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37471",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WHIZZ \u003c 1.1.1 - Cross-Site Request Forgery",
    "slug": "whizz",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-8099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-8099",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "KBucket: Your Curated Content in WordPress \u003c= 4.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "kbucket",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6665",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Glofox Shortcodes \u003c= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "glofox-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12508",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zox News \u003c= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "zox-news",
    "type": "theme",
    "affected_version": "* - 3.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11936",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HivePress Claim Listings \u003c= 1.1.3 - Missing Authorization",
    "slug": "hivepress-claim-listings",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60123",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Blocks Pro \u003c= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "advanced-blocks-pro",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9074",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks, Page Builder – ComboBlocks \u003c= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Block",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.84",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.84",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7588",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ghost \u003c= 1.4.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "ghost",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34559",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Small Package Quotes – Worldwide Express Edition \u003c= 5.2.18 - Reflected Cross-Site Scripting",
    "slug": "small-package-quotes-wwe-edition",
    "type": "plugin",
    "affected_version": "* - 5.2.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31078",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SAML SP Single Sign On \u003c= 5.0.4 - Missing Authorization to notice dismissal",
    "slug": "miniorange-saml-20-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41873",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FormLift for Infusionsoft Web Forms \u003c= 7.5.17 - Unauthenticated SQL Injection",
    "slug": "formlift",
    "type": "plugin",
    "affected_version": "* - 7.5.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.17",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-38773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38773",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Authors List \u003c= 2.0.6 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "authors-list",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13806",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ShortPixel Adaptive Images \u003c= 3.8.2 - Missing Authorization in activate_ai_handler and deactivate_ai_handler",
    "slug": "shortpixel-adaptive-images",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31230",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WS Audio Player \u003c= 1.1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ws-audio-player",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31400",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVPMaker  \u003c= 10.6.6 - Unauthenticated PHP Object Injection",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 10.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-25054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25054",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Supra CSV \u003c= 4.0.3 - Stored Cross-Site Scripting via Cross-Site Request Forgery",
    "slug": "supra-csv-parser",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3853",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPB Category Slider for WooCommerce \u003c= 1.71 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wpb-woocommerce-category-slider",
    "type": "plugin",
    "affected_version": "* - 1.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.71",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53281",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "tagDiv Composer \u003c= 5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1705",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Community by PeepSo – Social Network, Membership, Registration, User Profiles \u003c= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via content Parameter",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7618",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enter Addons – Ultimate Template Builder for Elementor \u003c= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag",
    "slug": "enteraddons",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3680",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conditional Shipping for WooCommerce \u003c= 2.3.1 - Cross-Site Request Forgery",
    "slug": "conditional-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-46815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46815",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VR Calendar \u003c= 2.4.4 - Unauthenticated Local File Inclusion",
    "slug": "vr-calendar-sync",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-44013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44013",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEOPress \u003c= 7.6.1 - Information Exposure",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 7.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34383",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume Download",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13372",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Absolute Reviews \u003c= 1.1.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name",
    "slug": "absolute-reviews",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8965",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) \u003c= 2.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "ai-scribe-the-chatgpt-powered-seo-content-creation-wizard",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12606",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "kk Star Ratings – Rate Post \u0026 Collect User Feedbacks \u003c= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "kk-star-ratings",
    "type": "plugin",
    "affected_version": "* - 5.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11977",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Dream Carousel \u003c= 1.0.1b - Reflected Cross-Site Scripting",
    "slug": "wp-dream-carousel",
    "type": "plugin",
    "affected_version": "* - 1.0.1b",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1b",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13331",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shipmondo – A complete shipping solution for WooCommerce \u003c= 5.0.3 - Missing Authorization to Authenticated (Customer+) Information Disclosure",
    "slug": "pakkelabels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27001",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "OOPSpam Anti-Spam \u003c= 1.1.35 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "oopspam-anti-spam",
    "type": "plugin",
    "affected_version": "* - 1.1.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22716",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP 404 Auto Redirect to Similar Post \u003c= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-404-auto-redirect-to-similar-post",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-40206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40206",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FV Flowplayer Video Player 6.1.2 - 6.6.4 - Cross-Site Scripting",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "6.1.2 - 6.6.4",
    "from_version": "6.1.2",
    "from_inclusive": true,
    "to_version": "6.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-0642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0642",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BMI Adult \u0026 Kid Calculator  \u003c= 1.2.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "bmi-adultkid-calculator",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32550",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 7.3.10 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 7.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40698",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beds24 Online Booking \u003c= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beds24-online-booking",
    "type": "plugin",
    "affected_version": "* - 2.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31851",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSS JS Files \u003c= 1.5.0 - Authenticated (Admin+) Arbitrary File Read",
    "slug": "css-js-files",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9146",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Pre-Orders for WooCommerce \u003c= 1.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pre-orders-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46783",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – Purolator Edition \u003c= 2.2.3 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-purolator-freight-edition",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13474",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Mediabay \u003c= 1.6 - Missing Authorization via AJAC actions",
    "slug": "mediabay-lite",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46612",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Directory Kit \u003c= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2278",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "eMagicOne Store Manager for WooCommerce \u003c= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()",
    "slug": "store-manager-connector",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5058",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8102",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Manutenção \u003c= 1.0.6 - IP Spoofing to Maintenance Mode Bypass",
    "slug": "wp-manutencao",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22139",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flickr Gallery \u003c= 1.5.2 - Unauthenticated PHP Object Injection",
    "slug": "flickr-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-20207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20207",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS \u003c= 2.0.9 - Reflected Cross-Site Scripting",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0236",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Designil PDPA Thailand \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdpa-thailand",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58028",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Education \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via text_html_tag",
    "slug": "wp-education",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49630",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WH Testimonials \u003c= 3.0.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wh-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1372",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMS Alert Order Notifications – WooCommerce \u003c= 3.7.8 - Reflected Cross-Site Scripting",
    "slug": "sms-alert",
    "type": "plugin",
    "affected_version": "* - 3.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26984",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Settings Update",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3471",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 13.1.7 - Cross-Site Scripting",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "[*, 13.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-27231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27231",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Caldera SMTP Mailer \u003c= 1.0.1 - Missing Authorization",
    "slug": "caldera-smtp-mailer",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56003",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inline Image Upload for BBPress \u003c= 1.1.19 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "image-upload-for-bbpress",
    "type": "plugin",
    "affected_version": "* - 1.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2006",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.1",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.14",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.13",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.5",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.16",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.16",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.13",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.10",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.6",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.4",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5493",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Track Everything \u003c=  2.0.1 - Cross-Site Request Forgery",
    "slug": "track-everything",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53332",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BuddyForms \u003c= 2.7.7  - PHAR Deserialization",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-26326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26326",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Form Block \u003c= 1.5.5 - Unauthenticated Arbitrary File Upload",
    "slug": "form-block",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-54693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54693",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Related Posts \u003c 2.7.2 - Cross-Site Request Forgery",
    "slug": "related-posts",
    "type": "plugin",
    "affected_version": "[*, 2.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-3257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3257",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultra Demo Importer \u003c= 1.0.5 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "ut-demo-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32496",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Search Exclude \u003c= 1.2.6 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "search-exclude",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36282",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forms \u003c= 1.12.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "forms-by-made-it",
    "type": "plugin",
    "affected_version": "[*, 1.12.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24505",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar \u003c= 9.9 - Unauthenticated SQL Injection",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-1207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1207",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Builder: Pagelayer – Drag and Drop website builder \u003c= 1.1.1 - Missing Authorization to Cross-Site Scripting",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-35947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35947",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets \u0026 Elementor Templates) \u003c= 3.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4333",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple HTML Sitemap \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-simple-html-sitemap",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45067",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Multilingual \u0026 Multicurrency \u003c= 5.3.8 - Missing Authorization",
    "slug": "woocommerce-multilingual",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26888",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "bbPress Toolkit \u003c= 1.0.12 - Cross-Site Scripting",
    "slug": "bbp-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-34032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34032",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.0.3 - Access Control Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2010-5106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-5106",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "AFS Analytics \u003c= 4.15 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "addfreestats",
    "type": "plugin",
    "affected_version": "* - 4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37402",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin \u003c= 3.62 - Reflected Cross-Site Scripting",
    "slug": "real3d-flipbook-lite",
    "type": "plugin",
    "affected_version": "* - 3.62",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.62",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32694",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Insight Core \u003c= 1.0 - Authenticated PHP Object Injection \u0026 Stored Cross-Site Scripting",
    "slug": "insight-core",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24950",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "simple-git \u003c 3.15.0 - Remote Code Execution",
    "slug": "elasticpress",
    "type": "plugin",
    "affected_version": "* - 4.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-25912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25912",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "simple-git \u003c 3.15.0 - Remote Code Execution",
    "slug": "simple-podcasting",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-25912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25912",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "simple-git \u003c 3.15.0 - Remote Code Execution",
    "slug": "maps-block-apple",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-25912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25912",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "simple-git \u003c 3.15.0 - Remote Code Execution",
    "slug": "insert-special-characters",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-25912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25912",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "simple-git \u003c 3.15.0 - Remote Code Execution",
    "slug": "autoshare-for-twitter",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-25912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25912",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13644",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Raptive Ads \u003c= 3.6.3 - Missing Authorization to Unauthenticated Data/Settings Reset",
    "slug": "adthrive-ads",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13364",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ecwid Shopping Cart \u003c= 7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ecwid-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32195",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Toolkit Pro for LearnDash \u003c= 4.1.4 - Reflected Cross-Site Scripting",
    "slug": "uncanny-toolkit-pro",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37436",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Taxonomy Manager \u003c= 2.0 - Unauthenticated Cross-Site Scripting",
    "slug": "ultimate-taxonomy-manager",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45837",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MangBoard WP \u003c= 1.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Board Header And Footer",
    "slug": "mangboard",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3435",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Timeline \u003c 1.6.1 - Missing Authorization",
    "slug": "unlimited-timeline",
    "type": "plugin",
    "affected_version": "[*, 1.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-27008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27008",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Entrada \u003c= 5.7.7 - Cross-Site Request Forgery",
    "slug": "entrada",
    "type": "theme",
    "affected_version": "* - 5.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58918",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Perfect Survey \u003c= 1.5.2 - Cross-Site Request Forgery",
    "slug": "perfect-survey",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24763",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPAdmin AWS CDN \u003c= 2.0.13 - Cross-Site Request Forgery",
    "slug": "aws-cdn-by-wpadmin",
    "type": "plugin",
    "affected_version": "* - 2.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37889",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Support Ticket \u003c= 1.9 - Unauthenticated Privilege Escalation",
    "slug": "support-ticket",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49422",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPGYM - Wordpress Gym Management System \u003c= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover",
    "slug": "gym-management",
    "type": "plugin",
    "affected_version": "* - 67.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "67.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7049",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Account Page Editor \u003c= 1.3.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "my-account-page-editor",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4536",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photos and Files Contest Gallery \u003c= 21.3.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 21.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30238",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WATI Chat and Notification \u003c= 1.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wati-chat-and-notification",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28925",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StorePress \u003c= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "storepress",
    "type": "theme",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22821",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 12.0.4 - Stored Cross-Site Scripting",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 12.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-2136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2136",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All Embed – Elementor Addons \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "all-embed-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24595",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) \u003c= 7.5.14 - Cross-Site Request Forgery",
    "slug": "miniorange-login-openid",
    "type": "plugin",
    "affected_version": "* - 7.5.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23706",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Delivery Date for WooCommerce – Lite \u003c= 2.7.3 - Reflected Cross-Site Scripting",
    "slug": "product-delivery-date-for-woocommerce-lite",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9345",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vayu Blocks – Gutenberg Blocks for WordPress \u0026 WooCommerce \u003c= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation",
    "slug": "vayu-blocks",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10124",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Links Page \u003c= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-links-page",
    "type": "plugin",
    "affected_version": "* - 4.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22720",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Smart Wishlist for WooCommerce \u003c= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation",
    "slug": "woo-smart-wishlist",
    "type": "plugin",
    "affected_version": "* - 5.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11518",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Directorist \u003c= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1888",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads – htaccess Editor \u003c 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "easy-digital-downloads-htaccess-editor",
    "type": "plugin",
    "affected_version": "1.0.0",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9515",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AIHub \u003c= 1.3.7 - Unauthenticated Arbitrary File Upload in generate_image",
    "slug": "aihub",
    "type": "theme",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1093",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Doofinder \u003c= 0.5.4 - Reflected Cross-Site Scripting",
    "slug": "doofinder",
    "type": "plugin",
    "affected_version": "* - 0.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51697",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Vouchers \u003c= 4.9.4 - Missing Authorization",
    "slug": "woocommerce-pdf-vouchers",
    "type": "plugin",
    "affected_version": "* - 4.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39650",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor \u003c= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1802",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spacer \u003c= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "spacer",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3618",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google News \u003c= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "google-news",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46452",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.15",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.14",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.13",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.25",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.19",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.10",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.9",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.5",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.4",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.25",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.23",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.22",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.22",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajax Search Lite \u003c= 4.10.3 - Missing Authorization leading to Authenticated (Subscriber+) Sensitive Information Disclosure",
    "slug": "ajax-search-lite",
    "type": "plugin",
    "affected_version": "* - 4.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38456",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.5 - Cross-Site Request Forgery",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54356",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "reCAPTCHA for all \u003c= 1.22 - Missing Authorization via recaptcha_for_all_image_select",
    "slug": "recaptcha-for-all",
    "type": "plugin",
    "affected_version": "* - 1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32599",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce PensoPay \u003c= 6.3.1 - Reflected Cross-Site Scripting via 'pensopay_action'",
    "slug": "woo-pensopay",
    "type": "plugin",
    "affected_version": "* - 6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41691",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clerk \u003c= 3.8.2 -  Authorization Bypass via Insufficient Validation",
    "slug": "clerkio",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3907",
    "auth_type": "Unauth",
    "cvss_score": 5.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Classifieds Plugin – Ad Directory \u0026 Listings by AWP Classifieds \u003c 3.0 - Cross-Site Scripting",
    "slug": "another-wordpress-classifieds-plugin",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-10012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10012",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_start",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4161",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_start",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4161",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Go Maps (formerly WP Google Maps) \u003c= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11166",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Clockwork SMS Plugins - Multiple Versions - Cross-Site Scripting",
    "slug": "mediaburst-email-to-sms",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clockwork SMS Plugins - Multiple Versions - Cross-Site Scripting",
    "slug": "clockwork-two-factor-authentication",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clockwork SMS Plugins - Multiple Versions - Cross-Site Scripting",
    "slug": "booking-sms",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clockwork SMS Plugins - Multiple Versions - Cross-Site Scripting",
    "slug": "formidable-sms",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clockwork SMS Plugins - Multiple Versions - Cross-Site Scripting",
    "slug": "gravity-forms-sms-notifications",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clockwork SMS Plugins - Multiple Versions - Cross-Site Scripting",
    "slug": "contact-form-7-sms-addon",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clockwork SMS Plugins - Multiple Versions - Cross-Site Scripting",
    "slug": "mediaburst-ecommerce-sms-notifications",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clockwork SMS Plugins - Multiple Versions - Cross-Site Scripting",
    "slug": "fscf-sms",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flat PM \u003c= 2.661 - Reflected Cross-Site Scripting",
    "slug": "flatpm-wp",
    "type": "plugin",
    "affected_version": "* - 2.661",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.661",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3934",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Keyword Monitor \u003c= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-keyword-monitor",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25088",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Plugins and Themes in ZIP from Dashboard \u003c= 1.9.1 - Reflected Cross-Site Scripting",
    "slug": "download-plugins-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9232",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Error Log Viewer by BestWebSoft \u003c 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "error-log-viewer",
    "type": "plugin",
    "affected_version": "[*, 1.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18562",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.7.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43282",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Passster \u003c= 3.5.5.5.1 - Insecure Password Storage to Sensitive Data Exposure",
    "slug": "content-protector",
    "type": "plugin",
    "affected_version": "* - 3.5.5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3206",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Visit Counter \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "visit-counter",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49065",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager \u003c= 4.57 - Sensitive File Disclosure",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.57",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1551",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Themify – WooCommerce Product Filter \u003c= 1.4.3 - Cross-Site Request Forgery",
    "slug": "themify-wc-product-filter",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2262",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.8.30 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10704",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BSK PDF Manager \u003c= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bsk-pdf-manager",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38767",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Virtual Assistant \u003c= 3.0 - Missing Authorization",
    "slug": "VirtualAssistant",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60155",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stetic \u003c= 1.0.6 Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "stetic",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-42364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42364",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Poll Maker \u003c= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 6.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57954",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Downloader \u003c= 0.4.7.4 - Reflected Cross-Site Scripting",
    "slug": "media-downloader",
    "type": "plugin",
    "affected_version": "* - 0.4.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54322",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeepSo Core: File Uploads \u003c= 6.4.6.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via file_download",
    "slug": "peepso-files",
    "type": "plugin",
    "affected_version": "* - 6.4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8988",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Shopping Cart \u0026 eCommerce Store \u003c= 5.7.2 - Authenticated (Contributor+) SQL Injection via model_number Parameter",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7827",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Maps Plugin by Intergeo \u003c= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "intergeo-maps",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4887",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Debug-Bar-Extender \u003c= 0.5 - Reflected Cross-Site Scripting",
    "slug": "debug-bar-extender",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26555",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carousel Slider \u003c= 2.2.6 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "responsive-tabs",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1712",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Last Modified \u003c= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-last-modified",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28907",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Keymaster Chord Notation Free \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "keymaster-chord-notation-free",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51809",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Job Board \u003c= 2.10.3 - Cross-Site Request Forgery via sjb_save_settings_section",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "* - 2.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29440",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.6.3 - Insecure Direct Object Reference",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1289",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Slim SEO \u003c= 4.5.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "slim-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49854",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Robo Gallery \u003c= 3.2.9 - Cross-Site Request Forgery via getPluginStatus",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45804",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MailChimp Subscribe Forms  \u003c= 4.0.9.3 - Open Redirect",
    "slug": "mailchimp-subscribe-sm",
    "type": "plugin",
    "affected_version": "* - 4.0.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32517",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Countdown, Coming Soon, Maintenance – Countdown \u0026 Clock \u003c= 2.3.2 - Cross-Site Scripting",
    "slug": "countdown-builder",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29422",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L"
  },
  {
    "title": "Livestream Notice \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "livestream-notice",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27621",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magazine Blocks \u003c= 1.3.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magazine-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56258",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz and Survey Master \u003c= 9.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 9.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6025",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yml for Yandex Market \u003c= 3.10.7 - Reflected Cross-Site Scripting",
    "slug": "yml-for-yandex-market",
    "type": "plugin",
    "affected_version": "[*, 3.10.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-30473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30473",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tags to Keywords \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-site Scripting",
    "slug": "tags-to-meta-keywords",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22685",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Canada Post Shipping \u003c= 2.8.3 - Cross-Site Request Forgery",
    "slug": "woocommerce-shipping-canada-post",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47789",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FooGallery \u003c= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 2.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2471",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog Designer PRO for WordPress \u003c= 3.4.7 - Reflected Cross-Site Scripting",
    "slug": "blog-designer-pro",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47694",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Docs \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-docs",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6787",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple 301 Redirects 2.0.0 - 2.0.3 - Authenticated Arbitrary Plugin Installation",
    "slug": "simple-301-redirects",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.0.3",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24354",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Paytium: Mollie payment forms \u0026 donations \u003c= 4.3.7 - Missing Authorization in 'check_for_verified_profiles'",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7290",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce \u003c= 3.1.37.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-event-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.37.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.37.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4423",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "APIExperts Square for WooCommerce \u003c= 4.4.1 - Missing Authorization",
    "slug": "woosquare",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47182",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP CSV Exporter \u003c= 1.3.6 - CSV Injection",
    "slug": "wp-csv-exporter",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3605",
    "auth_type": "Privileged",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "POEditor \u003c= 0.9.4 - Cross-Site Request Forgery",
    "slug": "poeditor",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32091",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Top Bar – PopUps – by WPOptin \u003c= 2.0.8 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wpoptin",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25118",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mixcloud Embed \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mixcloud-embed",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46501",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mambo Importer \u003c= 1.0 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "mambo-joomla-importer",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13899",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widget",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2792",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Frontend \u003c= 3.6.5 - Authenticated (Author+) Privilege Escalation",
    "slug": "wp-user-frontend",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47682",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Shipping And Billing Address For Woocommerce \u003c= 1.2 - Unauthenticated SQL Injection",
    "slug": "different-shipping-and-billing-address-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56290",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Htaccess \u003c= 1.8.1 - Cross-Site Request Forgery",
    "slug": "htaccess",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-8658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8658",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UiCore Elements \u003c= 1.3.0 - Missing Authorization to Unauthenticated Arbitrary File Read",
    "slug": "uicore-elements",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6253",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Emma for WordPress \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "emma-emarketing-plugin",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32166",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6486",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MK Google Directions \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-distance-calculator",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12820",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdServe \u003c 0.3 - SQL Injection",
    "slug": "adserve",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-0507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0507",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Klaviyo \u003c= 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "klaviyo",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25456",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InfiniteWP Client \u003c= 1.6.0 - Unauthenticated PHP Object Injection",
    "slug": "iwp-client",
    "type": "plugin",
    "affected_version": "[*, 1.6.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-15004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-15004",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pie Register Premium \u003c 3.8.3.3 - Missing Authorization",
    "slug": "pie-register-premium",
    "type": "plugin",
    "affected_version": "[*, 3.8.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-52391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52391",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple 301 Redirects 2.0.0 - 2.0.3 - Authenticated Wildcard Activation and Retrieval",
    "slug": "simple-301-redirects",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.0.3",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24355",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CURCY \u003c= 2.3.7 - Missing Authorization to Arbitrary Shortcode Execution",
    "slug": "woocommerce-multi-currency",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47563",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PJ News Ticker \u003c= 1.9.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "pj-news-ticker",
    "type": "plugin",
    "affected_version": "* - 1.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25094",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3D Avatar User Profile \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "3d-avatar-user-profile",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54358",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Show notice or message on admin area \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "show-notice-or-message-on-admin-area",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25075",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GetSocial \u003c= 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "getsocial",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22283",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Getwid \u003c= 2.1.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58252",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcut Macros \u003c= 1.3 - Missing Authorization to Settings Update",
    "slug": "shortcut-macros",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1956",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Post SMTP \u003c= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13844",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Timeline Designer \u003c= 1.4 - Authenticated (Admin+) SQL Injection",
    "slug": "timeline-designer",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11437",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Responsive Blocks – WordPress Gutenberg Blocks \u003c= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-block-editor-addons",
    "type": "plugin",
    "affected_version": "* - 1.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43335",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fudousan Plugin \u003c= 5.7.0 - Cross-Site Scripting",
    "slug": "fudousan-plugin",
    "type": "plugin",
    "affected_version": "* - 5.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20749",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Video Playlist For YouTube \u003c= 6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "video-playlist-for-youtube",
    "type": "plugin",
    "affected_version": "* - 6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32183",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Catalyst Connect Zoho CRM Client Portal \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "catalyst-connect-client-portal",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0588",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.4 - Missing Authorization to Arbitrary Post Duplication",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5385",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Text To Speech TTS Accessibility \u003c= 1.9.24 - Missing Authorization",
    "slug": "text-to-audio",
    "type": "plugin",
    "affected_version": "* - 1.9.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58664",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Cozy Blocks \u003c= 2.1.29 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "cozy-addons",
    "type": "plugin",
    "affected_version": "* - 2.1.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59573",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Vayu Blocks – Gutenberg Blocks for WordPress \u0026 WooCommerce \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "vayu-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22644",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SuperBackup \u003c= 2.3.3 - Missing Authorization",
    "slug": "indeed-wp-superbackup",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56070",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tevolution  \u003c 2.3.0 - Arbitrary File Upload",
    "slug": "Tevolution",
    "type": "plugin",
    "affected_version": "[*, 2.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10995",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VikRestaurants Table Reservations and Take-Away \u003c= 1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "vikrestaurants",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46251",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Database Toolset \u003c= 1.8.4 - Unauthenticated Sensitive Information Exposure via Backup Files",
    "slug": "database-toolset",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4222",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Newspack Content Converter \u003c= 0.1.5 - Missing Authorization",
    "slug": "newspack-content-converter",
    "type": "plugin",
    "affected_version": "* - 0.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37477",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Al Pack \u003c= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function",
    "slug": "alpack",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7664",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Google Maps Travel Route \u003c= 1.3.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "google-maps-travel-route",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22537",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.6.8.7 - Unauthenticated SQL Injection",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.6.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30774",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Discord Invite \u003c= 2.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-discord-invite",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5181",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress Export Import \u003c= 4.0.3 - Reflected Cross-Site Scripting",
    "slug": "learnpress-import-export",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32588",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Submitted Posts \u003c= 20190312 - Unauthenticated Arbitrary File Upload",
    "slug": "user-submitted-posts",
    "type": "plugin",
    "affected_version": "[*, 20190426)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20190426",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-25138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25138",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YARPP \u003c= 5.30.10 - Missing Authorization",
    "slug": "yet-another-related-posts-plugin",
    "type": "plugin",
    "affected_version": "* - 5.30.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.30.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43919",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Image Zoom \u003c= 1.46 - Local File Inclusion",
    "slug": "wp-image-zoooom",
    "type": "plugin",
    "affected_version": "* - 1.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24447",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JS Help Desk \u003c= 2.9.2 - Unauthenticated Local File Inclusion",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30901",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP EasyCart \u003c= 5.5.19 - Cross-Site Request Forgery",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.5.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32452",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Plugin for Google Reviews \u003c= 2.2.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "widget-google-reviews",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-44580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44580",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordLift \u003c= 3.54.4 - Missing Authorization",
    "slug": "wordlift",
    "type": "plugin",
    "affected_version": "* - 3.54.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.54.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30624",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GPP Slideshow \u003c= 1.3.5 - Missing Authorization",
    "slug": "gpp-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28996",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Comment License \u003c= 1.3.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "comment-license",
    "type": "plugin",
    "affected_version": "[*, 1.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1957",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SMM API \u003c= 6.0.30 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "smm-api",
    "type": "plugin",
    "affected_version": "* - 6.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.30",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31855",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cron Jobs \u003c= 1.2.9 - Reflected Cross-Site Scripting",
    "slug": "leira-cron-jobs",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8731",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Alojapro Widget \u003c= 1.1.15 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "alojapro-widget",
    "type": "plugin",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24530",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maps by BestWebSoft \u003c= 1.3.5 - Reflected Cross-Site Scripting",
    "slug": "bws-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18557",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "authLdap \u003c= 2.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "authldap",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-41655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41655",
    "auth_type": "Privileged",
    "cvss_score": 3.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Pixobe Cartography \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "pixobe-cartography",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Lightbox 2 \u003c= 3.0.6.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-lightbox-2",
    "type": "plugin",
    "affected_version": "* - 3.0.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3745",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Certifica WP \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via evento Parameter",
    "slug": "certifica-wp",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8316",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced iFrame \u003c= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 2023.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2023.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7069",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Manager \u003c= 3.0 - Stored Cross-Site Scripting",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-16967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16967",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0954",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Store Locator Widget \u003c= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "store-locator-widget",
    "type": "plugin",
    "affected_version": "* - 2025r1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2025r1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13657",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.1.13 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43984",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JoomSport \u003c= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion",
    "slug": "joomsport-sports-league-results-management",
    "type": "plugin",
    "affected_version": "* - 5.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7721",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPC Smart Compare for WooCommerce \u003c= 6.4.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "woo-smart-compare",
    "type": "plugin",
    "affected_version": "* - 6.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7496",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DeepL Pro API Translation \u003c= 1.7.4 - Sensitive Information Disclosure",
    "slug": "wpdeepl",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3691",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Slideshow \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gallery-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37246",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "More Link Modifier \u003c= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "more-link-modifier",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23818",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link Optimizer Lite \u003c= 1.4.5 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "link-optimizer-lite",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2540",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Boo Recipes \u003c= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "boo-recipes",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31759",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Markdown Editor (Formerly Dark Mode) \u003c 1.7 - Cross-Site Scripting",
    "slug": "dark-mode",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5651",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend File Manager \u0026 Sharing – User Private Files \u003c= 1.1.2 - Subscriber+ Arbitrary File Upload",
    "slug": "user-private-files",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2356",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEO Backlinks \u003c= 4.0.1 - Cross-Site Request Forgery",
    "slug": "seo-backlinks",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-34632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34632",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BBSpoiler \u003c= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "bbspoiler",
    "type": "plugin",
    "affected_version": "* - 2.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23873",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CC-IMG-Shortcode \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cc-img-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1559",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MobiLoud – WordPress Mobile Apps – Convert your WordPress Website to Native Mobile Apps \u003c 2.3.8 - Cross-Site Scripting",
    "slug": "mobiloud-mobile-app-plugin",
    "type": "plugin",
    "affected_version": "[*, 2.3.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-5344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5344",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formcraft3 \u003c= 3.8.27 - Server Side Request Forgery",
    "slug": "formcraft-form-builder",
    "type": "plugin",
    "affected_version": "[*, 3.8.28)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.28",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0591",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "WordPress Google Map Professional \u003c= 1.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "google-map-professional",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23913",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Website Content in Page or Post \u003c= 2024.03.27 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "show-website-content-in-wordpress-page-or-post",
    "type": "plugin",
    "affected_version": "* - 2024.03.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.03.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2430",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Small Package Quotes – Worldwide Express Edition \u003c= 5.2.19 - Missing Authorization",
    "slug": "small-package-quotes-wwe-edition",
    "type": "plugin",
    "affected_version": "* - 5.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30915",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Seriously Simple Stats \u003c= 1.6.0 - Reflected Cross-Site Scripting",
    "slug": "seriously-simple-stats",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8738",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Networker - Tech News WordPress Theme with Dark Mode \u003c= 1.1.9 - Missing Authorization",
    "slug": "networker",
    "type": "theme",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2962",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cloak Front End Email \u003c= 1.9.5 - Missing Authorization",
    "slug": "cloak-front-end-email",
    "type": "plugin",
    "affected_version": "* - 1.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26968",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElasticPress \u003c= 3.5.3 - Cross-Site Request Forgery Bypass",
    "slug": "elasticpress",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4405",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor – Header, Footer \u0026 Blocks Template \u003c= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33933",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KBucket \u003c= 4.2.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "kbucket",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52369",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Sessions Time Monitoring Full Automatic \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "activitytime",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24718",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 14.15 - Missing Authorization",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 14.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-55716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-55716",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sky Addons for Elementor \u003c= 2.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sky-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47332",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CF7 7 Mailchimp Add-on \u003c= 2.2 - Missing Authorization",
    "slug": "CF7-mailchimp-addon",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29012",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Database Optimizer \u003c= 1.2.1.3 - Cross-Site Request Forgery",
    "slug": "wp-database-optimizer",
    "type": "plugin",
    "affected_version": "* - 1.2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31474",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Infusionsoft Gravity Forms Add-on \u003c 1.5.7 - Cross-Site Scripting",
    "slug": "infusionsoft",
    "type": "plugin",
    "affected_version": "[*, 1.5.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4536",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfect Pullquotes \u003c= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "perfect-pullquotes",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33951",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ECT Social Share \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ect-social-share",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54405",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Warfare \u003c= 3.5.2 - Unauthenticated Arbitrary Settings Update",
    "slug": "social-warfare",
    "type": "plugin",
    "affected_version": "[*, 3.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-9978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9978",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "News Publisher Autopilot \u003c= 2.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wpm-news-api",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22557",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Get Custom Field Values \u003c 4.0 - Arbitrary Post Metadata Access",
    "slug": "get-custom-field-values",
    "type": "plugin",
    "affected_version": "[*, 4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24872",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "KD Coming Soon \u003c= 1.7 - Unauthenticated PHP Object Injection via cetitle",
    "slug": "kd-coming-soon",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46615",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Homey Login Register \u003c= 2.4.0 - Unauthenticated Privilege Escalation",
    "slug": "homey-login-register",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-51888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51888",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Auto Excerpt everywhere \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "auto-excerpt-everywhere",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46776",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Futurio Extra \u003c= 2.0.13 - Authenticated (Contributor+) Post Disclosure",
    "slug": "futurio-extra",
    "type": "plugin",
    "affected_version": "* - 2.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10695",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "File Manager \u003c= 7.2.5 - Authenticated (Administrator+) Directory Traversal",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "* - 7.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2654",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.36.0 - Missing Authorization in Reviews Exporter",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.36.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.36.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45101",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Infinite Scroll – Ajax Load More \u003c= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2433",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Countdown Timer \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "countdown-timer-block",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10631",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slim SEO \u003c= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcode",
    "slug": "slim-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4611",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Classified Listings \u003c= 1.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "ultimate-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9874",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GDPR-Extensions-com – Consent Manager \u003c= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "gdpr-consent-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9072",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Remove Footer Credit \u003c= 1.0.13 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "remove-footer-credit",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32429",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Yelp Review Slider \u003c= 8.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-yelp-review-slider",
    "type": "plugin",
    "affected_version": "* - 8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26946",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Left right image slideshow gallery \u003c= 12.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "left-right-image-slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5431",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Graphina - Elementor Charts and Graphs \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "graphina-elementor-charts-and-graphs",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8867",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDiscuz \u003c= 7.6.33 - Missing Authorization",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59591",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mesmerize \u003c= 1.6.120 - Cross-Site Request Forgery to Cache Clearing",
    "slug": "mesmerize",
    "type": "theme",
    "affected_version": "* - 1.6.120",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.120",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37431",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Site Reviews \u003c= 6.11.4 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display name",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "* - 6.11.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.11.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2293",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Invico - WordPress Consulting Business Theme \u003c= 1.9 - Reflected Cross-Site Scripting",
    "slug": "invico",
    "type": "theme",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31427",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdSanity \u003c 1.8.2 - Authenticated Arbitrary File Upload",
    "slug": "adsanity",
    "type": "plugin",
    "affected_version": "[*, 1.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-4949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4949",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Job Openings \u003c= 3.4.2 - Information Exposure",
    "slug": "wp-job-openings",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-4933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4933",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Poll Maker – Versus Polls, Anonymous Polls, Image Polls \u003c= 5.8.9 - Unauthenticated Basic Information Exposure",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12575",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin \u003c= 4.0.37 - Unauthenticated Server-Side Request Forgery",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7813",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Blocks – WordPress Blocks Plugin \u003c= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via title tag attribute",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3513",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CodeColorer \u003c= 0.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "codecolorer",
    "type": "plugin",
    "affected_version": "* - 0.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2795",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Tables – Easy Data Table Builder \u003c= 5.0.18 - Unauthenticated Server-Side Request Forgery",
    "slug": "ninja-tables",
    "type": "plugin",
    "affected_version": "* - 5.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2940",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Toolbar Extras for Elementor \u0026 More – WordPress Admin Bar Enhanced \u003c= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "toolbar-extras",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3611",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Medical Prescription Attachment Plugin for WooCommerce \u003c= 1.2.3 - Unauthenticated Arbitrary File Upload",
    "slug": "medical-prescription-attachment-plugin-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-29009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29009",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Borderless – Widgets, Elements, Templates and Toolkit for Elementor \u0026 Gutenberg \u003c= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "borderless",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34757",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reactflow Visitor Recording and Heatmaps \u003c= 1.0.10 - Reflected Cross-Site Scripting",
    "slug": "reactflow-session-replay-heatmap",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11975",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5349",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Binge Site Verification using Meta Tag \u003c= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Admin Settings",
    "slug": "bing-site-verification-using-meta-tag",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23875",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Lead Form \u003c 0.6 - Cross-Site Scripting",
    "slug": "video-lead-form",
    "type": "plugin",
    "affected_version": "[*, 0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6312",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shopify to WooCommerce Migration \u003c= 1.3.0 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "migrate-shopify-to-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31795",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pays – WooCommerce Payment Gateway \u003c= 2.6 - Cross-Site Request Forgery",
    "slug": "axima-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47648",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pay With Tweet \u003c= 1.1 - Cross-Site Scripting",
    "slug": "pay-with-tweet",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-5349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5349",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Share VOD – Turnkey Video Site Builder Script \u003c= 2.6.31 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "video-share-vod",
    "type": "plugin",
    "affected_version": "* - 2.6.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13393",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Robo Gallery \u003c= 3.2.17 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22295",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate AJAX Login \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "ultimate-ajax-login",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58854",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Social Share Buttons \u003c= 9.4 - Reflected Cross-Site Scripting",
    "slug": "easy-social-share-buttons3",
    "type": "plugin",
    "affected_version": "* - 9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30196",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Transition \u003c= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "page-transition",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49412",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kodex Posts likes \u003c= 2.5.0 - Reflected Cross-Site Scripting",
    "slug": "kodex-posts-likes",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43217",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Scheduled \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "scheduled",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31375",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Instant CSS \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "instant-css",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44243",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Homey Login Register \u003c= 2.4.0 - Unauthenticated Privilege Escalation in homey_register",
    "slug": "homey-login-register",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11951",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pure Chat – Live Chat Plugin \u0026 More! \u003c= 2.22 - Cross-Site Request Forgery",
    "slug": "pure-chat",
    "type": "plugin",
    "affected_version": "* - 2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35673",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Comments Import \u0026 Export \u003c= 2.0.4 - CSV Injection",
    "slug": "comments-import-export-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-11526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11526",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_size",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "0.1.0 - 3.1.3",
    "from_version": "0.1.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24206",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rock Convert \u003c= 2.10.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "rock-convert",
    "type": "plugin",
    "affected_version": "* - 2.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3441",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.5.4 - Authorization Bypass",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-20360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20360",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "LMS \u003c= 9.1 - Unauthenticated SQL Injection",
    "slug": "lms",
    "type": "theme",
    "affected_version": "* - 9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52833",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Booking Calendar \u003c= 8.9.1 - Reflected Cross-Site Scripting",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 8.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25040",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "http-cache-semantics \u003c 4.1.1 - Regular Expression Denial of Service (ReDoS)",
    "slug": "simple-local-avatars",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25881",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Free WooCommerce Theme 99fy Extension \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "99fy-core",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22801",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LeadConnector \u003c= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "leadconnector",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30893",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Sermons \u003c= 3.2 - Reflected Cross-Site Scripting",
    "slug": "advanced-sermons",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27952",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AMP for WP \u003c= 1.0.96.1 - Missing Authorization",
    "slug": "accelerated-mobile-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.96.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.96.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43146",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type'",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37479",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Discord Invite \u003c= 2.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-discord-invite",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47638",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seraphinite Post .DOCX Source \u003c= 2.16.6 - Cross-Site Request Forgery",
    "slug": "seraphinite-post-docx-source",
    "type": "plugin",
    "affected_version": "* - 2.16.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48279",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Interactive Polish Map \u003c= 1.2 - Authenticated (Admi+) Stored Cross-Site Scripting",
    "slug": "interactive-polish-map",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23821",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "3.3 - 3.3.5",
    "from_version": "3.3",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "3.4 - 3.4.7",
    "from_version": "3.4",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "3.5 - 3.5.8",
    "from_version": "3.5",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "3.8 - 3.8.1",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "3.9 - 3.9.3",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "4.2 - 4.2.2",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "4.6 - 4.6.2",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "4.9 - 4.9.2",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "[*, 3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "3.6 - 3.6.5",
    "from_version": "3.6",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "4.0 - 4.0.1",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "4.1 - 4.1.1",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "4.4 - 4.4.1",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "4.7 - 4.7.1",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "4.8",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "5.0",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "3.7 - 3.7.1",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "4.3 - 4.3.3",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "4.5 - 4.5.2",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "5.4 - 5.4.1",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "5.5",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "5.1",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "5.2 - 5.2.2",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c 5.5 - Authenticated Blind SQL Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "5.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-32790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-32790",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ST Categories Widget \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "st-category-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11878",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "e-Boekhouden.nl \u003c= 1.9.3 - Reflected Cross-Site Scripting",
    "slug": "e-boekhoudennl-connector",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53225",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress \u003c= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "buddypress",
    "type": "plugin",
    "affected_version": "* - 12.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4892",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome WordPress Timeline Plugin \u003c= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "awesome-timeline",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sticky Radio Player \u003c= 3.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "lbg-audio5-html5-shoutcast_sticky",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31926",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Woody code snippets – Insert Header Footer Code, AdSense Ads \u003c= 2.5.0 -Authenticated (Contributor+) Remote Code Execution",
    "slug": "insert-php",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3105",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 Database Addon \u003c= 1.2.5.4 - CSV Injection",
    "slug": "contact-form-cfdb7",
    "type": "plugin",
    "affected_version": "[*, 1.2.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24144",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Optimizer, Resizer and CDN – Sirv \u003c 1.3.2 - SQL Injection",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "[*, 1.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10950",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form to DB by BestWebSoft \u003c= 1.7.0 - Authenticated (Contributor+) SQL Injection via cntctfrmtdb_department",
    "slug": "contact-form-to-db",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-29096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29096",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mergado Pack \u003c= 4.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mergado-marketing-pack",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32669",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.34 - Sensitive Information Disclosure",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "[*, 3.2.35)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.35",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-25087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25087",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Enjoy Social Feed \u003c= 6.2.2 - Missing Authorization",
    "slug": "enjoy-instagram-instagram-responsive-images-gallery-and-carousel",
    "type": "plugin",
    "affected_version": "* - 6.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0779",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AIT CSV import/export \u003c= 3.0.3 - Unauthenticated Arbitrary File Upload",
    "slug": "ait-csv-import-export",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36849",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AvaiBook \u003c= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "avaibook",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30540",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sheets To WP Table Live Sync \u003c= 3.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sheets-to-wp-table-live-sync",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34375",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event post \u003c= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "event-post",
    "type": "plugin",
    "affected_version": "* - 5.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49298",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Duplica \u003c= 0.6 - Authenticated (Subscriber+) Missing Authorization to Users/Posts Duplicates Creation",
    "slug": "duplica",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5997",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons \u003c= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via link",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30185",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recommend to a friend \u003c= 2.2.2 - Cross-Site Scripting",
    "slug": "recommend-a-friend",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-7276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7276",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GoUrl Bitcoin Payment Gateway \u0026 Paid Downloads \u0026 Membership \u003c= 1.4.13 - Arbitrary File Upload",
    "slug": "gourl-bitcoin-payment-gateway-paid-downloads-membership",
    "type": "plugin",
    "affected_version": "* - 1.4.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-1010209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1010209",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pesapal Gateway for Woocommerce \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "pesapal-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30579",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wholesale Market for WooCommerce \u003c= 1.0.7 - Authenticated (Administrator+) Arbitrary File Download",
    "slug": "wholesale-market-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4108",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Team – Team Members Showcase Plugin \u003c= 4.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "tlp-team",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9236",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sticky Popup \u003c= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "sticky-popup",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1750",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Express Checkout \u003c= 2.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting via pec_coupon[code]",
    "slug": "wp-express-checkout",
    "type": "plugin",
    "affected_version": "2.2.8",
    "from_version": "2.2.8",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1469",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Button Builder – Buttons X \u003c= 0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "buttons-x",
    "type": "plugin",
    "affected_version": "* - 0.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23867",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Waitlist Woocommerce ( Back in stock notifier ) \u003c= 2.5.1 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "waitlist-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0215",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Phone Orders for WooCommerce \u003c= 3.7.1 - Missing Authorization",
    "slug": "phone-orders-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41655",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Progress Planner \u003c= 0.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "progress-planner",
    "type": "plugin",
    "affected_version": "* - 0.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37422",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Invoice – Web Invoice and Billing \u003c= 4.1.0 - Privilege Escalation",
    "slug": "wp-invoice",
    "type": "plugin",
    "affected_version": "[*, 4.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-11011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11011",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Download Button Shortcode \u003c= 1.0 - Information Disclosure via Arbitrary File Downloads",
    "slug": "simple-download-button-shortcode",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-10016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10016",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Easy Admin Menu \u003c= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-admin-menu",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33929",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting via Email Settings",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 9.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2603",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5188",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StopBadBots \u003c= 7.23 - Missing Authorization to Arbitrary Plugin Installation",
    "slug": "stopbadbots",
    "type": "plugin",
    "affected_version": "* - 7.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3883",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "2kb Amazon Affiliates Store \u003c 2.1.1 - Reflected Cross-Site Scripting",
    "slug": "2kb-amazon-affiliates-store",
    "type": "plugin",
    "affected_version": "[*, 2.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-14622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14622",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Attorney \u003c= 3 - Reflected Cross-Site Scripting",
    "slug": "attorney",
    "type": "theme",
    "affected_version": "* - 3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41692",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Admin JavaScript \u003c= 2.0 - Unauthenticated Full Path Dislcosure",
    "slug": "add-admin-javascript",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6548",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Cookie Consent ( for GDPR, CCPA \u0026 ePrivacy ) \u003c= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion",
    "slug": "gdpr-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3599",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow \u003c= 1.3.9 - Missing Authorization",
    "slug": "media-slider",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35717",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Akismet Spam Protection \u003c 2.0.2 - Cross-Site Scripting",
    "slug": "akismet",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-2714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-2714",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontier Post \u003c= 6.1 - Cross-Site Request Forgery",
    "slug": "frontier-post",
    "type": "plugin",
    "affected_version": "* - 6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6137",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP OpenSearch \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-opensearch",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23671",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Captcha \u003c= 0.0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "contact-form-7-simple-recaptcha",
    "type": "plugin",
    "affected_version": "[*, 0.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24565",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Translation Exchange \u003c= 1.0.14 - Stored Cross-Site Scripting",
    "slug": "translation-exchange",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25057",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ParOne Feeds \u003c= 1.17.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "parone",
    "type": "plugin",
    "affected_version": "* - 1.17.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51874",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Text Prompter – Unlimited chatgpt text prompts for openai tasks \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ai-content",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11896",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Real Estate \u003c= 3.9.5 - Reflected Cross-Site-Scripting",
    "slug": "essential-real-estate",
    "type": "plugin",
    "affected_version": "* - 3.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3933",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FeedWordPress \u003c= 2021.0713 - Reflected Cross-Site Scripting",
    "slug": "feedwordpress",
    "type": "plugin",
    "affected_version": "* - 2021.0713",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2021.0713",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25055",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.0.7 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-0233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-0233",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MDJM Event Management \u003c= 1.7.6 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "mobile-dj-manager",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52824",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Cumulus \u003c 1.22 - Cross-Site Scripting",
    "slug": "wp-cumulus",
    "type": "plugin",
    "affected_version": "[*, 1.22)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2009-4169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-4169",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Orange Form \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "orange-form",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24688",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "portfolio-and-projects",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "html5-videogallery-plus-player",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "wp-testimonial-with-widget",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "wp-slick-slider-and-image-carousel",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "accordion-and-accordion-slider",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "wp-logo-showcase-responsive-slider-slider",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "album-and-image-gallery-plus-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "meta-slider-and-carousel-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "blog-designer-for-post-and-widget",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "sp-news-and-widget",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "wp-trending-post-slider-and-widget",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "countdown-timer-ultimate",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "wp-featured-content-and-slider",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "ticker-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "wp-team-showcase-and-slider",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "post-grid-and-filter-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "wp-blog-and-widgets",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "featured-post-creative",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "timeline-and-history-slider",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "popup-anything-on-click",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "sp-faq",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple WPOnlineSupport Plugins \u003c= (Various Versions) - Missing Authorization to Notice Dismissal",
    "slug": "wp-responsive-recent-post-slider",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40200",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SendPress Newsletters \u003c= 1.23.11.6 - Reflected Cross-Site Scripting",
    "slug": "sendpress",
    "type": "plugin",
    "affected_version": "* - 1.23.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47517",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZoomSounds \u003c= 6.91 - Reflected Cross-Site Scripting",
    "slug": "dzs-zoomsounds",
    "type": "plugin",
    "affected_version": "* - 6.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro CCBill Gateway \u003c= 0.3 - Insufficient Authorization",
    "slug": "pmpro-ccbill",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40608",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Betheme \u003c= 26.6.2 - Missing Authorization to Post Status Change",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 26.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45351",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Weather Effect – Christmas Santa Snow Falling \u003c= 1.3.5 - Stored Cross-Site Scripting",
    "slug": "weather-effect",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24709",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz and Survey Master \u003c= 7.0.0 - Unauthenticated Arbitrary File Deletion",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "[*, 7.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-35951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35951",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Hermit 音乐播放器 \u003c= 3.1.6 - Unauthenticated SQL Injection",
    "slug": "hermit",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-29411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29411",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ADIF Log Search Widget \u003c= 1.0f - Reflected Cross-Site Scripting",
    "slug": "adif-log-search-widget",
    "type": "plugin",
    "affected_version": "* - 1.0f",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0f",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49238",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BookPress – For Book Authors \u003c= 1.2.7 - Missing Authorization",
    "slug": "book-press",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25167",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.9.9 - Unauthenticated Full Path Disclosure",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7411",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Custom 404 Pro \u003c= 3.7.1 - Cross-Site Request Forgery",
    "slug": "custom-404-pro",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0385",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Airbnb Review Slider \u003c= 3.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-airbnb-review-slider",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26755",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Restaurant Menu – Food Ordering System – Table Reservation \u003c= 2.3.1 - Cross-Site Request Forgery",
    "slug": "menu-ordering-reservations",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3776",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mail Masta Plugin \u003c= 1.0 - SQL Injection via filter_list",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6574",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50889",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RDP inGroups+ \u003c= 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "rdp-ingroups",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23546",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Flickr Gallery \u003c= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "responsive-flickr-gallery",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51630",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Verbalize WP \u003c= 1.0 - Unauthenticated Arbitrary File Upload",
    "slug": "verbalize-wp",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49668",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Active Products Tables for WooCommerce. Use constructor to create tables  \u003c= 1.0.6.3 - Reflected Cross-Site Scripting",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35730",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "turboSMTP \u003c= 4.6 - Reflected Cross-Site Scripting via 'page'",
    "slug": "turbosmtp",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12323",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1291",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProductDyno \u003c= 1.0.24 - Reflected Cross-Site Scripting via 'res' Parameter",
    "slug": "productdyno",
    "type": "plugin",
    "affected_version": "* - 1.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13413",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Currency Switcher for WooCommerce \u003c= 2.16.2 - Reflected Cross-Site Scripting",
    "slug": "currency-switcher-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.16.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9217",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Block for Font Awesome \u003c= 1.4.0 - Cross-Site Request Forgery",
    "slug": "block-for-font-awesome",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49751",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Post View Generator \u003c= 0.4.6 - Reflected Cross-Site Scripting",
    "slug": "custom-post-view-generator",
    "type": "plugin",
    "affected_version": "* - 0.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24605",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteOrigin Widgets Bundle \u003c= 1.61.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widget",
    "slug": "so-widgets-bundle",
    "type": "plugin",
    "affected_version": "* - 1.61.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.61.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5090",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advance Seat Reservation Management for WooCommerce \u003c= 3.3 - Unauthenticated SQL Injection",
    "slug": "scw-seat-reservation",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13344",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Icegram Express \u003c= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.6.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.23",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5414",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "SC filechecker \u003c= 0.6 - Authenticated (Admin+) Arbitrary File Deletion",
    "slug": "wp-file-checker",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35743",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WooCommerce Checkout \u0026 Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce \u003c= 1.5.15 - Cross-Site Request Forgery Bypass",
    "slug": "cartflows",
    "type": "plugin",
    "affected_version": "[*, 1.5.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36736",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Knowledge Base \u003c= 2.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Slug",
    "slug": "knowledgebase",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7431",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cloud Templates \u0026 Patterns collection \u003c= 1.2.2 - Sensitive Information Exposure via Log File",
    "slug": "templates-patterns-collection",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47529",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.0.5 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-0106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-0106",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Menu \u003c= 3.1.3 - Cross-Site Request Forgery",
    "slug": "responsive-menu",
    "type": "plugin",
    "affected_version": "[*, 3.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18513",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Slider for WooCommerce \u003c= 1.13.50 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-products-slider",
    "type": "plugin",
    "affected_version": "* - 1.13.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45459",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-bulk-product-editing",
    "type": "plugin",
    "affected_version": "* - 1.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-zoom-magnifier",
    "type": "plugin",
    "affected_version": "* - 1.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-badges-management",
    "type": "plugin",
    "affected_version": "* - 1.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-product-add-ons",
    "type": "plugin",
    "affected_version": "* - 1.5.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-questions-and-answers",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-authorizenet-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-order-tracking",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-cart-messages",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-subscription",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-paypal-express-checkout-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-advanced-refund-system-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 2.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-stripe",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-custom-thank-you-page-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-compare",
    "type": "plugin",
    "affected_version": "* - 2.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-color-and-label-variations-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-ajax-search",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-mailchimp",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-product-size-charts-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-best-sellers",
    "type": "plugin",
    "affected_version": "* - 1.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-product-vendors",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-pre-order-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-product-bundles",
    "type": "plugin",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-request-a-quote",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-waiting-list",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-pdf-invoice",
    "type": "plugin",
    "affected_version": "* - 1.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-brands-add-on",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-gift-cards",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-points-and-rewards",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-multi-step-checkout",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-added-to-cart-popup",
    "type": "plugin",
    "affected_version": "* - 1.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-desktop-notifications-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-affiliates",
    "type": "plugin",
    "affected_version": "[*, 1.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-quick-view",
    "type": "plugin",
    "affected_version": "* - 1.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-advanced-reviews",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-frequently-bought-together",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-recover-abandoned-cart",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YIT Plugin Framework \u003c= 3.3.8 - Authenticated Settings Change",
    "slug": "yith-woocommerce-social-login",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16251",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CBX Restaurant Booking \u003c= 1.2.1 - Cross-Site Request Forgery to Plugin Reset",
    "slug": "cbx-restaurant-booking",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7965",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WoWPth \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "wowpth",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1486",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShiftController Employee Shift Scheduling \u003c= 4.9.66 - Reflected Cross-Site Scripting",
    "slug": "shiftcontroller",
    "type": "plugin",
    "affected_version": "* - 4.9.66",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.66",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gravity Forms \u003c= 2.7.4 - Reflected Cross-Site Scripting",
    "slug": "gravityforms",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2701",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tripetto \u003c= 8.0.9 - Cross-Site Request Forgery to Arbitrary Results Deletion",
    "slug": "tripetto",
    "type": "plugin",
    "affected_version": "* - 8.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1530",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OnePress Social Locker \u003c 4.2.5 - Reflected Cross-Site Scripting",
    "slug": "social-locker",
    "type": "plugin",
    "affected_version": "[*, 4.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9425",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WatchTowerHQ \u003c= 3.6.15 - Unauthenticated Arbitrary File Download",
    "slug": "watchtowerhq",
    "type": "plugin",
    "affected_version": "* - 3.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-44583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44583",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "YANewsflash \u003c= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "yanewsflash",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6054",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kossy - Minimalist eCommerce WordPress Theme \u003c= 1.45 - Unauthenticated Local File Inclusion",
    "slug": "kossy",
    "type": "theme",
    "affected_version": "* - 1.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.45",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52807",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Contact Forms by Cimatti \u003c= 1.5.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28781",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfect Brands for WooCommerce \u003c= 2.0.4 - Unauthorized Brand Creation",
    "slug": "perfect-woocommerce-brands",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-23981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23981",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Avartan Slider Lite \u003c= 1.5.3 - Reflected Cross-Site Scripting via 'asview-nouce'",
    "slug": "avartan-slider-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30485",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Info Widget \u003c= 2.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-contact-info-widget",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49891",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ovatheme Events Manager \u003c= 1.8.4 - Unauthenticated Arbitrary File Upload",
    "slug": "ova-events-manager",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32510",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Conversion Tracking \u003c= 2.0.11 - Missing Authorization",
    "slug": "woocommerce-conversion-tracking",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52217",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Connector to CiviCRM with CiviMcRestFace \u003c= 1.0.10 - Missing Authorization",
    "slug": "connector-civicrm-mcrestface",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31618",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Geoportail Shortcode \u003c= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "geoportail-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51890",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ibtana \u003c= 1.2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ibtana-visual-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TrackShip for WooCommerce \u003c= 1.9.1 - Authenticated (Shop manager+) SQL Injection",
    "slug": "trackship-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47460",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CSV to html \u003c= 3.08 - Reflected Cross-Site Scripting",
    "slug": "csv-to-html",
    "type": "plugin",
    "affected_version": "* - 3.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54275",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp photo text slider 50 \u003c= 8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-photo-text-slider-50",
    "type": "plugin",
    "affected_version": "* - 8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11884",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment and Event Booking Calendar for WordPress – Amelia \u003c 1.0.49 - Arbitrary Booking Update and Sensitive Data Exposure",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "[*, 1.0.49)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.49",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0825",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Simple eCommerce for Selling Digital Files \u003c= 2.3.2 - SQL Injection",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9324",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Theme Tweaker \u003c= 5.20 - Cross-Site Request Forgery",
    "slug": "theme-tweaker-lite",
    "type": "plugin",
    "affected_version": "* - 5.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23713",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ONLYOFFICE Docs \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "onlyoffice",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11450",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Localize Remote Images \u003c= 1.0.9 - Cross-Site Request Forgery via admin menu",
    "slug": "localize-remote-images",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41244",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DX Sales CRM \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "dx-sales-crm",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23575",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Insert or Embed Articulate Content into WordPress \u003c= 4.3000000025 - Authenticated (Editor+) Arbitrary File Upload",
    "slug": "insert-or-embed-articulate-content-into-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.3000000025",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3000000025",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32202",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slider Revolution \u003c= 6.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindex",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.7.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4637",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form Professional \u003c= 5.1.56 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 5.1.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.56",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2020",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Database Backup \u003c= 5.8.3 -  Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-database-backup",
    "type": "plugin",
    "affected_version": "* - 5.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2271",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SRS Simple Hits Counter Plugin for WordPress 1.03 - 1.04 - Unauthenticated SQL Injection",
    "slug": "srs-simple-hits-counter",
    "type": "plugin",
    "affected_version": "1.0.3 - 1.0.4",
    "from_version": "1.0.3",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-5766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5766",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Enabled SVG \u003c= 0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "wp-enable-svg",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11184",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.980",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.980",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Side Cart Woocommerce (Ajax) \u003c 2.1 - Cross-Site Request Forgery",
    "slug": "side-cart-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-45376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45376",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Footer Putter \u003c= 6.1.3 - Reflected Cross-Site Scripting",
    "slug": "footer-putter",
    "type": "plugin",
    "affected_version": "* - 1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47768",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyForms \u003c= 2.8.5 - Reflected Cross-Site Scripting via page",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30198",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Marketing for WooCommerce by Omnisend \u003c= 1.14.3 - Cross-Site Request Forgery",
    "slug": "omnisend-connect",
    "type": "plugin",
    "affected_version": "* - 1.14.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32101",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.4 - Missing Authorization to Category Update",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5417",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Twitter Bootstrap Collapse aka Accordian Shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "twitter-bootstrap-collapse-aka-accordian-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22743",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RTMKit Addons for Elementor \u003c= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rometheme-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49235",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gboy Custom Google Map \u003c= 1.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "gboy-custom-google-map",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51882",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Exit Strategy \u003c= 1.55 - Cross-Site Request Forgery",
    "slug": "exit-strategy",
    "type": "plugin",
    "affected_version": "* - 1.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.55",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-10025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-10025",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ebook Store \u003c= 5.775 - Missing Authorization via ebook_store_export_orders",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.775",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.775",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22701",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Handsome Testimonials \u0026 Reviews \u003c 2.1.1 - Authenticated SQL Injection",
    "slug": "handsome-testimonials",
    "type": "plugin",
    "affected_version": "[*, 2.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24492",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 3.3.2 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6635",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Profile Builder – User Profile \u0026 User Registration Forms \u003c 1.1.66 - Cross-Site Scripting",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "[*, 1.1.66)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.66",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-10380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10380",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration Using Contact Form 7 \u003c= 2.3 - Cross-Site Request Forgery",
    "slug": "user-registration-using-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32679",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Admin and Site Enhancements (ASE) \u003c= 7.6.2 - Missing Authorization",
    "slug": "admin-site-enhancements",
    "type": "plugin",
    "affected_version": "* - 7.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-24649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24649",
    "auth_type": "Auth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "School Management \u003c= 92.0.0 - Reflected Cross-Site Scripting",
    "slug": "school-management",
    "type": "plugin",
    "affected_version": "* - 92.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "92.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47574",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Design Blocks \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "exclusive-blocks",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31815",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CodeBard's Patron Button and Widgets for Patreon \u003c= 2.2.0 - Reflected Cross-Site Scripting",
    "slug": "patron-button-and-widgets-by-codebard",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33928",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Social Bookmark Menu \u003c= 1.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-social-bookmark-menu",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7074",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nomupay Payment Processing Gateway \u003c= 7.1.6 - Reflected Cross-Site Scripting",
    "slug": "totalprocessing-card-payments",
    "type": "plugin",
    "affected_version": "* - 7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32513",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classic Editor and Classic Widgets \u003c= 1.4.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "classic-editor-and-classic-widgets",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47312",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Category Grid View Gallery \u003c= 2.3.1 - Reflected Cross-Site Scripting",
    "slug": "category-grid-view-gallery",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-4117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4117",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "News \u0026 Blog Designer Pack \u003c= 3.2 - Authenticated (Contributor+) Stored Cross-Site SQcripting via Shortcode",
    "slug": "blog-designer-pack",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4792",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Rocket \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "social-rocket",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9702",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WS Force Login Page \u003c= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ws-force-login-page",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46521",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Addressbook \u003c= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "addressbook",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51644",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Plugin for WordPress – Envira Photo Gallery \u003c= 1.8.4.6 - Reflected Cross-Site Scripting",
    "slug": "envira-gallery-lite",
    "type": "plugin",
    "affected_version": "[*, 1.8.4.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2190",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leyka \u003c= 3.29.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "* - 3.29.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.29.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-27450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27450",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Subscribe \u003c= 1.2.12 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-subscribe",
    "type": "plugin",
    "affected_version": "* - 1.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36844",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 5.3.0.0 - Cross-Site Request Forgery",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2951",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gwolle Guestbook \u003c= 4.1.2 - Reflected Cross-Site Scripting",
    "slug": "gwolle-gb",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24980",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schema Pro \u003c= 2.7.15 - Authenticated (Contributor+) Custom Field Access",
    "slug": "wp-schema-pro",
    "type": "plugin",
    "affected_version": "* - 2.7.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1564",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "StylePress for Elementor \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "full-site-builder-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58254",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yuki \u003c= 1.3.14 - Cross-Site Request Forgery to Theme Setting Reset",
    "slug": "yuki",
    "type": "theme",
    "affected_version": "* - 1.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1943",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sp*tify Play Button for WordPress \u003c= 2.05 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "spotify-play-button-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26536",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeproDev Ultimate Invoice \u003c= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure",
    "slug": "pepro-ultimate-invoice",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13719",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Petfinder Listings \u003c= 1.0.19 - Admin+ Stored Cross-Site Scripting",
    "slug": "petfinder-listings",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0702",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi Rating \u003c= 5.0.5 - Cross Site Request Forgery",
    "slug": "multi-rating",
    "type": "plugin",
    "affected_version": "* - 5.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47443",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Simple Custom Post Order \u003c= 2.5.7 - Missing Authorization",
    "slug": "simple-custom-post-order",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49321",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ebook Downloader \u003c= 1.0 - Unauthenticated SQL Injection",
    "slug": "ebook-downloader",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13435",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AI Engine: ChatGPT Chatbot \u003c= 2.2.63 - Authenticated (Editor+) Arbitrary File Upload",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 2.2.63",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.63",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-34440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34440",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Patreon WordPress \u003c 1.2.2 - PHP Object Injection",
    "slug": "patreon-connect",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-20984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20984",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Media Optimizer (.webp) \u003c= 1.4.0 - Reflected Cross-Site Scripting via wpmowebp-css-resources and wpmowebp-js-resources Parameters",
    "slug": "wp-media-optimizer-webp",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12060",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c= 4.0.2 - Cross-Site Scripting",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[*, 4.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10706",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Switcher \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "image-switcher",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23939",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Cron Dashboard \u003c 1.1.6 - Cross-Site Scripting",
    "slug": "wp-cron-dashboard",
    "type": "plugin",
    "affected_version": "[*, 1.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6991",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Checkout Field Manager \u003c= 17.3 - Unauthenticated Arbitrary File Upload",
    "slug": "n-media-woocommerce-checkout-fields",
    "type": "plugin",
    "affected_version": "* - 17.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4328",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy PayPal Buy Now Button \u003c= 1.9 - Unauthenticated Open Redirect",
    "slug": "wp-ecommerce-paypal",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43236",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c= 8.5.02.005 -  Cross-Site Scripting",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 8.5.02.005",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.02.005",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StageShow \u003c= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor Parameter",
    "slug": "stageshow",
    "type": "plugin",
    "affected_version": "* - 10.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "yCyclista \u003c= 1.2.3 - Reflected Cross-Site Scripting",
    "slug": "ycyclista",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23700",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js Viewer \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdfjs-viewer-shortcode",
    "type": "plugin",
    "affected_version": "[*, 2.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24759",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Flipbox Addon for Elementor  1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-flipbox-addon-for-elementor",
    "type": "plugin",
    "affected_version": "1.0.4",
    "from_version": "1.0.4",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51870",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yoga Schedule Momoyoga \u003c= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "momoyoga-integration",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9852",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ActiveDEMAND \u003c= 0.2.46 - Missing Authorization",
    "slug": "activedemand",
    "type": "plugin",
    "affected_version": "* - 0.2.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39513",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Structured Content \u003c= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "structured-content",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4715",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "W3 Total Cache \u003c= 0.9.2.4 - Sensitive Information Exposure",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "* - 0.9.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-6079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6079",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Aruba HiSpeed Cache \u003c= 2.0.12 - Missing Authorization",
    "slug": "aruba-hispeed-cache",
    "type": "plugin",
    "affected_version": "* - 2.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43119",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meks Video Importer \u003c= 1.0.11 - Missing Authorization",
    "slug": "meks-video-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38733",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Funnel Builder for WordPress by FunnelKit \u003c= 2.14.3 - Authenticated(Administrator+) SQL Injection",
    "slug": "funnel-builder",
    "type": "plugin",
    "affected_version": "[*, 2.14.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50856",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Surbma | Premium WP \u003c= 9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "surbma-premium-wp",
    "type": "plugin",
    "affected_version": "* - 9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22808",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Event Manager \u003c= 9.7.4 - Reflected Cross-Site Scripting",
    "slug": "quick-event-manager",
    "type": "plugin",
    "affected_version": "[*, 9.7.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-23491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23491",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Horizontal scrolling announcement \u003c= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "horizontal-scrolling-announcement",
    "type": "plugin",
    "affected_version": "* - 9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5001",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup Bank: WordPress Backup Plugin \u003c= 4.0.28 - Missing Authorization via post_user_feedback_backup_bank",
    "slug": "wp-backup-bank",
    "type": "plugin",
    "affected_version": "* - 4.0.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28165",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CM Download Manager \u003c 2.9.0 - Cross-Site Request Forgery via unpublishHeader",
    "slug": "cm-download-manager",
    "type": "plugin",
    "affected_version": "[*, 2.9.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-1231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1231",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Coming soon and Maintenance mode \u003c= 3.6.7 - Cross-Site request Forgery to Arbitrary Email Send",
    "slug": "coming-soon-page",
    "type": "plugin",
    "affected_version": "[*, 3.6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0199",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appointment Booking Calendar \u003c 1.3.19 - Cross-Site Scripting",
    "slug": "appointment-booking-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.3.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-14791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14791",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.6.2 - Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1282",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2210",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dashboard Widgets Suite \u003c= 3.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dashboard-widgets-suite",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26517",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VaultRE Contact Form 7 \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-plugin-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31101",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theater for WordPress \u003c= 0.18.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "theatre",
    "type": "plugin",
    "affected_version": "* - 0.18.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.18.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47833",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Realty Workstation \u003c= 1.0.9 - Authenticated SQL Injection",
    "slug": "realty-workstation",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1691",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry \u0026 Carousel \u003c= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 2.4.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12114",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Geo Mashup \u003c 1.8.3 - Cross-Site Scripting",
    "slug": "geo-mashup",
    "type": "plugin",
    "affected_version": "[*, 1.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-1383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1383",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooFramework Branding \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "wooframework-branding",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10112",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 5.2.5.9 - Reflected Cross-Site Scripting",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29113",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Address Obfuscation \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter",
    "slug": "email-address-obfuscation",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11935",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bricksforge \u003c= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Deletion",
    "slug": "bricksforge",
    "type": "plugin",
    "affected_version": "* - 2.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31243",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products \u0026 More \u003c= 4.4.1 - Unauthenticated PHP Object Injection",
    "slug": "woolementor",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4371",
    "auth_type": "Unauth",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Neosense - Multipurpose WordPress Theme | WordPress \u003c 1.8 - Arbitrary File Upload",
    "slug": "neosense",
    "type": "theme",
    "affected_version": "[*, 1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10954",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Auction Plugin \u003c= 3.7 - Authenticated (Editor+) SQL Injection",
    "slug": "wp-auctions",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8855",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Libro de Reclamaciones \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "libro-de-reclamaciones",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46446",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfect Font Awesome Integration \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "perfect-font-awesome-integration",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Passster – Password Protection \u003c= 3.5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "content-protector",
    "type": "plugin",
    "affected_version": "* - 3.5.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24837",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ni WooCommerce Bulk Product Editor \u003c= 1.4.5 - Reflected Cross-Site Scripting",
    "slug": "ni-woocommerce-product-editor",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54236",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Posts reminder \u003c= 0.20 - Cross-Site Request Forgery to Settings Update",
    "slug": "posts-reminder",
    "type": "plugin",
    "affected_version": "* - 0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8093",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JetTricks \u003c= 1.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-tricks",
    "type": "plugin",
    "affected_version": "* - 1.5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53991",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booqable Rental \u003c= 2.4.20 - Cross-Site Request Forgery",
    "slug": "booqable-rental-reservations",
    "type": "plugin",
    "affected_version": "* - 2.4.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30956",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.15 - Reflected Cross-Site Scripting via lang",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cloud Manager \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "cloud-manager",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0421",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "STEdb Forms \u003c= 1.0.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "stedb-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30571",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Dynamic Widgets \u003c= 1.5.16 - Reflected Cross-Site Scripting",
    "slug": "dynamic-widgets",
    "type": "plugin",
    "affected_version": "* - 1.5.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24933",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for WPBakery Page Builder \u003c= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "Ultimate_VC_Addons",
    "type": "plugin",
    "affected_version": "* - 3.19.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5254",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Forms by Cimatti \u003c= 1.7.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-29117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29117",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SMS \u003c= 6.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-sms",
    "type": "plugin",
    "affected_version": "* - 6.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25920",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.0.5 - Insecure Direct Object Reference to Forum Status Change",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40205",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Podlove Subscribe button \u003c= 1.3.10 - Authenticated (Contributor+) SQL Injection",
    "slug": "podlove-subscribe-button",
    "type": "plugin",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1118",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epeken All Kurir \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "epeken-all-kurir",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58212",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Downloader \u003c= 0.4.7.5 - Reflected Cross-Site Scripting",
    "slug": "media-downloader",
    "type": "plugin",
    "affected_version": "* - 0.4.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24684",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popups \u003c= 1.9.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "popups",
    "type": "plugin",
    "affected_version": "* - 1.9.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2305",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "miniOrange's Google Authenticator \u003c= 5.6.5 - Missing Authorization to Plugin Settings Change",
    "slug": "miniorange-2-factor-authentication",
    "type": "plugin",
    "affected_version": "* - 5.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4943",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Click to Call or Chat Buttons \u003c= 1.4.0 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "click-to-call-or-chat-buttons",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25710",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carousel, Slider, Gallery by WP Carousel – Image Carousel \u0026 Photo Gallery, Post Carousel \u0026 Post Grid, Product Carousel \u0026 Product Grid for WooCommerce \u003c= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode'",
    "slug": "wp-carousel-free",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2949",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4217",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "postMash – custom post order \u003c= 1.2.0 - Reflected Cross-Site Scripting via m",
    "slug": "postmash",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27196",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via plupload.flash.swf",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.10",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via plupload.flash.swf",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.3",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via plupload.flash.swf",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.1",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via plupload.flash.swf",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via plupload.flash.swf",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.13",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via plupload.flash.swf",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.11",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via plupload.flash.swf",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.10",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via plupload.flash.swf",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.7",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via plupload.flash.swf",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.2",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.2 - Cross-Site Scripting via plupload.flash.swf",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.13",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinpoint Booking System  \u003c= 2.9.9.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "[*, 2.9.9.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-25062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25062",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.2 - Unauthenticated \u0026 Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.5 - 6.5.1",
    "from_version": "6.5",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4439",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.2 - Unauthenticated \u0026 Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.7",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4439",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.2 - Unauthenticated \u0026 Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.1 - 6.1.5",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4439",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.2 - Unauthenticated \u0026 Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.2 - 6.2.4",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4439",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.2 - Unauthenticated \u0026 Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.3 - 6.3.3",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4439",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.5.2 - Unauthenticated \u0026 Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.4 - 6.4.3",
    "from_version": "6.4",
    "from_inclusive": true,
    "to_version": "6.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4439",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CC Custom Taxonomy \u003c= 1.0.1 - Authenticated (Administrator+) Cross Site Scripting",
    "slug": "cc-custom-taxonmy",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25028",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SmokeSignal \u003c= 1.2.6 - Cross-Site Scripting",
    "slug": "smokesignal",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18535",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simpel Reserveren 3 \u003c= 3.5.2 - Reflected Cross-Site Scripting",
    "slug": "simpel-reserveren",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000149",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Author \u003c= 1.0.4 - Missing Authorization",
    "slug": "media-author",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58841",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Groundhogg \u003c= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 3.7.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1267",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add to Feedly \u003c= 1.2.11 - Cross-Site Request Forgery",
    "slug": "add-to-feedly",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58859",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Input Fields for WooCommerce \u003c= 1.9 -  Authenticated (Contributor+) Arbitrary File Read",
    "slug": "product-input-fields-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10857",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "HTML Forms \u003c= 1.4.1 - Reflected Cross-Site Scripting",
    "slug": "html-forms",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56060",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Personal Data Reports \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gdpr-personal-data-reports",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress MU \u003c 2.7 - Cross-Site Scripting",
    "slug": "wpmu",
    "type": "core",
    "affected_version": "[*, 2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2009-1030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-1030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Any Document \u003c= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embed-any-document",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60099",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OceanWP \u003c= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "oceanwp",
    "type": "theme",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8944",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Image SEO \u003c= 1.1.4 - Cross-Site Request Forgery",
    "slug": "wp-image-seo",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49627",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Countdown FX \u003c= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-countdown-fx",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25117",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Logging Service \u003c= 1.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wordpress-logging-service",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23510",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 5.1.3 - Missing Authorization",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50417",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Logs Book \u003c= 1.0.1 - Cross-Site Request Forgery to Log Disabling",
    "slug": "wp-logs-book",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4474",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AccessPress Anonymous Post = 2.8.0 - Backdoored",
    "slug": "accesspress-anonymous-post",
    "type": "plugin",
    "affected_version": "2.8.0",
    "from_version": "2.8.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24867",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CommentTweets \u003c= 0.6 - Cross-Site Request Forgery to Settings Update",
    "slug": "commenttweets",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6845",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nokri - Job Board WordPress Theme \u003c= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover",
    "slug": "nokri",
    "type": "theme",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1313",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Minimalistic Event Manager \u003c= 1.1.1 - Missing Authorization",
    "slug": "minimalistic-event-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31739",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress iQ Block Country \u003c= 1.2.11 - Authenticated Stored Cross-Site Scripting",
    "slug": "iq-block-country",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36873",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor - Pro \u003c= 5.0.6 - SQL Injection",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "[*, 5.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24949",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Whizzy \u003c= 1.1.18 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "whizzy",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30543",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Open Graph and Twitter Card Tags \u003c 2.2.4.1 - Reflected Cross-Site Scripting",
    "slug": "wonderm00ns-simple-facebook-open-graph-tags",
    "type": "plugin",
    "affected_version": "[*, 2.2.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-0579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0579",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.15.8 - Missing Authorization",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.15.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31099",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 3.7.29 - Reflected Cross-Site Scripting",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 3.7.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34021",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pickup | Delivery | Dine-in date time \u003c= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "restaurant-pickup-delivery-dine-in",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0894",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Laposta Signup Basic \u003c= 1.4.1 - Cross-Site Request Forgery",
    "slug": "laposta-signup-basic",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41950",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34764",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c= 9.9 - Unauthenticated Arbitrary File Deletion",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4442",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP Chat App \u003c= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute",
    "slug": "wp-whatsapp",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2513",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HUSKY – Products Filter for WooCommerce Professional \u003c= 1.3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1796",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Memberships, Groups and Communities \u003c= 4.7.4 - Stored Cross-Site Scripting via Profile",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 4.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0233",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Broken Link Checker \u003c= 4.0 - Unauthenticated SQL Injection",
    "slug": "mainwp-broken-links-checker-extension",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-23737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23737",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hostel \u003c= 1.1.3 - Stored Cross-Site Scripting",
    "slug": "hostel",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-12345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-12345",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapSVG Lite \u003c= 8.6.4 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "mapsvg-lite-interactive-vector-maps",
    "type": "plugin",
    "affected_version": "* - 8.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32682",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons \u003c= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "* - 2.32.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.32.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13448",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TextMe SMS \u003c= 1.9.0 - Missing Authorization via tetxme_update_option_page()",
    "slug": "textme-sms-integration",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48287",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.4 (Pro) \u0026 \u003c= 2.2.7 (Free) - Missing Authorization via get_virtual_users",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0235",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.4 (Pro) \u0026 \u003c= 2.2.7 (Free) - Missing Authorization via get_virtual_users",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0235",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Dynamic \"To Top\"  3.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dynamic-to-top",
    "type": "plugin",
    "affected_version": "3.5.2",
    "from_version": "3.5.2",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52494",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinterest Verify Meta Tag \u003c= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pinterest-verify-meta-tag",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30941",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SimaCookie \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simasicher-dsgvo-cookie",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58868",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Duplicator \u003c= 2.35 - Missing Authorization",
    "slug": "post-duplicator",
    "type": "plugin",
    "affected_version": "* - 2.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24736",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YaMaps for WordPress \u003c= 0.6.31 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yamaps",
    "type": "plugin",
    "affected_version": "* - 0.6.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32172",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoho Flow \u003c= 2.14.1 - Cross-Site Request Forgery",
    "slug": "zoho-flow",
    "type": "plugin",
    "affected_version": "* - 2.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59568",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Coming Soon \u0026 Maintenance \u003c=  1.0.9 - Cross-Site Request Forgery",
    "slug": "ultimate-coming-soon",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24546",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MultiMailer \u003c= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "scand-multi-mailer",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EleForms – All In One Form Integration including DB for Elementor \u003c= 2.9.9.9 - Cross-Site Request Forgery",
    "slug": "all-contact-form-integration-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6628",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Word Replacer Pro \u003c= 1.0 - Missing Authorization to Unauthenticated Arbitrary Content Update",
    "slug": "word-replacer-ultra",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1733",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "XStore \u003c= 9.3.8 - Unauthenticated Local File Inclusion",
    "slug": "xstore",
    "type": "theme",
    "affected_version": "* - 9.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33560",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Indeed Ultimate Learning Pro \u003c= 3.9 - Authenticated (Administrator+) SQL Injection via post_id Parameter",
    "slug": "ulp-duplicate-post-sql-timebased",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13846",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SALERT \u003c= 1.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "salert",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32118",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Inventory Manager \u003c= 2.3.2 - Reflected Cross-Site Scripting",
    "slug": "wp-inventory-manager",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13434",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Ultimate Gift Card - Create, Sell and Manage Gift Cards with Customized Email Templates \u003c= 2.8.10 - Unauthenticated SQL Injection",
    "slug": "woocommerce-ultimate-gift-card",
    "type": "plugin",
    "affected_version": "* - 2.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47569",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Clinked Client Portal \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "clinked-client-portal",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12524",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebinarPress \u003c= 1.33.27 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-webinarsystem",
    "type": "plugin",
    "affected_version": "* - 1.33.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31883",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.5.7 - Unprotected REST-API to Email Injection",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34648",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FluentSnippets \u003c= 10.50 - Cross-Site Request Forgery",
    "slug": "easy-code-manager",
    "type": "plugin",
    "affected_version": "* - 10.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54010",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Plugins and Themes by inkthemes \u003c= 1.1.8 - Unauthenticated Information Exposure",
    "slug": "dzonia-lite",
    "type": "theme",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Plugins and Themes by inkthemes \u003c= 1.1.8 - Unauthenticated Information Exposure",
    "slug": "road-fighter",
    "type": "theme",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Plugins and Themes by inkthemes \u003c= 1.1.8 - Unauthenticated Information Exposure",
    "slug": "poloray",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Plugins and Themes by inkthemes \u003c= 1.1.8 - Unauthenticated Information Exposure",
    "slug": "colorway",
    "type": "theme",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Plugins and Themes by inkthemes \u003c= 1.1.8 - Unauthenticated Information Exposure",
    "slug": "butterbelly",
    "type": "theme",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Plugins and Themes by inkthemes \u003c= 1.1.8 - Unauthenticated Information Exposure",
    "slug": "rethink",
    "type": "theme",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Plugins and Themes by inkthemes \u003c= 1.1.8 - Unauthenticated Information Exposure",
    "slug": "themia-lite",
    "type": "theme",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Plugins and Themes by inkthemes \u003c= 1.1.8 - Unauthenticated Information Exposure",
    "slug": "compass",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Plugins and Themes by inkthemes \u003c= 1.1.8 - Unauthenticated Information Exposure",
    "slug": "cloriato-lite",
    "type": "theme",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Plugins and Themes by inkthemes \u003c= 1.1.8 - Unauthenticated Information Exposure",
    "slug": "wp-mailgun-smtp",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Plugins and Themes by inkthemes \u003c= 1.1.8 - Unauthenticated Information Exposure",
    "slug": "wp-sendgrid-smtp",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Favorites \u003c= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "favorites",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2304",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Cross-Site Request Forgery via 'clear_page_cache'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1346",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Interactive UK Regional Map \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "interactive-uk-regional-map",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49445",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.41 - Authenticated(Contributor+) Stored Cross-Site Scripting",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.41",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1940",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Custom Dashboard Widget \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "create-custom-dashboard-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56024",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Slider – Image Slider – Slideshow for WordPress \u003c 2.7.0 - Authenticated (Admin+) SQL Injection",
    "slug": "slider-image",
    "type": "plugin",
    "affected_version": "[*, 2.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-2062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2062",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AADMY – Add Auto Date Month Year Into Posts \u003c= 2.0.1 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "auto-date-year-month",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9837",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widget",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "* - 5.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5341",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Skyword API Plugin \u003c= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skyword-plugin",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11907",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clever Fox \u003c= 25.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "clever-fox",
    "type": "plugin",
    "affected_version": "* - 25.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "25.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1768",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DAP to Autoresponders Email Syncing \u003c= 1.0 - Unauthenticated Information Exposure",
    "slug": "dap-to-autoresponders-daar",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2840",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Invite Anyone \u003c= 1.3.15 - Improper Input Validation",
    "slug": "invite-anyone",
    "type": "plugin",
    "affected_version": "* - 1.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-18545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18545",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Easy Captcha \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "easy-captcha",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33312",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import WP – Export and Import CSV and XML files to WordPress \u003c= 2.14.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "jc-importer",
    "type": "plugin",
    "affected_version": "* - 2.14.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13562",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.6 - Disabled Membership Registration Bypass",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0701",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Attorney \u003c= 3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion",
    "slug": "attorney",
    "type": "theme",
    "affected_version": "* - 3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45832",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Adifier System \u003c 3.1.4 - Unauthenticated SQL Injection",
    "slug": "adifier-system",
    "type": "theme",
    "affected_version": "[*, 3.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-49752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49752",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.0.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2010-5295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-5295",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 – Clockwork SMS \u003c 2.4.1 - Reflected Cross-Site Scripting",
    "slug": "contact-form-7-sms-addon",
    "type": "plugin",
    "affected_version": "[*, 2.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18489",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp Social \u003c= 1.9.0 - Authenticated (Subscriber+) Information Disclosure",
    "slug": "wp-social",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47160",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.22",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.21",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.14",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.5",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.33",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.30",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.27",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.17",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.33",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.9",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.18",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.13",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.6",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.31",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.30",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Comment Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.23",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25286",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress File Upload / WordPress File Upload Pro \u003c= 4.19.1 - Authenticated (Administrator+) Path Traversal",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.19.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2688",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress File Upload / WordPress File Upload Pro \u003c= 4.19.1 - Authenticated (Administrator+) Path Traversal",
    "slug": "wordpress-file-upload-pro",
    "type": "plugin",
    "affected_version": "* - 4.19.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2688",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Smart Maintenance Mode \u003c= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "smart-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12683",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Activity Log \u003c= 2.8.7 - IP Address Spoofing",
    "slug": "aryo-activity-log",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4281",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Cerber Security \u003c= 9.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-cerber",
    "type": "plugin",
    "affected_version": "* - 9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4712",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Disqus Comment System \u003c 2.76 - Reflected Cross-Site Scripting",
    "slug": "disqus-comment-system",
    "type": "plugin",
    "affected_version": "[*, 2.76)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.76",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-5345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5345",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TJ Shortcodes 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "theme-junkie-shortcodes",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6530",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FeedStats \u003c 2.4 - Cross-Site Scripting",
    "slug": "feedstats-de",
    "type": "plugin",
    "affected_version": "[*, 2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2007-4104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4104",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spam Byebye \u003c= 2.2.4 - Cross-Site Request Forgery",
    "slug": "spam-byebye",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28941",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Invento | Architecture Building Agency Template \u003c= 2015-05-15 - Sensitive Information Disclosure",
    "slug": "invento",
    "type": "theme",
    "affected_version": "[*, 2015-05-15]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2015-05-15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9483",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Front End Users \u003c= 3.2.32 - Reflected Cross-Site Scripting",
    "slug": "front-end-only-users",
    "type": "plugin",
    "affected_version": "* - 3.2.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13569",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Membership \u003c= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "wp-membership",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54717",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Kali Forms \u003c= 2.1.1 - Unauthenticated Arbitrary Post Deletion",
    "slug": "kali-forms",
    "type": "plugin",
    "affected_version": "[*, 2.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36712",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "Leaky Paywall \u003c= 4.21.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "leaky-paywall",
    "type": "plugin",
    "affected_version": "* - 4.21.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31083",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Post Navigation \u003c= 2.1 - Unauthenticated Full Path Disclosure",
    "slug": "admin-post-navigation",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6549",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.1.11 - Unauthenticated Privilege Escalation via User Roles",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.1.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.12",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-36157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36157",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Visual Form Builder \u003c= 3.0.5 - Unauthenticated Information Disclosure",
    "slug": "visual-form-builder",
    "type": "plugin",
    "affected_version": "[*, 3.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0140",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "StatPressCN \u003c= 1.9.1 - Reflected Cross-Site Scripting",
    "slug": "statpresscn",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23544",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin \u003c= 1.1.1 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "experto-cta-widget",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47529",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MS-Reviews \u003c= 1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "ms-reviews",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0424",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.12.7 - Cross-Site Request Forgery to Level Orders Update",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 2.12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0624",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Photo Gallery Final Tiles Grid \u003c= 3.5.2 - Contributor+ Stored Cross-Site Scripting",
    "slug": "final-tiles-grid-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0186",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder – More than Just a Page Builder \u003c= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.18.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0506",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.987 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.987",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.987",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56062",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PWA for WP \u0026 AMP \u003c = 1.7.32 - Missing Authorization",
    "slug": "pwa-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.7.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4366",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Injection Guard \u003c= 1.2.7 - Reflected Cross-Site Scripting",
    "slug": "injection-guard",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8046",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode in Comment \u003c= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "shortcode-in-comment",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23569",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup by Supsystic \u003c 1.7.9 - Cross-Site Request Forgery",
    "slug": "popup-by-supsystic",
    "type": "plugin",
    "affected_version": "[*, 1.7.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10915",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Order Your Posts Manually \u003c= 2.2.5 - Authenticated (Administrator+) SQL Injection via 'sortdata'",
    "slug": "order-your-posts-manually",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32508",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NewsDaily \u003c= 1.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "newsdaily",
    "type": "theme",
    "affected_version": "* - 1.0.64",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.64",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56208",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magical Addons For Elementor \u003c= 1.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magical-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5161",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes \u003c 2.0.0 -  Arbitrary File Upload",
    "slug": "ignition",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24220",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Multiple Thrive Themes \u003c 2.0.0 -  Arbitrary File Upload",
    "slug": "storied",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24220",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Multiple Thrive Themes \u003c 2.0.0 -  Arbitrary File Upload",
    "slug": "luxe",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24220",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Multiple Thrive Themes \u003c 2.0.0 -  Arbitrary File Upload",
    "slug": "voice",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24220",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Multiple Thrive Themes \u003c 2.0.0 -  Arbitrary File Upload",
    "slug": "squared",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24220",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Multiple Thrive Themes \u003c 2.0.0 -  Arbitrary File Upload",
    "slug": "performag",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24220",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Multiple Thrive Themes \u003c 2.0.0 -  Arbitrary File Upload",
    "slug": "minus",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24220",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Multiple Thrive Themes \u003c 2.0.0 -  Arbitrary File Upload",
    "slug": "pressive",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24220",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Multiple Thrive Themes \u003c 2.0.0 -  Arbitrary File Upload",
    "slug": "rise",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24220",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Multiple Thrive Themes \u003c 2.0.0 -  Arbitrary File Upload",
    "slug": "focusblog",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24220",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Paytm Payment Donation \u003c= 2.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "paytm-donation",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22640",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Datepicker \u003c= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "wp-datepicker",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Microblog Poster \u003c 1.6.2 - Authenticated Blind SQL Injection",
    "slug": "microblog-poster",
    "type": "plugin",
    "affected_version": "[*, 1.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9449",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Knight Lab Timeline \u003c= 3.9.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "knight-lab-timelinejs",
    "type": "plugin",
    "affected_version": "* - 3.9.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32554",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hive Support \u003c= 1.2.5 - Authenticated (Subscriber+) Missing Authorization via hs_update_ai_chat_settings and hive_lite_support_get_all_binbox",
    "slug": "hive-support",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5018",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "PostX - Gutenberg Blocks for Post Grid \u003c= 2.4.9 - Unauthorized Access Controls",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "[*, 2.4.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24652",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Exam Matrix \u003c= 1.5 - Unauthenticated Privilege Escalation",
    "slug": "exam-matrix",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50485",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Welcart e-Commerce \u003c 1.2.2 - Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-5177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5177",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swift Calendar Online Appointment Scheduling \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "online-appointment-scheduling-software",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23526",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Delisho \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dr-widgets-blocks",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51676",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feed Them Social \u003c= 4.2.0 - Cross-Site Request Forgery via review_nag_check",
    "slug": "feed-them-social",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-24710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24710",
    "auth_type": "Auth",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Testimonials Showcase \u003c= 1.9.16 - Missing Authorization",
    "slug": "testimonials-showcase",
    "type": "plugin",
    "affected_version": "* - 1.9.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "REST API TO MiniProgram \u003c= 4.7.7 - Authenticated (Subscriber+) Media Attachment Deletion",
    "slug": "rest-api-to-miniprogram",
    "type": "plugin",
    "affected_version": "* - 4.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0551",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"
  },
  {
    "title": "Webflow Pages \u003c= 1.0.8 - Missing Authorization",
    "slug": "webflow-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49818",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Clever Addons for Elementor \u003c= 2.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates",
    "slug": "cafe-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10357",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Salutation \u003c 3.0.16 - Authenticated Stored Cross-Site Scripting",
    "slug": "salutation-wp",
    "type": "theme",
    "affected_version": "[*, 3.0.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-1000227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000227",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google XML Sitemap for Videos \u003c= 2.6.1 - Cross-Site Request Forgery via video_sitemap_generate",
    "slug": "xml-sitemaps-for-videos",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25055",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SKT Addons for Elementor \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Plugin Manager \u003c= 1.1.7 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "wp-plugin-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1088",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress CTA \u003c= 1.5.8 - Missing Authorization via Multiple AJAX Actions",
    "slug": "easy-sticky-sidebar",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46644",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Popliup – WordPress Popup Plugin \u003c= 1.1.1 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "popliup",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23945",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sticky Header On Scroll \u003c= 1.0 - Missing Authorization",
    "slug": "sticky-header-on-scroll",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27356",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c= 4.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6094",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nova Blocks by Pixelgrade \u003c= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nova-blocks",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31819",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 1.5.1.2 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 1.5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2005-1810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2005-1810",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Duplicate Post WordPress Plugin \u003c= 1.1.9 - SQL Injection",
    "slug": "copy-delete-posts",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-43408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-43408",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Polls CP \u003c= 1.0.76 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cp-polls",
    "type": "plugin",
    "affected_version": "* - 1.0.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.76",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8851",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZoomSounds \u003c= 6.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "dzs-zoomsounds",
    "type": "plugin",
    "affected_version": "* - 6.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0839",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pretty Links – Affiliate Links, Link Branding, Link Tracking \u0026 Marketing Plugin \u003c= 3.6.3 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "pretty-link",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2326",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP DataTable \u003c= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "wp-datatable",
    "type": "plugin",
    "affected_version": "* - 0.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13566",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Addon for Elementor \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "events-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49264",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sky Addons for Elementor \u003c= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "sky-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8216",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Residential Address Detection \u003c= 2.5.4 - Unauthenticated Arbitrary Options Update",
    "slug": "residential-address-detection",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-27270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27270",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEO Plugin by Squirrly SEO \u003c= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parameter",
    "slug": "squirrly-seo",
    "type": "plugin",
    "affected_version": "* - 12.4.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.4.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1768",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "custom-smilies",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32482",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid, Slider \u0026 Carousel Ultimate – with Shortcode, Gutenberg Block \u0026 Elementor Widget \u003c= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()",
    "slug": "post-grid-carousel-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13409",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premmerce \u003c= 1.3.18 - Cross-Site Request Forgery via runAction",
    "slug": "premmerce",
    "type": "plugin",
    "affected_version": "* - 1.3.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23719",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Custom Content Shortcode \u003c= 4.0.2 - Authenticated (Contributor+) Local File Inclusion via Shortcode",
    "slug": "custom-content-shortcode",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0340",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themeflection Numbers \u003c= 1.8.1 - Authenticated(Subscriber+) Privilege Escalation via tf_numb_save_licenses",
    "slug": "tf-numbers-number-counter-animaton",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0889",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2655",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress \u003c= 3.0.30 - HTML Injection",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.0.31)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.31",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18574",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AN_GradeBook \u003c= 5.0.1 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "an-gradebook",
    "type": "plugin",
    "affected_version": "* - 5.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2709",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paloma Widget \u003c= 1.14 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "postman-widget",
    "type": "plugin",
    "affected_version": "* - 1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54205",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CGD Arrange Terms \u003c= 1.1.3 - Reflected Cross-Site Scripting",
    "slug": "shopp-arrange",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23752",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yayforms",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12522",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPMobile.App \u003c= 11.48 - Reflected Cross-Site Scripting",
    "slug": "wpappninja",
    "type": "plugin",
    "affected_version": "* - 11.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43933",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CBX Map for Google Map \u0026 OpenStreetMap \u003c= 1.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cbxgooglemap",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9123",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce HSS Extension for Streaming Video \u003c= 3.31 - Reflected Cross-Site Scripting via videolink Parameter",
    "slug": "woocommerce-hss-extension-for-streaming-video",
    "type": "plugin",
    "affected_version": "* - 3.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12214",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wholesale For WooCommerce \u003c= 2.3.0 - Unauthenticated Information Exposure",
    "slug": "woocommerce-wholesale-pricing",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30469",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "photokit \u003c= 1.0 - Unauthenticated Arbitrary File Upload",
    "slug": "photokit",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49610",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mass Messaging in BuddyPress \u003c= 2.2.1 - Reflected Cross-Site Scripting",
    "slug": "mass-messaging-in-buddypress",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23798",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AFFILIATE Solution \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "affiliate-solution",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30477",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Country Flags for Elementor \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "country-flags-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49262",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobSearch \u003c 3.0.8 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "[*, 3.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-52806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52806",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Integrate Firebase \u003c= 0.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "integrate-firebase",
    "type": "plugin",
    "affected_version": "* - 0.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11785",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.3.13.727 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.3.13.727",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.13.727",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14799",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uix Slideshow \u003c= 1.6.5 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "uix-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Top 10 – Popular posts plugin - \u003c= 3.2.4 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "top-10",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26008",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration – Custom Registration Form, Login Form And User Profile For WordPress \u003c= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 3.0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5228",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YouTube Embed, Playlist and Popup \u003c= 2.3.8 - Contributor+ Stored Cross-Site Scripting",
    "slug": "youtube-video-player",
    "type": "plugin",
    "affected_version": "[*, 2.3.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24464",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Backup \u0026 Migration \u003c= 1.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-migration-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5738",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP Child Reports \u003c= 2.0.7 - Admin+ SQL Injection",
    "slug": "mainwp-child-reports",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24754",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FormCraft Premium \u003c= 3.9.6 - Authenticated(Administrator+) SQL Injection",
    "slug": "formcraft-form-builder",
    "type": "plugin",
    "affected_version": "* - 3.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2592",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hurrakify \u003c= 2.4 - Unauthenticated Server-Side Request Forgery",
    "slug": "hurrakify",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54330",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Control Manager for WordPress by ItalyStrap \u003c= 2.16.0 - Reflected Cross-Site Scripting",
    "slug": "advanced-control-manager",
    "type": "plugin",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54233",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Robcore Netatmo \u003c= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode",
    "slug": "robcore-netatmo",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10652",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Tainacan \u003c= 0.21.10 - Reflected Cross-Site Scripting",
    "slug": "tainacan",
    "type": "plugin",
    "affected_version": "* - 0.21.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.21.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnDash LMS \u003c= 2.5.3 - Arbitrary File Upload",
    "slug": "sfwd-lms",
    "type": "plugin",
    "affected_version": "[*, 2.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-25019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-25019",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Code Quality Control Tool \u003c= 0.1 - Unauthenticated Information Exposure via Log Files",
    "slug": "code-quality-control-tool",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8484",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Slideshow SE \u003c= 2.5.17 - Authenticated (Author+) Limited Local File Inclusion",
    "slug": "slideshow-se",
    "type": "plugin",
    "affected_version": "* - 2.5.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-35778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35778",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "kk Star Ratings \u003c= 5.4.5 - Race Condition to Multiple User Voting",
    "slug": "kk-star-ratings",
    "type": "plugin",
    "affected_version": "* - 5.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4642",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.3.1 - Same Origin Policy Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-2401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2401",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Event Manager, Events Calendar, Tickets, Registrations – Eventin \u003c= 4.0.8 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7149",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Penci Soledad Data Migrator \u003c= 1.3.0 - Unauthenticated Local File Inclusion",
    "slug": "penci-data-migrator",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3551",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Registration \u003c= 2.3.0  - Authenticated (Administrator+) Stored Cross Site Scripting",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23987",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada \u003c= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2343",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vertical Marquee Plugin \u003c= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "vertical-marquee-plugin",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40677",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Course Migration for LearnDash \u003c= 1.0.2 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "course-migration-for-learndash",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22346",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WatchTowerHQ \u003c= 3.6.15 - Unauthenticated Arbitrary File Deletion",
    "slug": "watchtowerhq",
    "type": "plugin",
    "affected_version": "* - 3.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-44584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44584",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Post Index \u003c= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "post-index",
    "type": "plugin",
    "affected_version": "* - 0.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-34637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34637",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BP Profile Shortcodes Extra \u003c= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bp-profile-shortcodes-extra",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS \u0026 CSS Script Optimizer \u003c= 0.3.3 - Cross-Site Request Forgery",
    "slug": "js-css-script-optimizer",
    "type": "plugin",
    "affected_version": "* - 0.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52216",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Chat Bee \u003c= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chat-bee",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26538",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TZ PlusGallery \u003c= 1.5.5 - Cross-Site Request Forgery",
    "slug": "tz-plus-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31756",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Enhanced Media Library \u003c= 2.8.9 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "enhanced-media-library",
    "type": "plugin",
    "affected_version": "* - 2.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2840",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accept Donations with PayPal \u003c= 1.4.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "easy-paypal-donation",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47517",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro - Membership Maps Add On \u003c 0.7 - Authenticated (contributor+) Information Disclosure",
    "slug": "pmpro-membership-maps",
    "type": "plugin",
    "affected_version": "[*, 0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-1286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1286",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Video \u0026 Photo Gallery for Ultimate Member \u003c= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "gallery-for-ultimate-member",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54370",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Taskbuilder – WordPress Project \u0026 Task Management plugin \u003c= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks Shortcode",
    "slug": "taskbuilder",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11930",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "White Label MS \u003c= 2.2.8 - Reflected Cross-Site Scripting",
    "slug": "white-label-cms",
    "type": "plugin",
    "affected_version": "[*, 2.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0422",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lead Form Data Collection to CRM \u003c= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many Actions",
    "slug": "wp-leads-builder-any-crm",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5692",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Subscribe To Unlock \u003c= 1.1.5 - Missing Authorization",
    "slug": "subscribe-to-unlock",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60152",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Posts Footer Manager \u003c= 2.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "intelly-posts-footer-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22734",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfect Survey \u003c= 1.5.1 - Unauthenticated SQL Injection",
    "slug": "perfect-survey",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24762",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Video Lightbox \u003c= 1.9.2 - Contributor+ Stored Cross-Site Scripting",
    "slug": "wp-video-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24665",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-DownloadManager \u003c= 1.68.11 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "wp-downloadmanager",
    "type": "plugin",
    "affected_version": "* - 1.68.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.68.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10747",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Masteriyo LMS – eLearning and Online Course Builder for WordPress \u003c= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality",
    "slug": "learning-management-system",
    "type": "plugin",
    "affected_version": "* - 1.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10000",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter  \u003c= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "* - 8.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3581",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "simple-git \u003c 3.16.0 - Remote Code Execution",
    "slug": "insecure-content-warning",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-25860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25860",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "simple-git \u003c 3.16.0 - Remote Code Execution",
    "slug": "retro-winamp-block",
    "type": "plugin",
    "affected_version": "[*, 1.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-25860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25860",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "simple-git \u003c 3.16.0 - Remote Code Execution",
    "slug": "simple-podcasting",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-25860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25860",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "simple-git \u003c 3.16.0 - Remote Code Execution",
    "slug": "maps-block-apple",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-25860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25860",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "simple-git \u003c 3.16.0 - Remote Code Execution",
    "slug": "ads-txt",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-25860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25860",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "simple-git \u003c 3.16.0 - Remote Code Execution",
    "slug": "simple-local-avatars",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-25860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25860",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page-list \u003c= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "page-list",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4485",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1421",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PayPal Brasil para WooCommerce \u003c= 1.4.2 - Cross-Site Request Forgery",
    "slug": "paypal-brasil-para-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25026",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paytiko for WooCommerce \u003c= 1.3.14 - Missing Authorization",
    "slug": "paytiko",
    "type": "plugin",
    "affected_version": "* - 1.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50032",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Watcheezy Live chat plugin for WordPress \u003c= 2.0 - Stored Cross-Site Scripting",
    "slug": "watcheezy",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24305",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.2.6 - Unauthenticated Arbitrary File Upload",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-10147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10147",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ELI's Related Posts Footer Links and Widget \u003c= 1.2.04.20 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "spostarbust",
    "type": "plugin",
    "affected_version": "* - 1.2.04.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.04.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47514",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0875",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OMGF \u003c= 4.5.11 - Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal",
    "slug": "host-webfonts-local",
    "type": "plugin",
    "affected_version": "* - 4.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25021",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "TablePress \u003c= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "tablepress",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9595",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Folders \u003c= 8.1.7 - Authenticated (Author+) SQL Injection",
    "slug": "media-library-plus",
    "type": "plugin",
    "affected_version": "* - 8.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30486",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 2.2.2 - Cross-Site Scripting",
    "slug": "wpmu",
    "type": "core",
    "affected_version": "[*, 1.2.5a)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5a",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2007-4893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4893",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.2.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4893",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Food Manager \u003c= 1.0.3 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-food-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0604",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cleanup – Directory Listing \u0026 Classifieds WordPress Plugin \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "cleanup-light",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24563",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 3.2.2 - Reflected Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "[*, 3.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24955",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinterest Automatic Pin \u003c 4.19.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-pinterest-automatic",
    "type": "plugin",
    "affected_version": "[*, 4.19.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-39510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39510",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Fancy Product Designer \u003c= 6.4.3 - Unauthenticated Arbitrary File Upload",
    "slug": "fancy-product-designer",
    "type": "plugin",
    "affected_version": "* - 6.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-51919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51919",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPThumb \u003c= 0.10 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "wp-thumb",
    "type": "plugin",
    "affected_version": "* - 0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49983",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Directory Plugin - Easy Listing Directories for WordPress \u003c= 6.4.14 - Insecure Direct Object Reference to Listing Arbitrary Image Addition",
    "slug": "business-directory-plugin",
    "type": "plugin",
    "affected_version": "* - 6.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13887",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Loan Comparison \u003c= 1.5.2 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode",
    "slug": "loan-comparison",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0366",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution \u003c= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9531",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "myCred Plugin \u003c= 1.7.7 - Reflected Cross-Site Scripting",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "[*, 1.7.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-20008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20008",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mystique \u003c= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mystique",
    "type": "theme",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43988",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Box \u003c= 3.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "[*, 3.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4390",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Delete Duplicate Posts \u003c= 4.8.9 - Missing Authorization via AJAX Actions",
    "slug": "delete-duplicate-posts",
    "type": "plugin",
    "affected_version": "[*, 4.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-47754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47754",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Post Author \u003c= 3.8.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-post-author",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56247",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Essential Blocks \u003c= 4.4.2 - Unauthenticated Local File Inclusion",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6623",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Blocks \u003c= 4.0.6 - Missing Authorization via templates",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2085",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Sangar Slider \u003c= 1.3.2 - Cross-Site Request Forgery",
    "slug": "sangar-slider-lite",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32091",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wbcom Designs - Activity Link Preview For BuddyPress \u003c= 1.4.4 - Unauthenticated Server-Side Request Forgery",
    "slug": "activity-link-preview-for-buddypress",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47548",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARPrice - WordPress Pricing Table Plugin \u003c= 4.0.3 - Reflected Cross-Site Scripting",
    "slug": "arprice",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49700",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Job Board \u003c= 2.9.6 - Information Disclosure",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "* - 2.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2558",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Estatik \u003c= 2.3.0 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "estatik",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10959",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Clickbank WordPress Plugin (Storefront) \u003c= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "clickbank-storefront",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11336",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directorist \u003c= 7.7.1 - CSV Injection",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-41798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41798",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "flickr-slideshow-wrapper \u003c= 5.4.6 - Reflected Cross-Site Scripting",
    "slug": "flickr-slideshow-wrapper",
    "type": "plugin",
    "affected_version": "* - 5.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27309",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mailster \u003c= 1.8.16.0 - Unauthenticated Information Exposure",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53804",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WebSub (FKA. PubSubHubbub) \u003c= 3.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pubsubhubbub",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0688",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.29.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3053",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FAT Services Booking \u003c= 5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "fat-services-booking",
    "type": "plugin",
    "affected_version": "* - 5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54220",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ibtana - WordPress Website Builder \u003c= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Update",
    "slug": "ibtana-visual-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5541",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Service \u003c= 1.0.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "service",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-55986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55986",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gum Elementor Addon \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gum-elementor-addon",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44027",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMTP for SendGrid – YaySMTP \u003c= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs",
    "slug": "smtp-sendgrid",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0918",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Meta Manager \u003c= 3.4.9 - Reflected Cross-Site Scripting",
    "slug": "user-meta-manager",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22718",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WPLMS \u003c 1.9.9.5.2 - Authenticated (Instructor+) Arbitrary File Upload",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "[*, 1.9.9.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-56054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56054",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPEX Replace DB Urls \u003c= 0.4.0 - Reflected Cross-Site Scripting",
    "slug": "wpex-replace",
    "type": "plugin",
    "affected_version": "* - 0.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22586",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Code Engine \u003c= 0.3.3 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "code-engine",
    "type": "plugin",
    "affected_version": "* - 0.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48169",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Show-Hide / Collapse-Expand \u003c= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "show-hidecollapse-expand",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4829",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.59 - Cross-Site Request Forgery to Menu Template creation",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4707",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Master Addons for Elementor \u003c= 2.0.6.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38710",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DataMentor \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "datamentor",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50545",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Blocks – WordPress Blocks Plugin \u003c= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2918",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InventoryPress \u003c= 1.7 - Authenticated(Author+) Stored Cross-Site Scripting",
    "slug": "inventorypress",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2579",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Editor Custom Color Palette \u003c= 3.4.8 - Missing Authorization",
    "slug": "editor-custom-color-palette",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57909",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wishlist \u003c= 1.0.41 - Authenticated (Contributor+) SQL Injection",
    "slug": "wishlist",
    "type": "plugin",
    "affected_version": "* - 1.0.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26915",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Newsup \u003c= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation",
    "slug": "newsup",
    "type": "theme",
    "affected_version": "* - 5.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8682",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "App Builder \u003c= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "app-builder",
    "type": "plugin",
    "affected_version": "* - 3.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32565",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder \u003c= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.8.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4430",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin and Site Enhancements (ASE) \u003c= 7.5.1 - Authenticated Stored Cross-Site Scripting via SVG",
    "slug": "admin-site-enhancements",
    "type": "plugin",
    "affected_version": "* - 7.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10790",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Geolocator \u003c= 1.1 - Unauthenticated PHP Object Injection",
    "slug": "geolocator",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52443",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Loan Comparison \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "loan-comparison",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks \u003c= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0598",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSS JS Manager \u003c= 2.4.49 - Cross-Site Request Forgery",
    "slug": "css-js-manager",
    "type": "plugin",
    "affected_version": "* - 2.4.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.49",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47154",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Ultimate Bootstrap Elements for Elementor \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Widget",
    "slug": "ultimate-bootstrap-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2132",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Linear \u003c= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "linear",
    "type": "plugin",
    "affected_version": "* - 2.7.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12496",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gulri Slider \u003c= 3.5.8 - Reflected Cross-Site Scripting",
    "slug": "gulri-slider",
    "type": "plugin",
    "affected_version": "* - 3.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56223",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration, User Profiles, Login \u0026 Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.1.3",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-34621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34621",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Labinator Content Types Duplicator \u003c= 1.1.3 - Cross-Site Request Forgery",
    "slug": "labinator-content-types-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31809",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Email Notifications for Updates \u003c= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "wp-update-mail-notification",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2933",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Arkhe Blocks \u003c= 2.27.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attributes",
    "slug": "arkhe-blocks",
    "type": "plugin",
    "affected_version": "* - 2.27.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.27.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53794",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shipyaari Shipping Management \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "manage-shipyaari-shipping",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26528",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Compact WP Audio Player \u003c= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fileurl",
    "slug": "compact-wp-audio-player",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29917",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal PrettyPhoto \u003c= 1.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "rt-prettyphoto",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10128",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscribe to Comments \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "subscribe-to-comments",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2006-10001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-10001",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recurring PayPal Donations \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "recurring-donation",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35676",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.0.7 - Full Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-0262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-0262",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Blog Filter \u003c= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "blog-filter",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5291",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8440",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8681",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets \u0026 Elementor Templates) \u003c= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sina Fancy Text Widget",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3988",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flash Show And Hide Box \u003c= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "flash-show-and-hide-box",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51656",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Depicter Slider – Responsive Image Slider, Video Slider \u0026 Post Slider \u003c= 2.0.6 - Cross-Site Request Forgery via save",
    "slug": "depicter",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6493",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form by BestWebSoft – Advanced Contact Us Form Builder for WordPress \u003c= 4.0.1 - Cross-Site Scripting",
    "slug": "contact-form-plugin",
    "type": "plugin",
    "affected_version": "[*, 4.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10869",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DesignFolio Plus Theme (Unkown Versions) - Arbitrary File Upload",
    "slug": "designfolio-plus",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-10087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10087",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Eventr \u003c= 1.02.2 - SQL Injection",
    "slug": "eventr",
    "type": "plugin",
    "affected_version": "* - 1.02.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.02.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002019",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Digg Digg \u003c 5.3.5 - Cross-Site Request Forgery",
    "slug": "digg-digg",
    "type": "plugin",
    "affected_version": "[*, 5.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-3258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3258",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Muslim Prayer Time-Salah/Iqamah \u003c= 1.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "masjidal",
    "type": "plugin",
    "affected_version": "* - 1.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12515",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced File Manager \u003c= 5.2.8 - Authenticated (Subscriber+) Limited File Upload",
    "slug": "file-manager-advanced",
    "type": "plugin",
    "affected_version": "* - 5.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8725",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "JobBoard Job listing \u003c= 1.2.7 - Missing Authorization",
    "slug": "job-board-light",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31834",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.9.1 - Unauthenticated SQL Injection",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0308",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Database for CF7 \u003c= 1.2.4 - Missing Authorization via wpcf7db_delete AJAX action",
    "slug": "database-for-cf7",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49167",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "TinyMCE Color Picker \u003c 1.2 - Cross-Site Request Forgery",
    "slug": "tinymce-colorpicker",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-3845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3845",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae_slider_animation Parameters",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4401",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Slider – Responsive Touch Slider \u003c= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.10.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11731",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cerber Security \u003c= 9.3.2 - User Enumeration Bypass via REST API",
    "slug": "wp-cerber",
    "type": "plugin",
    "affected_version": "* - 9.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4417",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "E Search \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "e-search",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000131",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid, Slider \u0026 Carousel Ultimate \u003c= 1.6.10 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "post-grid-carousel-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24782",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EthereumICO \u003c= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ethereum-ico Shortcode",
    "slug": "ethereumico",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12921",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "POST SMTP Mailer \u003c= 2.0.20 - Cross-Site Request Forgery Bypass",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4422",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Snap \u003c= 1.3.5 - Missing Authorization",
    "slug": "socialsnap",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32805",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Enquiry for WooCommerce \u003c= 3.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gm-woocommerce-quote-popup",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6626",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKT Addons for Elementor \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Block",
    "slug": "skt-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34436",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Designer \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "designer",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23987",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CPO Companion \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "cpo-companion",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4837",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Customer Reviews \u003c= 3.4.2 - Multiple Stored Cross-Site Scripting",
    "slug": "wp-customer-reviews",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24135",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Like Button \u003c= 1.6.11 - Cross-Site Request Forgery via 'saveData'",
    "slug": "wp-like-button",
    "type": "plugin",
    "affected_version": "* - 1.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40199",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Advanced-Search \u003c= 3.3.8 - Cross-Site Request Forgery leading to Plugin Settings Updates",
    "slug": "wp-advanced-search",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47447",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Awin Data Feed \u003c= 1.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "awin-data-feed",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1938",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Marketing for WooCommerce by Omnisend \u003c= 1.13.8 - Sensitive Information Exposure",
    "slug": "omnisend-connect",
    "type": "plugin",
    "affected_version": "* - 1.13.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47244",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Molongui \u003c= 4.7.7 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "molongui-authorship",
    "type": "plugin",
    "affected_version": "* - 4.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29764",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.14.0.2 - Cross-Site Scripting",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "[*, 1.14.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15328",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.0.4 - Denial of Service",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2006-6017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-6017",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Slider by 10Web \u003c= 1.2.61 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "slider-wd",
    "type": "plugin",
    "affected_version": "* - 1.2.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10566",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultra Addons Lite for Elementor \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field",
    "slug": "ut-elementor-addons-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9077",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Download Counter \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-download-counter",
    "type": "plugin",
    "affected_version": "1.6",
    "from_version": "1.6",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4838",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Forms \u003c= 2.2.9 - Unauthenticated Arbitrary File Upload",
    "slug": "forms-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6313",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sidebar-Content from Shortcode \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sidebar-content-from-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23642",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates \u003c= 1.0.14 - Missing Authorization to Spexo Theme Install",
    "slug": "sastra-essential-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13335",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lightbox Plus \u003c= 2.7.2 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "lightbox-plus",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10865",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jotform Online Forms  \u003c= 1.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "embed-form",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2542",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "event",
    "type": "theme",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35711",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Blocks for WooCommerce \u003c= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "product-blocks-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SendPress Newsletters \u003c= 1.23.11.6 - Cross-Site Request Forgery",
    "slug": "sendpress",
    "type": "plugin",
    "affected_version": "* - 1.23.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.11.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41730",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Button Plugin MaxButtons \u003c= 9.7.8 - Full Path Disclosure",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "* - 9.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6499",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Membership For WooCommerce \u003c= 2.1.6 - Unauthenticated Arbitrary File Upload",
    "slug": "membership-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4395",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Link Library \u003c= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library Shortcode",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4281",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SimpleShop \u003c= 2.10.0 - Cross-Site Request Forgery",
    "slug": "simpleshop-cz",
    "type": "plugin",
    "affected_version": "* - 2.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1230",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple SEO \u003c= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cds-simple-seo",
    "type": "plugin",
    "affected_version": "* - 2.0.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10357",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opor Ayam \u003c= 1.8 - Reflected Cross-Site Scripting",
    "slug": "opor-ayam",
    "type": "theme",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44053",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "linkID \u003c= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure",
    "slug": "linkid",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12542",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Jupiterx Core \u003c= 4.8.7 - Authenticated (Contributor+) Arbitrary File Read",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 4.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0365",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Verge3D \u003c= 4.8.2 - Cross-Site Request Forgery",
    "slug": "verge3d",
    "type": "plugin",
    "affected_version": "* - 4.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30833",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 3.4.5 - WooCommerce File Deletion",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "[*, 3.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-20714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20714",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hostel \u003c= 1.1.5.2 - Reflected Cross-Site Scripting",
    "slug": "hostel",
    "type": "plugin",
    "affected_version": "* - 1.1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3753",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Customers Manager \u003c 30.1 - Cross-Site Request Forgery to Customer Deletion via 'Delete'",
    "slug": "woocommerce-customers-manager",
    "type": "plugin",
    "affected_version": "[*, 30.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "30.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-2843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2843",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WishSuite \u003c= 1.3.3 - Cross-Site Request Forgery via plugin_activation()",
    "slug": "wishsuite",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23731",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Forex Calculators \u003c= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "fx-calculators",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22689",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DTracker \u003c= 1.5 - SQL Injection",
    "slug": "dtracker",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002005",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Events Calendar \u003c= 6.15.1 -  Unauthenticated SQL Injection",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 6.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.15.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9807",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP-Members Membership \u003c= 3.4.7.3 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.4.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2869",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Memberships, Groups and Communities \u003c 2.8.6 - Remote Code Execution",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "[*, 2.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15873",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Goo.gl Url Shorter \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "googl-url-shorter",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23585",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \u003c= 1.24.1 - Cross-Site Request Forgery via submitDefaultEditor",
    "slug": "post-and-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.24.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25480",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Schema - All In One Schema Rich Snippets \u003c= 1.4.4 - Cross-Site Scripting",
    "slug": "all-in-one-schemaorg-rich-snippets",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20977",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks \u003c= 4.0.6 - Missing Authorization via save",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2083",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Magic Responsive Slider and Carousel WordPress \u003c= 1.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "magic-carousel",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31640",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Build \u0026 Control Block Patterns – Boost up Gutenberg Editor \u003c= 1.3.5.4 - Missing Authorization",
    "slug": "control-block-patterns",
    "type": "plugin",
    "affected_version": "* - 1.3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1095",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Importify \u003c= 1.0.4 - Unauthenticated Sensitive Information Exposure",
    "slug": "importify",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49194",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FileOrganizer and FileOrganizer Pro \u003c= 1.0.6 - Authenticated Stored Cross-Site Scripting",
    "slug": "fileorganizer",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2324",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Online Order for Clover \u003c= 1.5.7 - Reflected Cross-Site Scripting",
    "slug": "clover-online-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8787",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LessButtons Social Sharing and Statistics \u003c= 1.6.1 - Cross-Site Request Forgery",
    "slug": "lessbuttons",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47614",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CozyStay \u003c= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler",
    "slug": "cozystay",
    "type": "theme",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13412",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "S3 Video \u003c= 0.983 -  Reflected Cross-Site Scripting",
    "slug": "s3-video",
    "type": "plugin",
    "affected_version": "* - 0.983",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.983",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000148",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Page Builder \u003c 4.1.10 - Open Redirect",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "[*, 4.1.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24358",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Post Grid \u003c= 7.4.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "the-post-grid",
    "type": "plugin",
    "affected_version": "* - 7.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3635",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MaxButtons \u003c= 6.18 - Cross-Site Scripting",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "* - 6.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-2169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2169",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shariff Wrapper \u003c= 4.6.13 - Unauthenticated Local File Inclusion",
    "slug": "shariff",
    "type": "plugin",
    "affected_version": "* - 4.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4098",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Goodnews – Responsive WordPress News/Magazine | News / Editorial \u003c= 5.11.1 - Reflected Cross-Site Scripting",
    "slug": "goodnews5",
    "type": "plugin",
    "affected_version": "* - 5.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Builder \u003c= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wc-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29926",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 1.9.10 - Reflected Cross-Site Scripting",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 1.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24873",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMTP2GO \u003c= 1.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings",
    "slug": "smtp2go",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28496",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.4 - Missing Authorization to Enable/Disable Dark Mode",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5387",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple File List \u003c= 4.4.11 - Reflected Cross-Site Scripting",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "* - 4.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3062",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Propovoice CRM \u003c= 1.7.8 - Unauthenticated Insecure Direct Object Reference",
    "slug": "propovoice",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43350",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tweet Wheel \u003c 1.0.3.3 - Reflected Cross-Site Scripting",
    "slug": "tweet-wheel",
    "type": "plugin",
    "affected_version": "[*, 1.0.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10986",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Mapper \u003c= 0.2.5.3 - Reflected Cross-Site Scripting",
    "slug": "image-mapper",
    "type": "plugin",
    "affected_version": "* - 0.2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56016",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewsmanApp \u003c= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "newsmanapp",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11767",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP To Do \u003c= 1.3.0 - Cross-Site Request Forgery via wptodo_addcomment",
    "slug": "wp-todo",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3943",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Options Plus \u003c= 1.8.1 - Cross-Site Request Forgery via custom_options_plus_adm",
    "slug": "custom-options-plus",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28420",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "hiWeb Migration Simple \u003c= 2.0.0.1 - Reflected Cross-Site Scripting",
    "slug": "hiweb-migration-simple",
    "type": "plugin",
    "affected_version": "* - 2.0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0769",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post SMTP Mailer/Email Log \u003c= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2351",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "aThemes Addons for Elementor \u003c= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "athemes-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13547",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Box Business (7.0.0 - 7.9.0)  and Developer (20.0.0 - 20.9.0)  - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "[20.0.0, 20.9.0)",
    "from_version": "20.0.0",
    "from_inclusive": true,
    "to_version": "20.9.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6591",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N"
  },
  {
    "title": "Popup Box Business (7.0.0 - 7.9.0)  and Developer (20.0.0 - 20.9.0)  - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "[7.0.0, 7.9.0)",
    "from_version": "7.0.0",
    "from_inclusive": true,
    "to_version": "7.9.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6591",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N"
  },
  {
    "title": "Constant Contact Forms by MailMunch \u003c= 2.0.10 - Cross-Site Request Forgery",
    "slug": "constant-contact-forms-by-mailmunch",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45647",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Availability Calendar \u003c= 1.2.1 - Stored Cross-Site Scripting",
    "slug": "availability-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24604",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallerio \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "gallerio",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23629",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual CSS Style Editor \u003c= 7.2.0 - Unauthenticated Arbitrary Options Update",
    "slug": "yellow-pencil-visual-theme-customizer",
    "type": "plugin",
    "affected_version": "[*, 7.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-11886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11886",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hash Form \u003c= 1.2.8 - Cross-Site Request Forgery",
    "slug": "hash-form",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47468",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WOOCS – WooCommerce Currency Switcher \u003c= 1.4.1.7 - Cross-Site Request Forgery",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.4.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30458",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Payday \u003c= 3.3.13 - Missing Authorization",
    "slug": "payday",
    "type": "plugin",
    "affected_version": "* - 3.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31876",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple URLs \u003c= 118 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-urls",
    "type": "plugin",
    "affected_version": "* - 118",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "118",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iThemes Builder Depot Theme \u003c 5.0.30 - Reflected Cross-Site Scripting",
    "slug": "BuilderChild-Depot",
    "type": "theme",
    "affected_version": "[*, 5.0.30)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.30",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9377",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TabGarb Pro \u003c= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "tabgarb",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28900",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Message Filter for Contact Form 7 \u003c= 1.6.1.1 - Reflected Cross-Site Scripting",
    "slug": "cf7-message-filter",
    "type": "plugin",
    "affected_version": "* - 1.6.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39647",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Stock Manager \u003c= 2.5.7 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "woocommerce-stock-manager",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-34619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34619",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Instagram for WordPress \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "instagram-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5357",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Medialist \u003c= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "media-list",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46640",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Editor Custom Color Palette \u003c= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "editor-custom-color-palette",
    "type": "plugin",
    "affected_version": "* - 3.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9642",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Generator \u003c= 2.5.5 - Reflected Cross-Site Scripting",
    "slug": "contact-form-generator",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37988",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDiscuz \u003c= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3869",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "tarteaucitron.js for WordPress \u003c= 0.2.5 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "tarteaucitron-wp",
    "type": "plugin",
    "affected_version": "* - 0.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator \u003c= 1.28.1 - Unauthenticated Arbitrary File Upload",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.28.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.28.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-28890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-28890",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Flynax Bridge \u003c= 2.2.0 - Unauthenticated Privilege Escalation via Password Update",
    "slug": "flynax-bridge",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3603",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Sales MIS Report \u003c= 4.0.3 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-mis-report",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32541",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Extra Product Options for WooCommerce \u003c= 4.1 - Authenticated (Shop manager+) Stored Cross-Site Scripting via plugin settings",
    "slug": "extra-product-options-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47658",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mollie Payments for WooCommerce \u003c= 7.3.11 - Authenticated (Shop Manager+) Arbitrary File Upload",
    "slug": "mollie-payments-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 7.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6090",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Optimizer, Resizer and CDN – Sirv \u003c= 7.2.0 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "* - 7.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27949",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booknetic \u003c= 4.1.4 - Cross-Site Request Forgery",
    "slug": "booknetic",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13146",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPBakery \u003c= 7.7 - Authenticated (Author+) Local File Inclusion",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5709",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Panda Video \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pandavideo",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5457",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' Shortcode",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.272",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.272",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3337",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quartz \u003c= 1.01.1 - SQL Injection",
    "slug": "quartz",
    "type": "plugin",
    "affected_version": "* - 1.01.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5185",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5185",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "KKProgressbar2 Free \u003c= 1.1.4.2 - Authenticated (Admin+) SQL Injection",
    "slug": "kkprogressbar",
    "type": "plugin",
    "affected_version": "* - 1.1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4533",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Product Labels For Woocommerce (Sale Badges) \u003c= 1.5.10 - Authenticated (Admin+) SQL Injection",
    "slug": "aco-product-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10638",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "wpCentral \u003c= 1.5.7 - Cross-Site Request Forgery",
    "slug": "wp-central",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41854",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function",
    "slug": "idonate",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.1.9",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4523",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "EmbedPress \u003c= 4.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 4.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50461",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Yelp Review Slider \u003c= 7.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-yelp-review-slider",
    "type": "plugin",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0263",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Affiliate Platform \u003c= 6.5.1 - Cross-Site Request Forgery to Afilliate Deletion",
    "slug": "wp-affiliate-platform",
    "type": "plugin",
    "affected_version": "* - 6.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5285",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Social Widget \u003c= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-social-widget",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30610",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InPost for WooCommerce \u003c= 1.4.0 and InPost PL \u003c= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Delete",
    "slug": "inpost-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6500",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H"
  },
  {
    "title": "InPost for WooCommerce \u003c= 1.4.0 and InPost PL \u003c= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Delete",
    "slug": "woo-inpost",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6500",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H"
  },
  {
    "title": "Template Debugger \u003c= 3.1.2 - Cross-Site Request Forgery",
    "slug": "quick-edit-template-link",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35773",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug'",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2309",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.3.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-2403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2403",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.5.2 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32238",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Limit Login Attempts \u003c= 2.6.4 - IP Spoofing to Protection Mechanism Bypass",
    "slug": "wp-limit-login-attempts",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4303",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WOLF – WordPress Posts Bulk Editor and Manager Professional \u003c= 1.0.8.1 - Missing Authorization",
    "slug": "bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0791",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Review Stream \u003c= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "review-stream",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28774",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.8 - Reflected Cross-Site Scripting via page",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8119",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hercules Core  \u003c= 6.5 - Missing Authorization to Settings Update",
    "slug": "hercules-core",
    "type": "plugin",
    "affected_version": "* - 6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37232",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "VR-Frases (collect \u0026 share quotes) \u003c= 3.0.1 - Authenticated (Admin+) SQL Injection",
    "slug": "vr-frases",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0861",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JetWidgets for Elementor \u003c= 1.0.12 - Cross-Site Request Forgery to Settings Update",
    "slug": "jetwidgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0086",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Booster (\u003c= 6.0.0), Booster Plus (\u003c= 6.0.0), and Booster Elite (\u003c= 6.0.0) for WooCommerce - Cross-Site Request Forgery",
    "slug": "booster-plus-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 6.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4017",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Booster (\u003c= 6.0.0), Booster Plus (\u003c= 6.0.0), and Booster Elite (\u003c= 6.0.0) for WooCommerce - Cross-Site Request Forgery",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 6.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4017",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Booster (\u003c= 6.0.0), Booster Plus (\u003c= 6.0.0), and Booster Elite (\u003c= 6.0.0) for WooCommerce - Cross-Site Request Forgery",
    "slug": "booster-elite-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 6.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4017",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "User Registration \u0026 Membership – Custom Registration Form, Login Form, and User Profile \u003c= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3281",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Category SEO Meta Tags \u003c= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "category-seo-meta-tags",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46091",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator \u0026 More \u003c= 2.5.4 - Reflected Cross-Site Scripting",
    "slug": "wp-ad-guru",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12411",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cross-Linker \u003c= 3.0.1.9 - Cross-Site Request Forgery",
    "slug": "cross-linker",
    "type": "plugin",
    "affected_version": "* - 3.0.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1826",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26772",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TemplatesNext ToolKit \u003c= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "templatesnext-toolkit",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13559",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Call Now Button \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "call-now-button",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1455",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11868",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Transposh WordPress Translation \u003c= 1.0.9.6 - Sensitive Information Disclosure",
    "slug": "transposh-translation-filter-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2462",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MainWP Post Plus Extension \u003c= 4.0.3 - Missing Authorization to Arbitrary Page/Post Deletion",
    "slug": "mainwp-post-plus-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23666",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction \u003c= 2.6.2 - Missing Authorization",
    "slug": "wallet-system-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13724",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0838",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anti-Malware Security and Brute-Force Firewall \u003c= 4.21.85 - Authenticated (Admin+) PHP Object Injection",
    "slug": "gotmls",
    "type": "plugin",
    "affected_version": "* - 4.21.85",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21.85",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4327",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletters \u003c= 4.9.9.6 - Reflected Cross-Site Scripting",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Accessibility Helper (WAH) \u003c= 0.6.2.5 - Missing Authorization",
    "slug": "wp-accessibility-helper",
    "type": "plugin",
    "affected_version": "* - 0.6.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31423",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Carousel Ultimate \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "carousel",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58652",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Style Kits \u003c= 1.8.0 - Cross-Site Request Forgery Bypass",
    "slug": "analogwp-templates",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4401",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Media Icons Widget \u003c= 1.6 - Cross-Site Request Forgery",
    "slug": "spoontalk-social-media-icons-widget",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25036",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Posts Footer Manager \u003c= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "intelly-posts-footer-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32130",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes Finder \u003c= 1.5.3 - Reflected Cross-Site Scripting",
    "slug": "shortcodes-finder",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47695",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Piotnet Addons For Elementor Pro \u003c= 7.1.17 - Reflected Cross-Site Scripting",
    "slug": "piotnet-addons-for-elementor-pro",
    "type": "plugin",
    "affected_version": "* - 7.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33633",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WOOCS \u003c= 1.3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.3.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4431",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ND Restaurant Reservations \u003c= 1.3 - Options Change",
    "slug": "nd-restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-15819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15819",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "cformsII \u003c= 13.1 - Cross-Site Scripting",
    "slug": "cforms2",
    "type": "plugin",
    "affected_version": "* - 13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-10377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10377",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AGIL(Automatic Grid Image Listing) \u003c= 1.0 - Arbitrary File Upload",
    "slug": "automatic-grid-image-listing",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25119",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Online Order for Clover \u003c= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via moo_receipt_link Shortcode",
    "slug": "clover-online-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9895",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BulletProof Security \u003c .51.1 - Cross-Site Scripting",
    "slug": "bulletproof-security",
    "type": "plugin",
    "affected_version": "[*, .51.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": ".51.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-7958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7958",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Ninja Forms Contact Form \u003c= 3.6.10 - Authenticated (Admin+) Stored Cross-Site Scripting via import",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25066",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hostel \u003c= 1.1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Manage Bookings",
    "slug": "hostel",
    "type": "plugin",
    "affected_version": "* - 1.1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32120",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field",
    "slug": "college",
    "type": "theme",
    "affected_version": "[*, 1.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field",
    "slug": "anfaust",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field",
    "slug": "brain-power",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field",
    "slug": "bunnypresslite",
    "type": "theme",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field",
    "slug": "bazaar-lite",
    "type": "theme",
    "affected_version": "[*, 1.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field",
    "slug": "cafe-bistro",
    "type": "theme",
    "affected_version": "[*, 1.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field",
    "slug": "arendelle",
    "type": "theme",
    "affected_version": "[*, 1.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field",
    "slug": "anand",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field",
    "slug": "atlast-business",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field",
    "slug": "aapna",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2813",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.6.25 - Missing Authorization to Form Submission Export",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38393",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPB Elementor Addons \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter",
    "slug": "wpb-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4896",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend File Manager \u003c 4.0 \u0026 N-Media Post Front-end Form \u003c 1.1 \u0026 - Arbitrary File Upload",
    "slug": "wp-post-frontend",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-15042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-15042",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Frontend File Manager \u003c 4.0 \u0026 N-Media Post Front-end Form \u003c 1.1 \u0026 - Arbitrary File Upload",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "[*, 4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-15042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-15042",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP SEO Redirect 301 \u003c= 2.3.1 - Cross-Site Request Forgery",
    "slug": "wp-seo-redirect-301",
    "type": "plugin",
    "affected_version": "[*, 2.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24832",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Appbox \u003c= 4.3.20 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-appbox",
    "type": "plugin",
    "affected_version": "* - 4.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36910",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebinarPress \u003c= 1.33.20 - Cross-Site Request Forgery",
    "slug": "wp-webinarsystem",
    "type": "plugin",
    "affected_version": "* - 1.33.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43339",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paytium: Mollie payment forms \u0026 donations \u003c= 4.3.7 - Missing Authorization in 'check_mollie_account_details'",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7293",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Themify Shortcodes \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themify-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43133",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBakery Page Builder \u003c= 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10006",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 3.0.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37486",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Gmedia Photo Gallery \u003c= 1.23.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "grand-media",
    "type": "plugin",
    "affected_version": "* - 1.23.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53257",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite \u003c= 1.0.0 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "image-map-pro-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3412",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post and Page Builder by BoldGrid \u003c= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url Function",
    "slug": "post-and-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.27.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0859",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \u003c= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate",
    "slug": "ap-plugin-scripteo",
    "type": "plugin",
    "affected_version": "* - 4.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6459",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zakra \u003c= 4.1.5 - Missing Authorization to Subscriber+ Demo Import",
    "slug": "zakra",
    "type": "theme",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8595",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple News \u003c= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via news Shortcode",
    "slug": "simple-news",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10112",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bitcoin Payments \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bitcoin-payments",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51826",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wechat Social login \u003c= 1.3.0 - Authentication Bypass",
    "slug": "wechat-social-login",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9106",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "140+ Widgets | Xpro Addons For Elementor – FREE \u003c= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13649",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikAppointments Services Booking Calendar \u003c= 1.2.16 - Cross-Site Request Forgery",
    "slug": "vikappointments",
    "type": "plugin",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22719",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Admin and Site Enhancements (ASE) Pro \u003c= 7.6.1.1 - Missing Authorization",
    "slug": "admin-site-enhancements-pro",
    "type": "plugin",
    "affected_version": "* - 7.6.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24653",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.5 -  Full Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-0191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0191",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SS Font Awesome Icon \u003c= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ss-font-awesome-icon",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58837",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP VR \u003c= 8.2.8 - Reflected Cross-Site Scripting",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1413",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login No Captcha reCAPTCHA \u003c= 1.6.11 - CAPTCHA Bypass via Whitelisted IP Address Spoofing",
    "slug": "login-recaptcha",
    "type": "plugin",
    "affected_version": "* - 1.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2913",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive Tabs For WPBakery Page Builder \u003c= 1.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "responsive-tabs-for-wpbakery",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0368",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Attachment Manager \u003c= 2.1.2 - Unauthenticated Arbitrary File Deletion",
    "slug": "attachment-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7643",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Forminator – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.27.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.26.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5119",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Tag Cloud \u003c= 0.99.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "nktagcloud",
    "type": "plugin",
    "affected_version": "* - 0.99.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.99.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2412",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MediCenter - Health Medical Clinic \u003c= 15.1 - Unauthenticated PHP Object Injection",
    "slug": "medicenter",
    "type": "theme",
    "affected_version": "* - 15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54014",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cybersoldier \u003c 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cybersoldier",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24895",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.1 - Cross-Site Scripting via Theme Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.5",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1564",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.1 - Cross-Site Scripting via Theme Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.1",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1564",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.1 - Cross-Site Scripting via Theme Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1564",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.1 - Cross-Site Scripting via Theme Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.8",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1564",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.1 - Cross-Site Scripting via Theme Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1564",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.1 - Cross-Site Scripting via Theme Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.11",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1564",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.1 - Cross-Site Scripting via Theme Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.11",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1564",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.1 - Cross-Site Scripting via Theme Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.9",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1564",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.1 - Cross-Site Scripting via Theme Names",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.8",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1564",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP \u003c= 4.27.4 - Arbitrary File Upload",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "* - 4.27.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.27.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-1905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-1905",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Tabs \u003c= 2.1.14 - Cross Site Request Forgery",
    "slug": "wp-expand-tabs-free",
    "type": "plugin",
    "affected_version": "* - 2.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25065",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Heateor Social Login WordPress \u003c= 1.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "heateor-social-login",
    "type": "plugin",
    "affected_version": "* - 1.1.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy2Map \u003c= 1.2.4 - Directory Traversal",
    "slug": "easy2map",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-4616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4616",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Contact Form by Supsystic \u003c= 1.7.29 - Cross-Site Request Forgery to Stored Cross-Site Scripting via saveAsCopy AJAX Action",
    "slug": "contact-form-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13452",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Hygiene \u003c= 4.0.0 - Missing Authorization",
    "slug": "media-hygiene",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47469",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.59 - Insufficient Access Control to Theme Activation",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4700",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Checkout for PayPal \u003c= 1.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "checkout-for-paypal",
    "type": "plugin",
    "affected_version": "* - 1.0.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39572",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter Popup \u003c= 1.2 - Cross-Site Request Forgery to Subscriber Deletion",
    "slug": "newsletter-popup",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3642",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "teachPress \u003c= 9.0.9 - Cross-Site Request Forgery to Import Delete",
    "slug": "teachpress",
    "type": "plugin",
    "affected_version": "* - 9.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1320",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup Anything \u003c= 2.0.3 - Contributor+ Stored Cross-Site Scripting",
    "slug": "popup-anything-on-click",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24883",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Motors – Car Dealer \u0026 Classified Ads \u003c= 1.4.5 - Cross-Site Request Forgery via Multiple Functions",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38716",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ListingEasy \u003c= 1.9.2 - Reflected Cross-Site Scripting",
    "slug": "listingeasy",
    "type": "theme",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30955",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GEO my WordPress \u003c= 4.5.0.4 - Missing Authorization via get_field_options_ajax",
    "slug": "geo-my-wp",
    "type": "plugin",
    "affected_version": "* - 4.5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54326",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip \u0026 Popover Widget",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3990",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rank Math SEO \u003c= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "[*, 1.0.41)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.41",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-11514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11514",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA \u0026 ePrivacy) \u003c= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Whitelist Script",
    "slug": "gdpr-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11724",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CM E-Mail Blacklist – Simple email filtering for safer registration \u003c= 1.5.5 - Reflected Cross-Site Scripting",
    "slug": "cm-email-blacklist",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24694",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiVendorX – WooCommerce Multivendor Marketplace Solutions \u003c= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4101",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.6.7 - Insecure Direct Object Reference to Menu Access",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2441",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Hotjar \u003c= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "hotjar",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1259",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirect 404 Error Page to Homepage or Custom Page with Logs \u003c= 1.7.8 - Log Deletion via Cross-Site Request Forgery",
    "slug": "redirect-404-error-page-to-homepage-or-custom-page",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24767",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ClickWhale \u003c= 2.4.3 - Cross-Site Request Forgery",
    "slug": "clickwhale",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26963",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c 8.7 - Authenticated (Editor+) Privilege Escalation",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "[*, 8.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-48319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48319",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Plugmatter Optin Feature Box \u003c 2.0.14 - SQL Injection",
    "slug": "plugmatter-optin-feature-box-lite",
    "type": "plugin",
    "affected_version": "[*, 2.0.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9451",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ajax Search Lite \u003c= 4.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ajax-search-lite",
    "type": "plugin",
    "affected_version": "* - 4.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8619",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Poll Maker \u003c= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "epoll-wp-voting",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29818",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "qTranslate X Cleanup and WPML Import \u003c= 3.0.1 - Cross-Site Request Forgery via clean_ajx",
    "slug": "qtranslate-to-wpml-export",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29431",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Album Gallery – WordPress Gallery \u003c= 1.6.3 - Authenticated (Editor+) PHP Object Injection via Gallery Meta",
    "slug": "new-album-gallery",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13833",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.4 (Pro) \u0026 \u003c= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site  Scripting",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6005",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.4 (Pro) \u0026 \u003c= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site  Scripting",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6005",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEOPress \u003c= 6.5.0.2 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 6.5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1669",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Builder Sandwich – Front-End Page Builder \u003c= 5.1.0 - Missing Authorization",
    "slug": "page-builder-sandwich",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37218",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Live Chat – Live support \u003c= 3.1.0 - Cross-Site Request Forgery",
    "slug": "onwebchat",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-5642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5642",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Loco Translate \u003c= 2.6.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "loco-translate",
    "type": "plugin",
    "affected_version": "[*, 2.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0765",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopLentor – WooCommerce Builder for Elementor \u0026 Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \u003c= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3991",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IMPress for IDX Broker \u003c= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "idx-broker-platinum",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31556",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WorkScout-Core \u003c 1.7.06 - Cross-Site Request Forgery",
    "slug": "workscout-core",
    "type": "plugin",
    "affected_version": "[*, 1.7.06)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.06",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-59572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59572",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Add-ons \u003c= 6.1.3 - Cross-Site Request Forgery",
    "slug": "woocommerce-product-addons",
    "type": "plugin",
    "affected_version": "* - 6.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32794",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Content Writer \u003c= 3.6.8 - Unauthenticated Information Exposure via Log File",
    "slug": "content-writer",
    "type": "plugin",
    "affected_version": "* - 3.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10486",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Widget for Social Page Feeds \u003c= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "facebook-pagelike-widget",
    "type": "plugin",
    "affected_version": "* - 6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13207",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Apollo13 Framework Extensions \u003c= 1.9.3 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "apollo13-framework-extensions",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37480",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hotel Booking \u003c= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13447",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "iThoughts Advanced Code Editor \u003c= 1.2.10 - Cross-Site Request Forgery to Settings Update",
    "slug": "ithoughts-advanced-code-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7835",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "6.1 - 6.1.7",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40068",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada \u003c= 7.11.1 - Authenticated(Contributor+) Server Side Request Forgery via 'ajax_import_options'",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-39313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39313",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Mimetic Books \u003c= 0.2.13 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mimetic-books",
    "type": "plugin",
    "affected_version": "* - 0.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24548",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Theme \u003c= 1.0.9 - Cross-Site Request Forgery via dtwap_download()",
    "slug": "download-theme",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38062",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47872",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eDS Responsive Menu \u003c= 1.2 - Missing Authorization",
    "slug": "eds-responsive-menu",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49971",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Admin Columns PRO \u003c= 6.4.9 - Authenticated (Subscriber+) CSV Injection",
    "slug": "admin-columns-pro",
    "type": "plugin",
    "affected_version": "* - 6.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17661",
    "auth_type": "Auth",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FormFacade \u003c= 1.3.6 - Reflected Cross-Site Scripting",
    "slug": "formfacade",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54301",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Submitted Posts – Enable Users to Submit Posts from the Front End \u003c= 20240319 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "user-submitted-posts",
    "type": "plugin",
    "affected_version": "* - 20240319",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20240319",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5002",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… \u003c= 4.4 - Cross-Site Request Forgery via init_endpoint",
    "slug": "ladipage",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4731",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Easy Contact \u003c= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter",
    "slug": "wp-easy-contact",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8315",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Templately \u003c= 3.1.5 - Missing Authorization via AJAX actions",
    "slug": "templately",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50424",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Plum: Spin Wheel \u0026 Email Pop-up \u003c= 2.0 - Missing Authorization",
    "slug": "qodeblock",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38743",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Time Clock \u003c= 1.2.2 \u0026 Time Clock Pro \u003c= 1.1.4 - Unauthenticated (Limited) Remote Code Execution",
    "slug": "time-clock-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9593",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Time Clock \u003c= 1.2.2 \u0026 Time Clock Pro \u003c= 1.1.4 - Unauthenticated (Limited) Remote Code Execution",
    "slug": "time-clock",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9593",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.45.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.45.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7638",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Sola Support Tickets \u003c 3.13 - Cross-Site Scripting",
    "slug": "sola-support-tickets",
    "type": "plugin",
    "affected_version": "[*, 3.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-11012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11012",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pathomation \u003c= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pathomation",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27306",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avaz \u003c= 2.8 - Unauthenticated Local File Inclusion",
    "slug": "snsavaz",
    "type": "theme",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-28944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28944",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sala - Startup \u0026 SaaS WordPress Theme \u003c= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover",
    "slug": "sala",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4606",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Shop Page Builder \u003c= 2.27.7 - Missing Authorization",
    "slug": "dzs-wootable",
    "type": "plugin",
    "affected_version": "* - 2.27.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.27.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29001",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bulk Posts Editing For WordPress \u003c= 4.2.3 - Cross-Site Request Forgery",
    "slug": "ithemeland-bulk-posts-editing-lite",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4204",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unyson \u003c= 2.7.28 - Missing Authorization",
    "slug": "unyson",
    "type": "plugin",
    "affected_version": "* - 2.7.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44472",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meta Box \u003c= 4.16.1 - Mishandling of File Upload",
    "slug": "meta-box",
    "type": "plugin",
    "affected_version": "* - 4.16.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-14794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14794",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Google Map Targeting \u003c= 1.1.6 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "gmap-targeting",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52732",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fluent Forms \u003c= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 6.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3615",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32508",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Field Suite \u003c= 2.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "custom-field-suite",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3068",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Attachments \u003c= 1.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "download-attachments",
    "type": "plugin",
    "affected_version": "* - 1.2.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0076",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator \u003c= 4.4.1 - Missing Authorization",
    "slug": "feedzy-rss-feeds",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1092",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PeproDev CF7 Database \u003c= 1.7.0 - Unauthenticated Stored Cross-Site Scripting via form submission",
    "slug": "pepro-cf7-database",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-41863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41863",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ditty \u003c= 3.1.58 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60105",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow Gallery \u003c= 1.1.4 - Cross-Site Scripting",
    "slug": "slideshow-gallery-2",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-5229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5229",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Viper GuestBook \u003c= 1.3.15 - Cross-Site Scripting",
    "slug": "wp-vipergb",
    "type": "plugin",
    "affected_version": "[*, 1.3.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9356",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Automatic Translator with Google Translate \u003c= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Font",
    "slug": "auto-translate",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0632",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Button Plugin MaxButtons \u003c= 9.2 - Cross-Site Request Forgery",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "* - 9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36346",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Restricted Site Access  \u003c= 7.4.1 - IP Spoofing to Protection Mechanism Bypass",
    "slug": "restricted-site-access",
    "type": "theme",
    "affected_version": "* - 7.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48753",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Widget Countdown \u003c= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "widget-countdown",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor \u003c= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.30.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.30.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4566",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Expires Headers \u0026 Optimized Minify \u003c= 2.7 - Cross-Site Request Forgery via [placeholder]",
    "slug": "add-expires-headers",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27457",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zynith SEO \u003c= 7.4.9 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "zynith-seo",
    "type": "plugin",
    "affected_version": "* - 7.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43940",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy2Map Photos \u003c= 1.0.9 - SQL Injection",
    "slug": "easy2map-photos",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-4615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4615",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Projectopia \u003c= 5.1.18 - Unauthenticated Privilege Escalation via Account Takeover",
    "slug": "projectopia-core",
    "type": "plugin",
    "affected_version": "* - 5.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32648",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Structured Content \u003c= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode",
    "slug": "structured-content",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4608",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Block Spam By Math Reloaded \u003c= 2.2.4 - Missing Authorization",
    "slug": "block-spam-by-math-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28872",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.4 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6009",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP File Manager \u003c= 7.0 - Reflected Cross-Site Scripting",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "[*, 7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24177",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WpTravelly \u003c= 1.8.5 - Missing Authorization",
    "slug": "tour-booking-manager",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22737",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dashboard To-Do List \u003c= 1.3.1 - Cross-Site Request Forgery via ardtdw_widgetupdate()",
    "slug": "dashboard-to-do-list",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31376",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Admin and Site Enhancements (ASE) \u003c= 7.6.9 - IP Spoofing to Limit Login Attempt Bypass",
    "slug": "admin-site-enhancements",
    "type": "plugin",
    "affected_version": "* - 7.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13685",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultra Addons for Contact Form 7 \u003c= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode",
    "slug": "ultimate-addons-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 3.5.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6756",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5533",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "4.9.2",
    "from_version": "4.9.2",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5533",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WHA Crossword \u003c= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wha-crossword",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36365",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PeproDev WooCommerce Receipt Uploader \u003c= 2.6.9 - Reflected Cross-Site Scripting",
    "slug": "pepro-bacs-receipt-upload-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8873",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Shortcodes \u003c= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themify-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2732",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "MobiLoud \u003c= 4.6.6 - Missing Authorization",
    "slug": "mobiloud-mobile-app-plugin",
    "type": "plugin",
    "affected_version": "* - 4.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52813",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-dTree \u003c= 4.4.5 - Reflected Cross-Site Scripting",
    "slug": "wp-dtree-30",
    "type": "plugin",
    "affected_version": "* - 4.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41662",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ancient World Linked Data \u003c= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ancient-world-linked-data-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50520",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 5.9.7.3 - Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 5.9.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-35037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35037",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Engine \u003c= 6.3.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wplr-sync",
    "type": "plugin",
    "affected_version": "* - 6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39660",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Links Manager \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "affiliate-links-manager",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27273",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BSK Forms Blacklist \u003c= 3.8 - Reflected Cross-Site Scripting",
    "slug": "bsk-gravityforms-blacklist",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43233",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "s2Member \u003c= 240315 - Limited Privilege Escalation",
    "slug": "s2member",
    "type": "plugin",
    "affected_version": "* - 240315",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "240315",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31237",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "CTHthemes CityBook \u003c= 2.3.3, TownHub \u003c= 1.0.5, and EasyBook \u003c= 1.2.1 - Stored Cross-Site Scripting",
    "slug": "easybook",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-20212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20212",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CTHthemes CityBook \u003c= 2.3.3, TownHub \u003c= 1.0.5, and EasyBook \u003c= 1.2.1 - Stored Cross-Site Scripting",
    "slug": "townhub",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-20212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20212",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CTHthemes CityBook \u003c= 2.3.3, TownHub \u003c= 1.0.5, and EasyBook \u003c= 1.2.1 - Stored Cross-Site Scripting",
    "slug": "citybook",
    "type": "theme",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-20212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20212",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gearside Developer Dashboard \u003c= 1.0.72 - Reflected Cross-Site Scripting",
    "slug": "gearside-developer-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.0.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4429",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dima Take Action \u003c= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dima-take-action",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31742",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Go Maps \u003c= 9.0.15 - Authenticated (Admin+) Directory Traversal",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47595",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Hello World \u003c= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read",
    "slug": "hello-world",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9224",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Rus-To-Lat \u003c= 0.3 - Cross-Site Request Forgery to Plugins Options Changes",
    "slug": "rustolat",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25470",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BeeTeam368 Extensions \u003c= 1.9.4 - Unauthenticated Local File Inclusion",
    "slug": "beeteam368-extensions",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-25174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25174",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wpDiscuz \u003c= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2477",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1236",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ЮKassa для WooCommerce \u003c= 2.3.0 - Missing Authorization",
    "slug": "yookassa",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-34868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34868",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.0 - Missing Session Cookie Expiration",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-5868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5868",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Album and Image Gallery with Lightbox – Flagallery Photo Portfolio \u003c= 6.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "flash-album-gallery",
    "type": "plugin",
    "affected_version": "* - 6.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24903",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exertio Framework \u003c= 1.3.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "exertio-framework",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49402",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Xpert Tab \u003c=  1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xpert-tab",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46542",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Media Widget \u003c= 4.0 - Arbitrary File Upload",
    "slug": "social-media-widget",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-1949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1949",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.4.0 - Missing Authorization via submit",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50903",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP STAGING – Backup Duplicator \u0026 Migration \u003c= 2.9.17 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-staging",
    "type": "plugin",
    "affected_version": "* - 2.9.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2737",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Database to Excel \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "database-to-excel",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58844",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rename Author Slug \u003c= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "rename-author-slug",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23640",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Catalog Mode For WooCommerce \u003c= 5.0.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "woocommerce-catalog-enquiry",
    "type": "plugin",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5348",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Carousel Slider \u003c= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "product-carousel-slider-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47755",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arrow Maps \u003c= 1.0.9 - Reflected Cross-Site Scripting",
    "slug": "ap-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28858",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Legal + \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "legal-plus",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23835",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mortgage Calculator / Loan Calculator \u003c= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mortgage-loan-calculator",
    "type": "plugin",
    "affected_version": "* - 1.5.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0805",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Log WP_Mail \u003c= 0.1 - Sensitive Information Disclosure",
    "slug": "logwpmail",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1412",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ultimate Blocks \u003c= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3241",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Culqi \u003c= 3.0.14 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "culqi-checkout",
    "type": "plugin",
    "affected_version": "* - 3.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32819",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theater for WordPress \u003c= 0.18.6.2 - Reflected Cross-Site Scripting",
    "slug": "theatre",
    "type": "plugin",
    "affected_version": "* - 0.18.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.18.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11371",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Data Access \u003c= 4.3.1 - Admin+ SQL Injection",
    "slug": "wp-data-access",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24866",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MailPoet \u003c= 5.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mailpoet",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10103",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AutomatorWP \u003c= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions",
    "slug": "automatorwp",
    "type": "plugin",
    "affected_version": "* - 5.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9542",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Optimize Images ALT Text (alt tag) \u0026 names for SEO using AI \u003c= 3.1.1 - Unauthenticated Full Path Disclosure",
    "slug": "imageseo",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6571",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-34658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34658",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Revolut Gateway for WooCommerce \u003c= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update",
    "slug": "revolut-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.17.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.17.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8678",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP etracker \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "wp-etracker",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34431",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stripe Payments For WooCommerce by Checkout Plugins \u003c= 1.4.10 - Cross-Site Request Forgery",
    "slug": "checkout-plugins-stripe-woo",
    "type": "plugin",
    "affected_version": "* - 1.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23865",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Post Grid, Post Carousel, \u0026 List Category Posts \u003c= 2.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "post-carousel",
    "type": "plugin",
    "affected_version": "* - 2.4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0097",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qubely – Advanced Gutenberg Blocks \u003c= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID'",
    "slug": "qubely",
    "type": "plugin",
    "affected_version": "* - 1.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9601",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPShapere - WordPress admin theme \u003c= 1.4.1 - Cross-Site Request Forgery",
    "slug": "wpshapere-lite",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53317",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form By Mega Forms \u003c= 1.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "mega-forms",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40191",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cackle \u003c= 4.33 - Cross-Site Request Forgery",
    "slug": "cackle",
    "type": "plugin",
    "affected_version": "* - 4.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30546",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Registration \u003c= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-3342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3342",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP-CRM System \u003c= 3.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-crm-system",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30434",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Portfolio – Filterable Masonry Portfolio Gallery for Professionals \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "portfolio-pro",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11900",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8515",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sky Addons for Elementor \u003c= 2.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template",
    "slug": "sky-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9542",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.5.9 - Missing Authorization to Settings Update",
    "slug": "give",
    "type": "plugin",
    "affected_version": "[*, 2.5.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-20627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-20627",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EleForms – All In One Form Integration including DB for Elementor \u003c= 2.9.9.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "all-contact-form-integration-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2082",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conditional Fields for Contact Form 7 \u003c= 2.4.15 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "cf7-conditional-fields",
    "type": "plugin",
    "affected_version": "* - 2.4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50412",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp-Scribd-List \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-scribd-list",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23436",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wptobe-memberships \u003c= 3.4.2 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wptobe-memberships",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9048",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "i2 Pros \u0026 Cons \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "i2-pro-cons",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0065",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress 1.1.6  - 1.1.7 - Authentication Bypass to Account Takeover",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "1.1.6 - 1.1.7",
    "from_version": "1.1.6",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-7350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7350",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mini twitter feed \u003c= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mini-twitter-feed",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46496",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Counter live visitors for WooCommerce \u003c= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block",
    "slug": "counter-visitor-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7359",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "WP Google Map Plugin \u003c 2.3.7 - Reflected Cross-Site Scripting",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "[*, 2.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9305",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4553",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Animation Addons for Elementor \u003c= 1.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template",
    "slug": "animation-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12340",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Flexible Elementor Panel \u003c= 2.3.8 - Cross Site Request Forgery",
    "slug": "flexible-elementor-panel",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45076",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Share This Image \u003c= 2.03 - Open Redirect via link Parameter",
    "slug": "share-this-image",
    "type": "plugin",
    "affected_version": "* - 2.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.03",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8761",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Store Finder \u003c= 6.9.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "superstorefinder-wp",
    "type": "plugin",
    "affected_version": "* - 6.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43976",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP STAGING WordPress Backup Plugin – Migration Backup Restore \u003c= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "wp-staging",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3412",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "AI ChatBot for WordPress \u003c= 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 7.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9111",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup box \u003c= 4.1.2 - Cross-Site Request Forgery",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34367",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MF Plus WPML \u003c= 1.1 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "mf-plus-wpml",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49431",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Button contact VR \u003c= 4.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "button-contact-vr",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2220",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Light Poll \u003c= 1.0.0 - Cross-Site Request Forgery to Poll Answers Deletion",
    "slug": "light-poll",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6720",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Download Manager \u003c= 2.9.49 - Reflected Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "[*, 2.9.50)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.50",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-2216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2216",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Burst Statistics Really Simple Plugins \u003c= 1.5.3 - Authenticated (Editor+) SQL Injection",
    "slug": "burst-statistics",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0405",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "KB Support \u003c= 1.5.84 - Authenticated (Subscriber+) CSV Injection",
    "slug": "kb-support",
    "type": "plugin",
    "affected_version": "* - 1.5.84",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.84",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25983",
    "auth_type": "Auth",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vrm 360 3D Model Viewer \u003c= 1.2.1 - Authenticated(Subscriber+) Sensitive Information Exposure",
    "slug": "vrm360",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5177",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP User \u003c= 7.0 - Unauthenticated SQL Injection",
    "slug": "wp-user",
    "type": "plugin",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4049",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARS Affiliate Page Plugin \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "ars-affiliate-page",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12098",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wp-cyr-cho \u003c= 0.1 - Cross-Site Request Forgery",
    "slug": "wp-cyr-cho",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-43835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-43835",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Child Theme Generator \u003c= 2.2.7 - Reflected Cross-Site Scripting",
    "slug": "child-theme-generator",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24982",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Timber \u003c= 1.23.1 - Use of a Vulnerable Dependency",
    "slug": "timber-library",
    "type": "plugin",
    "affected_version": "* - 1.23.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45411",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "E2Pdf – Export To Pdf Tool for WordPress \u003c= 1.20.27 - Missing Authorization",
    "slug": "e2pdf",
    "type": "plugin",
    "affected_version": "* - 1.20.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37415",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sign-up Sheets \u003c= 2.3.3 - Cross-Site Request Forgery",
    "slug": "sign-up-sheets",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49391",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LifterLMS – WordPress LMS Plugin for eLearning \u003c= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "* - 7.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4743",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ADFO – Custom data in admin dashboard  \u003c= 1.9.1 - Authenticated (Admin+) PHP Object Injection",
    "slug": "admin-form",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27300",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pyrmont V2 \u003c= 2.0.7 - SQL Injection",
    "slug": "pyrmont-v2",
    "type": "theme",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2009-4424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-4424",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TreePress – Easy Family Trees \u0026 Ancestor Profiles \u003c= 2.0.22 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'post_title' parameter",
    "slug": "treepress",
    "type": "plugin",
    "affected_version": "* - 2.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23863",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "weMail \u003c= 1.14.5 - Reflected Cross-Site Scripting",
    "slug": "wemail",
    "type": "plugin",
    "affected_version": "* - 1.14.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43238",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Forms \u003c= 6.0.1 - IP Spoofing via HTTP header",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "* - 6.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0816",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gwolle Guestbook \u003c= 2.5.3 - Cross-Site Scripting",
    "slug": "gwolle-gb",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-17884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17884",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DW Question \u0026 Answer Pro \u003c= 1.3.4 - Missing Authorization Checks",
    "slug": "dw-question-answer-pro",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24800",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "OSM - OpenStreetMap \u003c= 6.0 - Cross-Site Request Forgery",
    "slug": "osm",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-30544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-30544",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Word Balloon \u003c= 4.20.2 - Cross-Site Request Forgery",
    "slug": "word-balloon",
    "type": "plugin",
    "affected_version": "* - 4.20.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.20.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5884",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PDF.js \u003c 4.2.67 - Arbitrary JavaScript Execution",
    "slug": "bsk-pdf-manager",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js \u003c 4.2.67 - Arbitrary JavaScript Execution",
    "slug": "pdfjs-viewer-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js \u003c 4.2.67 - Arbitrary JavaScript Execution",
    "slug": "tainacan",
    "type": "plugin",
    "affected_version": "* - 0.21.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.21.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js \u003c 4.2.67 - Arbitrary JavaScript Execution",
    "slug": "pdf-viewer-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js \u003c 4.2.67 - Arbitrary JavaScript Execution",
    "slug": "ari-fancy-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js \u003c 4.2.67 - Arbitrary JavaScript Execution",
    "slug": "wonderplugin-pdf-embed",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js \u003c 4.2.67 - Arbitrary JavaScript Execution",
    "slug": "pdf-embedder",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js \u003c 4.2.67 - Arbitrary JavaScript Execution",
    "slug": "pdf-poster",
    "type": "plugin",
    "affected_version": "* - 2.1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js \u003c 4.2.67 - Arbitrary JavaScript Execution",
    "slug": "pdfjs-viewer-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js \u003c 4.2.67 - Arbitrary JavaScript Execution",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js \u003c 4.2.67 - Arbitrary JavaScript Execution",
    "slug": "3d-flipbook-dflip-lite",
    "type": "plugin",
    "affected_version": "* - 1.15.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Groups for LearnDash \u003c= 6.1.0.1 - Missing Authorization to Authenticated (Group Leader+) User Group Add",
    "slug": "uncanny-learndash-groups",
    "type": "plugin",
    "affected_version": "* - 6.1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-8350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8350",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.4 - Missing Authorization to Arbitrary Post Deletion",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5386",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Timed Content \u003c= 2.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "timed-content",
    "type": "plugin",
    "affected_version": "* - 2.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0067",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder – Contact forms and much more \u003c= 8.5.6 - Missing Authorization via set_read()",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1130",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BMI BMR Calculator \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "bmi-bmr-calculator",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1267",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdForest \u003c= 6.0.9 - Authentication Bypass to Admin",
    "slug": "adforest",
    "type": "theme",
    "affected_version": "* - 6.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-8359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8359",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Save as PDF plugin by Pdfcrowd \u003c= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "save-as-pdf-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37549",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 2.4.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37259",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flatsome \u003c= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "flatsome",
    "type": "theme",
    "affected_version": "* - 3.18.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5156",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Post Type Images \u003c= 0.5 - Cross-Site Request Forgery",
    "slug": "custom-post-types-image",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58255",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP User Frontend \u003c= 3.5.28 - Privilege Escalation",
    "slug": "wp-user-frontend",
    "type": "plugin",
    "affected_version": "* - 3.5.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24649",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Pro \u003c= 5.2.8 - Unauthenticated Local File Inclusion",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "* - 5.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-47178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47178",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Faqs \u003c= 1.8.21 - Cross-Site Scripting",
    "slug": "ultimate-faqs",
    "type": "plugin",
    "affected_version": "[*, 1.8.22)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.22",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15643",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restrict Content \u003c= 3.2.7 - Information Exposure via legacy log file",
    "slug": "restrict-content",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47668",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Admin Bar Improved \u003c= 3.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wordpress-admin-bar-improved",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30552",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Login Log \u003c 1.1.2 - SQL Injection",
    "slug": "simple-login-log",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-18514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18514",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NextGen GalleryView \u003c= 0.5.5 - Reflected Cross-Site Scripting",
    "slug": "wordpress-nextgen-galleryview",
    "type": "plugin",
    "affected_version": "* - 0.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35098",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit \u003c= 3.2.2 - Unauthenticated SQL Injection",
    "slug": "wp-marketing-automations",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9186",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 5.6.6 - Cross-Site Request Forgery",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "* - 5.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41805",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Active Products Tables for WooCommerce. Professional products tables for WooCommerce store \u003c= 1.0.6.1 - Cross-Site Request Forgery",
    "slug": "profit-products-tables-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0796",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Inventory Manager \u003c= 2.1.0.12 - Reflected Cross-Site Scripting via 'message'",
    "slug": "wp-inventory-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2123",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FeedList \u003c= 2.61.03 - Reflected Cross-Site Scripting",
    "slug": "feedlist",
    "type": "plugin",
    "affected_version": "* - 2.61.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.61.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2010-4637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4637",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Reviews \u003c= 3.2.14 - Reflected Cross-Site Scripting",
    "slug": "ultimate-reviews",
    "type": "plugin",
    "affected_version": "* - 3.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49266",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Contact Slider \u003c= 2.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-contact-slider",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3237",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AB Press Optimizer \u003c= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ab-press-optimizer-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-26375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-26375",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GS Portfolio for Envato \u003c= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gs-envato-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0559",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Upload Restriction \u003c= 2.2.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-upload-restriction",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34625",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Give - Donation Plugin \u003c= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation",
    "slug": "give",
    "type": "plugin",
    "affected_version": "[*, 2.33.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.33.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-41665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41665",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All-in-One Addons for Elementor – WidgetKit \u003c= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Widgets",
    "slug": "widgetkit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2137",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The integration of the AMO.CRM \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "leads-for-amo-crm",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9628",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SERPed.net \u003c= 4.6 - Reflected Cross-Site Scripting",
    "slug": "serped-net",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32651",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder Addons by WPZOOM \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget",
    "slug": "wpzoom-addons-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2181",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Online Contract \u003c= 5.1.4 - Missing Authorization to Unauthenticated Settings Import",
    "slug": "onlinecontract",
    "type": "plugin",
    "affected_version": "* - 5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0954",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form, Survey \u0026 Popup Form Plugin for WordPress –  ARForms Form Builder \u003c 1.5 - Cross-Site Scripting",
    "slug": "arforms-form-builder",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24718",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Edwiser Bridge \u003c= 2.0.6 - Cross-Site Request Forgery Bypass",
    "slug": "edwiser-bridge",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4399",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Revive.so – Bulk Rewrite and Republish Blog Posts \u003c= 2.0.3 - Missing Authorization",
    "slug": "revive-so",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32233",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Embeds \u003c= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "video-embeds",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49429",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Product Add-Ons \u003c= 4.2.0 - Missing Authorization",
    "slug": "yith-woocommerce-product-add-ons",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46635",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tumult Hype Animations \u003c= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function",
    "slug": "tumult-hype-animations",
    "type": "plugin",
    "affected_version": "* - 1.9.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11082",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "We’re Open! \u003c= 1.45 - Cross-Site Request Forgery",
    "slug": "opening-hours",
    "type": "plugin",
    "affected_version": "* - 1.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25067",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PHP Everywhere \u003c= 2.0.3 - Remote Code Execution by Subscriber+ users via shortcode",
    "slug": "php-everywhere",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-24663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-24663",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2772",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp EMember \u003c= 10.6.5 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "wp-eMember",
    "type": "plugin",
    "affected_version": "* - 10.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5080",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Events Manager \u003c= 6.4.8 - Reflected Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5889",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Client Dash \u003c= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "client-dash",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49165",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Downloader for TikTok \u003c 1.4 - Server-Side Request Forgery",
    "slug": "downloader-tiktok",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-24142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24142",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss \u003c= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13611",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Paytium: Mollie payment forms \u0026 donations \u003c= 4.3.7 - Missing Authorization in 'create_mollie_account'",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7291",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Elementor Header \u0026 Footer Builder \u003c= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11230",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageMapper \u003c= 1.2.6 - Cross-Site Request Forgery to Plugin Settings Change via ajax",
    "slug": "imagemapper",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5975",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Weekly News \u003c 2.2.9 - Cross-Site Scripting",
    "slug": "weeklynews",
    "type": "theme",
    "affected_version": "[*, 2.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9504",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Table \u0026 Contact Form 7 Database – Tablesome \u003c= 1.0.27 - Reflected Cross-Site Scripting",
    "slug": "tablesome",
    "type": "plugin",
    "affected_version": "* - 1.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29110",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pre-Publish Checklist \u003c= 1.1.1 - Insecure Direct Object Reference to Arbitrary Post '_ppc_meta_key' Update",
    "slug": "pre-publish-checklist",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44151",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CHP Ads Block Detector \u003c= 3.9.4 - Cross-Site Request Forgery via chp_abd_action",
    "slug": "chp-ads-block-detector",
    "type": "plugin",
    "affected_version": "* - 3.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2352",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Events Manager \u003c= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection",
    "slug": "wp-events-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7717",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Feed for WooCommerce \u003c= 2.2.8 - Missing Authorization",
    "slug": "webtoffee-product-feed",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49287",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4406",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infility Global \u003c= 2.14.7 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "infility-global",
    "type": "plugin",
    "affected_version": "* - 2.14.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47650",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Alert Box Block – Display notice/alerts in the front end \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "alert-box-block",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22675",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Reviews \u003c= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "* - 6.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27629",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "atec Debug \u003c= 1.2.22 - Authenticated (Administrator+) Arbitrary File Read",
    "slug": "atec-debug",
    "type": "plugin",
    "affected_version": "* - 1.2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9516",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "List Children \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "list-children",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4099",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajax BootModal Login \u003c= 1.4.3 - CAPTCHA Reuse",
    "slug": "ajax-bootmodal-login",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-15876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-15876",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Optimize By xTraffic \u003c= 5.1.6 - Unauthenticated PHP Object Injection",
    "slug": "wp-optimize-by-xtraffic",
    "type": "plugin",
    "affected_version": "* - 5.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28970",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bookly \u003c= 20.3 - Staff Member Stored Cross-Site Scripting",
    "slug": "bookly-responsive-appointment-booking-tool",
    "type": "plugin",
    "affected_version": "* - 20.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24930",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 3.2.9 - Missing Authorization",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49697",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Hack Repair Guy's Plugin Archiver \u003c= 2.0.4 - Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-content",
    "slug": "hackrepair-plugin-archiver",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10188",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Bing Search API Integration \u003c= 0.3.3 - Reflected Cross-Site Scripting",
    "slug": "abbs-bing-search",
    "type": "plugin",
    "affected_version": "* - 0.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51692",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewsBoard Post and RSS Scroller \u003c= 1.2.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "newsboard",
    "type": "plugin",
    "affected_version": "* - 1.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31402",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thumbnail carousel slider \u003c= 1.1.9 - Reflected Cross-Site Scripting",
    "slug": "wp-responsive-thumbnail-slider",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2120",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TWB Woocommerce Reviews \u003c= 1.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "twb-woocommerce-reviews",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47653",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Specific Content For Mobile – Customize the mobile version without redirections \u003c= 0.1.9.5 - Reflected Cross-Site Scripting",
    "slug": "specific-content-for-mobile",
    "type": "plugin",
    "affected_version": "* - 0.1.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29126",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WiserNotify Social Proof \u003c= 2.5 - Missing Authorization",
    "slug": "wiser-notify",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41690",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Olympus Shortcodes \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "olympus-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51857",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DX Delete Attached Media \u003c= 2.0.5.1 - Cross-Site Request Forgery via add_to_base",
    "slug": "dx-delete-attached-media",
    "type": "plugin",
    "affected_version": "* - 2.0.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46073",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Civi - Job Board \u0026 Freelance Marketplace WordPress Theme \u003c= 2.1.6.1 - Authentication Bypass",
    "slug": "civi",
    "type": "theme",
    "affected_version": "* - 2.1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13772",
    "auth_type": "Unauth",
    "cvss_score": 5.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Advanced File Manager \u003c= 5.3.1 - Missing Authorization to Notice Dismisaal",
    "slug": "file-manager-advanced",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47688",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "404 to Start \u003c= 1.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "404-to-start",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3855",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Custom Cursors \u003c= 3.0 - Cross-Site Request Forgery to Cursor Manipulation",
    "slug": "wp-custom-cursors",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3151",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Affiliates Manager Google reCAPTCHA Integration \u003c= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "affiliates-manager-google-recaptcha-integration",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48233",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Lister Lite for eBay \u003c= 3.6.3 - Reflected Cross-Site Scripting",
    "slug": "wp-lister-for-ebay",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47380",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Marketing Automation \u003c= 1.2.6.8 - Reflected Cross-Site Scripting",
    "slug": "marketing-automation",
    "type": "plugin",
    "affected_version": "* - 1.2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22631",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Currency Exchange Rates \u003c= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-currency-exchange-rates",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54332",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PlatiOnline Payments \u003c= 6.3.2 - Missing Authorization",
    "slug": "plationline",
    "type": "plugin",
    "affected_version": "* - 6.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53288",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.66 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.66",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.66",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3295",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cliengo – Chatbot \u003c= 3.0.1 - Cross-Site Request Forgery",
    "slug": "cliengo",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37923",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "SEO Redirection \u003c= 8.1 - Subscriber+ SQL Injection",
    "slug": "seo-redirection",
    "type": "plugin",
    "affected_version": "* - 8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24847",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Aiomatic - AI Content Writer, Editor, ChatBot \u0026 AI Toolkit \u003c= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "aiomatic-automatic-ai-content-writer",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6206",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ni CRM Lead \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "ni-crm-lead",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54237",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Compress – Image Optimizer [All-In-One] \u003c= 6.20.01 - Open Redirect via css",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.20.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.20.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6812",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GDPR Data Request Form \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gdpr-data-request-form",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24836",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder Gutenberg Blocks – CoBlocks \u003c= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Profiles",
    "slug": "coblocks",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2933",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Private Content Plus \u003c= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "wp-private-content-plus",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11292",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "hiWeb Export Posts \u003c= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletion",
    "slug": "hiweb-export-posts",
    "type": "plugin",
    "affected_version": "* - 0.9.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7640",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP Google Maps \u003c= 9.0.27 - Unauthenticated Stored Cross-Site Scripting via REST API",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6627",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bloom Email Opt-In  \u003c 1.1.1 - Sensitive Information Disclosure",
    "slug": "bloom",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-11003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11003",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Product List Table \u003c= 3.0.0 - Cross-Site Request Forgery",
    "slug": "custom-product-list-table",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4541",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TranslatePress \u003c= 2.0.8 - Authenticated Stored Cross-Site Scripting",
    "slug": "translatepress-multilingual",
    "type": "plugin",
    "affected_version": "[*, 2.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24610",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Notibar – Notification Bar for WordPress \u003c= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text",
    "slug": "notibar",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11012",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Metorik – Reports \u0026 Email Automation for WooCommerce \u003c= 1.7.1 - Cross-Site Request Forgery",
    "slug": "metorik-helper",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38691",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wp Ultimate Review \u003c= 2.0.3 - Cross-Site Request Forgery",
    "slug": "wp-ultimate-review",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28987",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Database Backup and check Tables Automated With Scheduler 2024 \u003c= 2.35 - Authenticated (Administrator+) Sensitive Information Exposure",
    "slug": "database-backup",
    "type": "plugin",
    "affected_version": "* - 2.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.35",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13911",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Thrive Theme Builder \u003c 3.24.0 - Privilege Escalation",
    "slug": "thrive-theme",
    "type": "theme",
    "affected_version": "[*, 3.24.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.24.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-47782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47782",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Pack Elementor addons \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-pack-addon",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46472",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ePermissions \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "epermissions",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23635",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Site Reviews \u003c= 6.10.2 - Missing Authorization",
    "slug": "site-reviews",
    "type": "plugin",
    "affected_version": "[*, 6.10.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-49832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49832",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PWGRandom \u003c= 1.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "pwgrandom",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9394",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Travel  \u003c= 4.4.6 - Cross-Site Request Forgery Bypass",
    "slug": "wp-travel",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4389",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Spoiler \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-spoiler",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31020",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donations Made Easy – Smart Donations \u003c= 4.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-donations",
    "type": "plugin",
    "affected_version": "* - 4.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47550",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Domain Replace \u003c= 1.3.8 - Reflected Cross-Site Scripting",
    "slug": "domain-replace",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1218",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GS Testimonial Slider \u003c= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gs-testimonial",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Security \u0026 Malware scan by CleanTalk \u003c= 2.120 - IP Spoofing to Protection Mechanism Bypass",
    "slug": "security-malware-firewall",
    "type": "plugin",
    "affected_version": "* - 2.120",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.120",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5239",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "nsc \u003c= 1.0 - Prototype Pollution to Reflected Cross-Site Scripting",
    "slug": "nsc",
    "type": "theme",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3965",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clever Addons for Elementor \u003c=2.0.15 - Stored Cross-Site Scripting",
    "slug": "cafe-lite",
    "type": "plugin",
    "affected_version": "[*, 2.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24273",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4376",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podcast Subscribe Buttons \u003c 1.4.2 - Stored Cross-Site Scripting",
    "slug": "podcast-subscribe-buttons",
    "type": "plugin",
    "affected_version": "[*, 1.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24743",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez \u003c= 4.1.1 - Reflected Cross-Site Scripting",
    "slug": "houzez",
    "type": "theme",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49407",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TheGem \u003c= 5.10.5 - Missing Authorization",
    "slug": "thegem",
    "type": "theme",
    "affected_version": "* - 5.10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60097",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition",
    "slug": "file-manager",
    "type": "plugin",
    "affected_version": "6.0 - 6.5.5",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7627",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Far Future Expiry Header \u003c= 1.4 - Plugin's Settings Update via Cross-Site Request Forgery",
    "slug": "far-future-expiry-header",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24799",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Broadstreet \u003c= 1.51.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "broadstreet",
    "type": "plugin",
    "affected_version": "* - 1.51.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.51.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32211",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments – wpDiscuz \u003c= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.24",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9488",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom 404 Pro \u003c= 3.11.1 - Reflected Cross-Site Scripting",
    "slug": "custom-404-pro",
    "type": "plugin",
    "affected_version": "* - 3.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39646",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Speed Booster Pack \u003c= 4.3.3 - Admin+ SQL Injection",
    "slug": "speed-booster-pack",
    "type": "plugin",
    "affected_version": "* - 4.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25023",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VikRentCar Car Rental Management System \u003c= 1.3.2 - Information Exposure",
    "slug": "vikrentcar",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32780",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "iThemes Security \u003c 3.2.5 - Cross-Site Scripting",
    "slug": "better-wp-security",
    "type": "plugin",
    "affected_version": "[*, 3.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-4263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4263",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Asset CleanUp: Page Speed Booster \u003c= 1.3.9.3 - Missing Authorization",
    "slug": "wp-asset-clean-up",
    "type": "plugin",
    "affected_version": "* - 1.3.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43314",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HTML5 chat \u003c= 1.04 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "html5-chat",
    "type": "plugin",
    "affected_version": "* - 1.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12451",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Tickets and Registration \u003c= 5.8.1 - Missing Authorization",
    "slug": "event-tickets",
    "type": "plugin",
    "affected_version": "* - 5.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1053",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.0.8.2 - Unauthenticated SQL Injection",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "[*, 1.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-14502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-14502",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via CSS",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.4",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9036",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via CSS",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.2",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9036",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via CSS",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9036",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via CSS",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9036",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via CSS",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.4",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9036",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Post Modules for Elementor \u003c= 2.5.0 - Reflected Cross-Site Scripting",
    "slug": "wp-post-modules-el",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31636",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGlobus – Multilingual Everything! \u003c= 1.9.6 - Cross-Site Request Forgery",
    "slug": "wpglobus",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-5361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5361",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "12 Step Meeting List \u003c= 3.16.5 - Unauthenticated Sensitive Information Exposure",
    "slug": "12-step-meeting-list",
    "type": "plugin",
    "affected_version": "* - 3.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24582",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Donate \u003c= 2.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-donate",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32637",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.6.8.1 - Unauthenticated Bypass to User Registration",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6099",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AddFunc Mobile Detect \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addfunc-mobile-detect",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22550",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Persian Nested Show/Hide Text \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "persian-nested-showhide-text",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51831",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Download Monitor \u003c 3.5.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "[*, 3.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5212",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 5.2.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12273",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Insurance \u003c= 3.5 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "insurance",
    "type": "theme",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31634",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wp anything slider \u003c= 9.1 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "wp-anything-slider",
    "type": "plugin",
    "affected_version": "* - 9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5466",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Magazine Blocks \u003c= 1.3.6 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "magazine-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34760",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.9 - Subscriber+ SQL Injection",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24919",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Awesome Shortcodes For Genesis  1.1.8 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "awesome-shortcodes-for-genesis",
    "type": "plugin",
    "affected_version": "1.1.8",
    "from_version": "1.1.8",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51638",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YDS Support Ticket System \u003c= 1.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "yds-support-ticket-system",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55985",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "HT Conctact Form 7 \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ht-contactform",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookie Nonsense for YT \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yt-cookie-nonsense",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51933",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPPizza – A Restaurant Plugin \u003c= 3.18.13 - Reflected Cross-Site Scripting",
    "slug": "wppizza",
    "type": "plugin",
    "affected_version": "* - 3.18.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35766",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flexo Counter \u003c= 1.0001 - Reflected Cross-Site Scripting",
    "slug": "flexo-countdown",
    "type": "plugin",
    "affected_version": "* - 1.0001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0001",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50052",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Get Use APIs – JSON Content Importer \u003c= 1.5.3 - Reflected Cross-Site Scripting",
    "slug": "json-content-importer",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6268",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 2.1.5 - Unauthenticated Information Exposure",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47344",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "News Kit Elementor Addons \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "news-kit-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54260",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Report \u003c= 1.4.5 - Reflected Cross-Site Scripting",
    "slug": "ithemelandco-woo-report",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38683",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DirectoryPress \u003c= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "directorypress",
    "type": "plugin",
    "affected_version": "* - 3.6.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10584",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FileBird \u003c= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Reset",
    "slug": "filebird",
    "type": "plugin",
    "affected_version": "* - 6.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11510",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MediaPress \u003c= 1.5.9.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "mediapress",
    "type": "plugin",
    "affected_version": "* - 1.5.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58608",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rich Counter \u003c 1.2.0 - JavaScript Injection",
    "slug": "rich-counter",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-10394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10394",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BigBuy Dropshipping Connector for WooCommerce \u003c= 2.0.0 - Unauthenticated Full Path Disclosute",
    "slug": "bigbuy-wc-dropshipping-connector",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13538",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Post \u003c= 1.1 - Stored Cross-Site Scripting",
    "slug": "simple-post",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.3 - Improper Access Control",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-0589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0589",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Media Sharing \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "social-media-sharing",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54423",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Syntax \u003c 0.9.10 - Remote Code Execution",
    "slug": "wp-syntax",
    "type": "plugin",
    "affected_version": "* - 0.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2009-2852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-2852",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPAMS \u003c= 44.0 (17-08-2023) - Unauthenticated Stored Cross-Site Scripting",
    "slug": "apartment-management",
    "type": "plugin",
    "affected_version": "[*, 44.0 (17-08-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "44.0 (17-08-2023)",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39392",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sniplets \u003c 1.2.3 - Cross-Site Scripting",
    "slug": "sniplets",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2008-1061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-1061",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MainWP \u003c= 4.4.3.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "mainwp",
    "type": "plugin",
    "affected_version": "* - 4.4.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-38519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38519",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "New Adman \u003c= 1.6.8 - Cross-Site Request Forgery via plugin_menu",
    "slug": "new-adman",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27441",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Community by PeepSo \u003c= 6.0.2.0 - Cross-Site Request Forgery leading to Plugin/Subscription Deletion",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.0.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25967",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "ReDi Restaurant Reservation \u003c= 24.1209 - Reflected Cross-Site Scripting",
    "slug": "redi-restaurant-reservation",
    "type": "plugin",
    "affected_version": "* - 24.1209",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.1209",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48286",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Favorites \u003c= 2.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "favorites",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1452",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Fields \u003c 1.2 - Cross-Site Request Forgery",
    "slug": "simple-fields",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-7476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7476",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Football Pool \u003c= 2.11.10 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "football-pool",
    "type": "plugin",
    "affected_version": "* - 2.11.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43130",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.8 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26935",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post And Page Reactions \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "post-and-page-reactions",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22568",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Help Desk – Best Help Desk \u0026 Support Plugin \u003c= 2.7.7 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23679",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "ARForms \u003c= 6.4.1 - Missing Authorization to Plugin Settings Change",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "* - 6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54217",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Linear \u003c= 2.8.1 - Cross-Site Request Forgery to Cache Reset",
    "slug": "linear",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13709",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BackWPup \u003c= 4.0.2 - Plaintext Storage of Backup Destination Password",
    "slug": "backwpup",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-5775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5775",
    "auth_type": "Privileged",
    "cvss_score": 2.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Content Copy Protection \u003c= 3.4.4  - Cross-Site Request Forgery to Setting Update",
    "slug": "wp-content-copy-protection",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-23983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23983",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.2.41 - Cross-Site Request Forgery",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.2.42)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.42",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9380",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All-in-One WP Migration \u003c=  7.62 - Unauthenticated Reflected Cross-Site Scripting",
    "slug": "all-in-one-wp-migration",
    "type": "plugin",
    "affected_version": "* - 7.62",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.62",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2546",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grand Restaurant WordPress \u003c= 7.0 - Cross-Site Request Forgery",
    "slug": "grandrestaurant",
    "type": "theme",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39351",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rate My Post – Star Rating Plugin by FeedbackWP \u003c= 3.4.4 - Insecure Direct Object Reference",
    "slug": "rate-my-post",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32823",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Caldera forms \u003c= 1.9.4 - Admin+ Stored Cross-Site Scripting",
    "slug": "caldera-forms",
    "type": "plugin",
    "affected_version": "[*, 1.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24896",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mapping Multiple URLs Redirect Same Page \u003c= 5.8 - Reflected Cross-Site Scripting",
    "slug": "mapping-multiple-urls-redirect-same-page",
    "type": "plugin",
    "affected_version": "* - 5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Favorite Posts \u003c= 1.6.8 - Cross-Site Request Forgery",
    "slug": "wp-favorite-posts",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34427",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "POEditor \u003c= 0.9.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "poeditor",
    "type": "plugin",
    "affected_version": "* - 0.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32453",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Your Text Manager \u003c= 0.3.0 - Cross-Site Scripting",
    "slug": "your-text-manager",
    "type": "plugin",
    "affected_version": "* - 0.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4604",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1499",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Application Firewall \u003c= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass",
    "slug": "web-application-firewall",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4539",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Vitepos – Point of sale (POS) \u003c= 3.1.3 - Missing Authorization",
    "slug": "vitepos-lite",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26750",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Pop-up \u003c= 1.1.5 - Privilege Escalation",
    "slug": "pop-up-pop-up",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38070",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Datasets Manager by Arttia Creative \u003c= 1.5 - Unauthenticated Arbitrary File Upload",
    "slug": "datasets-manager-by-arttia-creative",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52375",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ad Invalid Click Protector (AICP) \u003c= 1.2.5.2 - Cross-Site Request Forgery to Arbitrary Ban Deletion",
    "slug": "ad-invalid-click-protector",
    "type": "plugin",
    "affected_version": "* - 1.2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0191",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nokaut Offers Box \u003c= 1.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "nokaut-offers-box",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10632",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackWPup – WordPress Backup Plugin \u003c 1.4.1 - Directory Traversal",
    "slug": "backwpup",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2011-5208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5208",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Page Builder \u003c= 1.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-pagebuilder",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3830",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.12.6 - Authenticated (Contributor+) Path Traversal",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.12.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3107",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Bulk \u003c= 1.0.11 - Missing Authorization",
    "slug": "bulk",
    "type": "theme",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26867",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Payment Form for PayPal Pro \u003c 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "payment-form-for-paypal-pro",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-7666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7666",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qtranslate Slug \u003c= 1.1.16 - Reflected Cross-Site Scripting",
    "slug": "qtranslate-slug",
    "type": "plugin",
    "affected_version": "* - 1.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10092",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spoki – Chat Buttons and WooCommerce Notifications \u003c= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spoki",
    "type": "plugin",
    "affected_version": "* - 2.15.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11893",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "2Checkout Add-on for iThemes Exchange \u003c 1.1.0 -  Reflected Cross-Site Scripting",
    "slug": "exchange-addon-2checkout",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9364",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nexos - Real Estate WordPress Theme \u003c= 1.7 - SQL Injection",
    "slug": "nexos",
    "type": "theme",
    "affected_version": "[*, 1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-15363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-15363",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Travelpayouts \u003c= 1.1.12 - Cross-Site Request Forgery to Settings Import",
    "slug": "travelpayouts",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5934",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Schema \u0026 Structured Data for WP \u0026 AMP \u003c= 1.49 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "schema-and-structured-data-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.49",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9512",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 5.0.22 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 5.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47439",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Copyright Safeguard Footer Notice \u003c= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "copyright-safeguard-footer-notice",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23870",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LSD Custom taxonomy and category meta \u003c= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "custom-taxonomy-category-and-term-fields",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46502",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Easy Contact \u003c= 4.0.1 - Unauthenticated PHP Object Injection",
    "slug": "wp-easy-contact",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53572",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fontsy \u003c= 1.8.6 - Unauthenticated SQL Injection",
    "slug": "fontsy",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4447",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slickstream \u003c= 2.0.3 - Cross-Site Request Forgery",
    "slug": "slick-engagement",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53273",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Categorify \u003c= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxDeleteCategory",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "* - 1.0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1907",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lana Shortcodes \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "lana-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3372",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XV Random Quotes \u003c= 1.40 - Cross-Site Request Forgery to Settings Reset",
    "slug": "xv-random-quotes",
    "type": "plugin",
    "affected_version": "* - 1.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13580",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Chamber Dashboard Business Directory \u003c 3.3.1 - Cross-Site Scripting",
    "slug": "chamber-dashboard-business-directory",
    "type": "plugin",
    "affected_version": "[*, 3.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-24699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24699",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "f(x) Private Site \u003c= 1.2.1 - Sensitive Information Exposure",
    "slug": "fx-private-site",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0906",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Motors – Car Dealer, Classifieds \u0026 Listing \u003c= 1.4.3 - Unauthenticated Arbitrary File Upload",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3989",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Sort Order \u003c= 1.3.1 - Missing Authorization",
    "slug": "wp-sort-order",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31294",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ezoic \u003c= 2.8.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ezoic-integration",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41315",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Salesmate Add-On for Gravity Forms \u003c= 2.0.3 - Missing Authorization",
    "slug": "gf-salesmate-add-on",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31533",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Yoast SEO \u003c= 2.1.1 - Cross Site Scripting via post_title parameter",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-6692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6692",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traveler Layout Essential For Elementor \u003c 1.4 - Unauthenticated Server-Side Request Forgery",
    "slug": "traveler-layout-essential-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-22701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22701",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker \u003c= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 5.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13505",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Various Affected Software (Various Versions) - Arbitrary File Upload",
    "slug": "piwik-pro",
    "type": "plugin",
    "affected_version": "0.2.35 - 0.4.3",
    "from_version": "0.2.35",
    "from_inclusive": true,
    "to_version": "0.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2009-4140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-4140",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Various Affected Software (Various Versions) - Arbitrary File Upload",
    "slug": "woopra",
    "type": "plugin",
    "affected_version": "* - 1.4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2009-4140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-4140",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Faltu Testimonial Rotator \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "faltu-testimonial-rotator",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51853",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Landing Page Builder \u003c= 1.5.2.0 - Authenticated (Editor+) Local File Inlcusion",
    "slug": "page-builder-add",
    "type": "plugin",
    "affected_version": "* - 1.5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43345",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JVM rich text icons \u003c= 1.2.3 - Authenticated(Subscriber+) Arbitrary File Upload",
    "slug": "jvm-rich-text-icons",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51417",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Beds24 Online Booking \u003c= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode",
    "slug": "beds24-online-booking",
    "type": "plugin",
    "affected_version": "* - 2.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10177",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Listeo-Core \u003c= 1.9.32 - Authenticated (Subscriber+) SQL Injection",
    "slug": "listeo-core",
    "type": "plugin",
    "affected_version": "* - 1.9.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49404",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Favorite Posts \u003c= 1.6.5 - Unauthenticated Cross-Site Scripting",
    "slug": "wp-favorite-posts",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1160",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comment Reply Notification \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "comment-reply-notification",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25051",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup More \u003c= 2.2.4 - Authenticated (Admin+) Directory Traversal to Limited Local File Inclusion",
    "slug": "popup-more",
    "type": "plugin",
    "affected_version": "2.1.6",
    "from_version": "2.1.6",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0844",
    "auth_type": "Privileged",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.2.12 - Missing Authorization",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43162",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Affiliate Platform \u003c 6.5.1 - Reflected Cross-Site Scripting via Lead Editing",
    "slug": "wp-affiliate-platform",
    "type": "plugin",
    "affected_version": "[*, 6.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-5283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5283",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooODT Lite \u003c= 2.4.6 - Missing Authorization to Arbitrary Options Update",
    "slug": "byconsole-woo-order-delivery-time",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47179",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Crowdfunding for WooCommerce \u003c= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter",
    "slug": "crowdfunding-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5767",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.14.0.2 - Cross-Site Request Forgery",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "[*, 1.14.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.0.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15329",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DandyID Services \u003c= 1.5.9 - Cross-Site Request Forgery",
    "slug": "dandyid-services",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9335",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Monitor \u003c= 5.0.12 - Missing Authorization to API Key Manipulation",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 5.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10092",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pie Register Premium \u003c= 3.8.3.2 - Authenticated (Subscriber+) Limited File Deletion",
    "slug": "pie-register-premium",
    "type": "plugin",
    "affected_version": "* - 3.8.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26940",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Migrate Posts \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "migrate-post",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25170",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.0 - Unauthenticated CSV Injection",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0721",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Google Analyticator \u003c= 5.2 - Cross-Site Scripting",
    "slug": "google-analyticator",
    "type": "plugin",
    "affected_version": "[*, 5.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2009-5158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2009-5158",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c 1.2550 - Cross-Site Request Forgery",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "[*, 1.2550)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2550",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-20971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20971",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All 404 Redirect to Homepage \u003c 1.21 - Reflected Cross-Site Scripting via tab Parameter",
    "slug": "all-404-redirect-to-homepage",
    "type": "plugin",
    "affected_version": "[*, 1.21)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24326",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Directory Plugin – Easy Listing Directories for WordPress \u003c= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter",
    "slug": "business-directory-plugin",
    "type": "plugin",
    "affected_version": "* - 6.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4443",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ElementsReady Addons for Elementor  6.4.2 -  Open Redirect",
    "slug": "element-ready-lite",
    "type": "plugin",
    "affected_version": "6.4.2",
    "from_version": "6.4.2",
    "from_inclusive": true,
    "to_version": "6.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47353",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Neon Channel Product Customizer Free \u003c= 2.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion",
    "slug": "neon-channel-product-customizer-free",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54679",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Elements Hider \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-elements-hider",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28971",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cloak \u0026 Encrypt \u003c 3.8.0 - Cross-Site Scripting",
    "slug": "url-cloak-encrypt",
    "type": "plugin",
    "affected_version": "[*, 3.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4563",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CubeWP \u003c= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cubewp-framework",
    "type": "plugin",
    "affected_version": "* - 1.1.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59569",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CardCom Payment Gateway \u003c= 3.5.0.4 - Missing Authorization",
    "slug": "woo-cardcom-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 3.5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57976",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "woocommerce-product-addon",
    "type": "plugin",
    "affected_version": "* - 32.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "32.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "wp-cloudflare-page-cache",
    "type": "plugin",
    "affected_version": "* - 4.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "tweet-old-post",
    "type": "plugin",
    "affected_version": "* - 9.0.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "optimole-wp",
    "type": "plugin",
    "affected_version": "* - 3.12.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "feedzy-rss-feeds",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "wp-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "menu-icons",
    "type": "plugin",
    "affected_version": "* - 0.13.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.13.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "templates-patterns-collection",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ThemeIsle SDK  \u003c= Various Versions - Missing Authorization",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1047",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tastyc \u003c 2.5.2 - Unauthenticated Local File Inclusion",
    "slug": "tastyc",
    "type": "theme",
    "affected_version": "[*, 2.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-27010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27010",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sendinblue for WooCommerce \u003c= 4.0.17 - Authenticated (Editor+) Arbitrary File Download and Deletion",
    "slug": "woocommerce-sendinblue-newsletter-subscription",
    "type": "plugin",
    "affected_version": "* - 4.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32807",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "3DPrint Lite \u003c= 2.1.3.5 - Cross-Site Request Forgery",
    "slug": "3dprint-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30865",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HurryTimer \u003c= 2.13.1 - Missing Authorization",
    "slug": "hurrytimer",
    "type": "plugin",
    "affected_version": "* - 2.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53255",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Icons For WordPress \u003c= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "smartifw",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2513",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Portfolio and Projects \u003c= 1.3.7 - Cross-Site Request Forgery via 'wpos_anylc_admin_init_process'",
    "slug": "portfolio-and-projects",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39995",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP MapIt \u003c= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-mapit",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5658",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Post Submission \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "frontend-post-submission",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23638",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Review Slider \u003c= 12.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-facebook-reviews",
    "type": "plugin",
    "affected_version": "* - 12.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6456",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SCSS-Library \u003c= 0.4.1 - Cross-Site Request Forgery",
    "slug": "scss-library",
    "type": "plugin",
    "affected_version": "* - 0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46436",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Table Builder \u003c= 1.5.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-table-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3282",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reset \u003c= 1.6 - Cross-Site Request Forgery to Database Reset",
    "slug": "reset",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13684",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "RapidLoad – Optimize Web Vitals Automatically \u003c= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification and SQL Injection",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11840",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "BetterLinks \u003c= 2.1.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "betterlinks",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51672",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Poll Maker \u003c= 4.6.2 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 4.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34013",
    "auth_type": "Privileged",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.7.1001 - Missing Authorization",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1001",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56227",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Plestar Directory Listing  \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "plestar-directory-listing",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23723",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Express Checkout (Accept PayPal Payments) \u003c= 2.3.7 - Unauthenticated Price Manipulation",
    "slug": "wp-express-checkout",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30527",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Backup by 10Web \u003c= 1.0.20 - Reflected Cross-Site Scripting",
    "slug": "backup-wd",
    "type": "plugin",
    "affected_version": "* - 1.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24426",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Html Page Sitemap \u003c= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-html-page-sitemap",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26549",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Product Code for WooCommerce \u003c= 1.5.0 - Cross-Site Request Forgery to Database Update",
    "slug": "product-code-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48264",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newsletter \u003c= 7.4.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "newsletter",
    "type": "plugin",
    "affected_version": "[*, 7.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1889",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Content Security Plugin \u003c= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report Fields",
    "slug": "wp-content-security-policy",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4579",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Newsletter Signups \u003c= 1.0.4 - Missing Authorization",
    "slug": "easy-newsletter-signups",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41664",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Clean Login \u003c= 1.10.3 - Cross-Site Request Forgery",
    "slug": "clean-login",
    "type": "plugin",
    "affected_version": "* - 1.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-8875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-8875",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Your Journey \u003c= 1.9.8 - Prototype Pollution to Reflected Cross-Site Scripting",
    "slug": "yourjourney",
    "type": "theme",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3933",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Menu Image, Icons made easy \u003c= 3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "menu-image",
    "type": "plugin",
    "affected_version": "* - 3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50826",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Ready Sites Importer \u003c= 2.2.6 -  Unprotected AJAX Actions",
    "slug": "responsive-add-ons",
    "type": "plugin",
    "affected_version": "[*, 2.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-12073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12073",
    "auth_type": "Auth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L"
  },
  {
    "title": "Display Terms Shortcode \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "display-terms-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51610",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form \u0026 Lead Form Elementor Builder \u003c= 1.6.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "lead-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24967",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP RSS Aggregator \u003c= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source",
    "slug": "wp-rss-aggregator",
    "type": "plugin",
    "affected_version": "* - 4.23.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.23.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0630",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simplelife Plugin \u003c= 1.2 - Cross-Site Scripting",
    "slug": "simplelife",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9395",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram \u003c= 1.9.18 - Cross-Site Request Forgery",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "[*, 1.9.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.19",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10962",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Microsoft Advertising Universal Event Tracking (UET) \u003c= 1.0.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "microsoft-advertising-universal-event-tracking-uet",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2170",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoice Builder \u003c= 1.2.89 - Missing Authorization to Sensitive Information Exposure",
    "slug": "woo-pdf-invoice-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4245",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9657",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "W3SPEEDSTER \u003c= 7.33 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "w3speedster-wp",
    "type": "plugin",
    "affected_version": "* - 7.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23765",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.6 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2008-3233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-3233",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OG Tags \u003c= 2.0.1 - Cross-Site Request Forgery",
    "slug": "og-tags",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20831",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Auto Refresh Single Page \u003c= 1.1 -  Authenticated (Contributor+) PHP Object Injection",
    "slug": "auto-refresh-single-page",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1731",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Pack Elementor addons (Header Footer \u0026 WooCommerce Builder,  Template Library) \u003c= 2.0.8.3 - Reflected Cross-Site Scripting",
    "slug": "the-pack-addon",
    "type": "plugin",
    "affected_version": "* - 2.0.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32785",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event post \u003c= 5.9.4 - Missing Authorization",
    "slug": "event-post",
    "type": "plugin",
    "affected_version": "* - 5.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1376",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSVPMaker  \u003c= 10.6.5 - Unauthenticated Stored Cross-Site Scripting via 'email'",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 10.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-27616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27616",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Page Creator \u003c= 1.1.3 - Cross-Site Request Forgery to Arbitrary Page Creation",
    "slug": "bulk-page-creator",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1611",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Inline Text Popup \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "inline-text-popup",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46538",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Content Protection \u003c= 1.3 - Cross-Site Request Forgery",
    "slug": "wp-content-protection",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58670",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Aggregator Advanced Settings \u003c= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "aggregator-advanced-settings",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9368",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3D Work In Progress \u003c= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "renee-work-in-progress",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49657",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Folder Gallery \u003c= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "folder-gallery",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11823",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CNZZ\u002651LA for WordPress \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cnzz51la-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23823",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Smart Quick View for WooCommerce \u003c= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure",
    "slug": "woo-smart-quick-view",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11741",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "EWWW Image Optimizer \u003c= 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "ewww-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-6243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6243",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Front End Users \u003c= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection",
    "slug": "front-end-only-users",
    "type": "plugin",
    "affected_version": "* - 3.2.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7607",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mail Mint \u003c= 1.17.7 - Unauthenticated Sensitive Information Exposure",
    "slug": "mail-mint",
    "type": "plugin",
    "affected_version": "* - 1.17.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47541",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c= 5.4.17 - Reflected Cross-Site Scripting",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 5.4.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-8814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8814",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "New User Approve \u003c= 2.6.2 - Missing Authorization",
    "slug": "new-user-approve",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54323",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Lawyer Landing Page \u003c= 1.2.4 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "lawyer-landing-page",
    "type": "theme",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37503",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Acobot Live Chat \u0026 Contact Form \u003c= 2.0 - Cross-Site Request Forgery and Cross-Site Scripting",
    "slug": "acobot",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-2039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2039",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.24 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34437",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact form 7 Custom validation \u003c= 1.1.3 - Unauthenticated SQL Injection via 'post'",
    "slug": "cf7-field-validation",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-40609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40609",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.23 - Authenticated (Author+) Server-Side Request Forgery via URL",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "[*, 2.10.24)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.24",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-2287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2287",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Tax Switch for WooCommerce \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via class-name Parameter",
    "slug": "tax-switch-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PixFields \u003c= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pixfields",
    "type": "plugin",
    "affected_version": "* - 0.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46844",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aesop Story Engine \u003c= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "aesop-story-engine",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30557",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JSM Show Post Metadata \u003c= 4.6.0 - Missing Authorization",
    "slug": "jsm-show-post-meta",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24589",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Customizer Export/Import \u003c= 0.9.4 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "customizer-export-import",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3380",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Price Alert \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "price-alert-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52469",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MagicPost \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wb_share_social Shortcode",
    "slug": "magicpost",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12591",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Void Contact Form 7 Widget For Elementor Page Builder \u003c= 2.4.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "cf7-widget-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43291",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Analytics Events \u003c= 2.8.0 - Reflected Cross-Site Scripting",
    "slug": "wp-google-analytics-events",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32145",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Share This Image \u003c= 2.02 - Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons Shortcode",
    "slug": "share-this-image",
    "type": "plugin",
    "affected_version": "* - 2.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8363",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reactive Mortgage Calculator \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "reactive-mortgage-calculator",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27341",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile \u0026 User signup \u003c= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Constant Contact Forms by MailMunch \u003c= 2.1.2 - Reflected Cross-Site Scripting",
    "slug": "constant-contact-forms-by-mailmunch",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9614",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woo Ukrposhta \u003c= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parameters",
    "slug": "woo-ukrposhta",
    "type": "plugin",
    "affected_version": "* - 1.17.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12049",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c 3.2 - Cross-Site Scripting",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "[*, 3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-1000508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000508",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Performance Lab \u003c= 2.2.0 - Cross-Site Request Forgery via dismiss-wp-pointer",
    "slug": "performance-lab",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47174",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Booking Calendar \u003c= 1.7.0 - Reflected Cross-Site Scripting",
    "slug": "advanced-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1007",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HubSpot – CRM, Email Marketing, Live Chat, Forms \u0026 Analytics \u003c= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget",
    "slug": "leadin",
    "type": "plugin",
    "affected_version": "* - 11.1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5879",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content Widget",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1419",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search Atlas SEO \u003c= 1.8.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "metasync",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47387",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Registration Calendar By vcita \u003c= 1.3.1 \u0026 Online Payments – Get Paid with PayPal, Square \u0026 Stripe \u003c= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "event-registration-calendar-by-vcita",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2406",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Registration Calendar By vcita \u003c= 1.3.1 \u0026 Online Payments – Get Paid with PayPal, Square \u0026 Stripe \u003c= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "paypal-payment-button-by-vcita",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2406",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3404",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SP Project \u0026 Document Manager  \u003c= 4.67 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.67",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36530",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Webhooks \u003c= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook",
    "slug": "ninja-forms-webhooks",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13940",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tagbox – UGC Galleries, Social Media Widgets, User Reviews \u0026 Analytics \u003c= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "taggbox-widget",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32552",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Auto Poster \u003c= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "social-auto-poster",
    "type": "plugin",
    "affected_version": "* - 5.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6756",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Embed Privacy \u003c= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embed-privacy",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48300",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Flexmls® IDX \u003c= 3.14.27 - Unauthenticated PHP Object Injection",
    "slug": "flexmls-idx",
    "type": "plugin",
    "affected_version": "* - 3.14.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.27",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26900",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blogger Image Import  2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "blogger-image-import",
    "type": "plugin",
    "affected_version": "2.1",
    "from_version": "2.1",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23689",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteOrigin Widgets Bundle \u003c= 1.60.0 -  - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode",
    "slug": "so-widgets-bundle",
    "type": "plugin",
    "affected_version": "* - 1.60.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.60.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4362",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Calendar Made Simple – Pie Calendar \u003c= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcode",
    "slug": "pie-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1410",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Sticky Footer  \u003c= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-sticky-footer",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50019",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zynith SEO \u003c= 7.4.9 - Missing Authorization to Unauthenticated Arbitrary Option Deletion",
    "slug": "zynith-seo",
    "type": "plugin",
    "affected_version": "* - 7.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43939",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "GiveWP \u003c= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.33.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.33.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4248",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Radio Station \u003c= 2.5.12 - Cross-Site Request Forgery",
    "slug": "radio-station",
    "type": "plugin",
    "affected_version": "* - 2.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53568",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Button Plugin MaxButtons \u003c= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "* - 9.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7029",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Esteem \u003c= 1.5.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "esteem",
    "type": "theme",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37432",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishlist for WooCommerce \u003c= 3.2.3 - Missing Authorization",
    "slug": "wish-list-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49319",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShareThis Dashboard for Google Analytics \u003c= 3.1.4 - Missing Authorization",
    "slug": "googleanalytics",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45851",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Nexter Blocks \u003c= 4.0.7 - Missing Authorization",
    "slug": "the-plus-addons-for-block-editor",
    "type": "plugin",
    "affected_version": "* - 4.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56294",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Polls \u003c= 2.73 - Cross-Site Scripting",
    "slug": "wp-polls",
    "type": "plugin",
    "affected_version": "* - 2.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10936",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Pro \u003c= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.29.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.29.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3076",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Star CloudPRNT for WooCommerce \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "star-cloudprnt-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4603",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support \u003c= 3.5.4 - Reflected Cross-Site Scripting",
    "slug": "lbg-audio8-html5-radio-ads",
    "type": "plugin",
    "affected_version": "* - 3.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48163",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ThirstyAffiliates Affiliate Link Manager \u003c= 3.10.4 - Subscriber+ Arbitrary Affiliate Links Creation",
    "slug": "thirstyaffiliates",
    "type": "plugin",
    "affected_version": "* - 3.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0398",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPGlobus – Multilingual Everything! \u003c= 1.9.6 - Cross-Site Scripting via wpglobus_option[more_languages]",
    "slug": "wpglobus",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5366",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shamsi \u003c= 4.3.3 - Missing Authorization leading to Authenticated (Subscriber+) Attachment Deletion",
    "slug": "wp-shamsi",
    "type": "plugin",
    "affected_version": "* - 4.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0335",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WP Dispensary \u003c= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-dispensary",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12444",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Checkout with Cash App on WooCommerce \u003c= 6.0.2 - Reflected Cross-Site Scripting",
    "slug": "wc-cashapp",
    "type": "plugin",
    "affected_version": "* - 6.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9635",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.3.14.727 - SQL Injection",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "[*, 7.3.15.727)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.15.727",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-14801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14801",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BestWebSoft's Twitter \u003c 2.55 - Cross-Site Scripting",
    "slug": "twitter-plugin",
    "type": "plugin",
    "affected_version": "[*, 2.55)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.55",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 23.1.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 23.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "23.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39631",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Form Builder \u003c= 5.5.6 - Cross-Site Request Forgery",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "* - 5.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-24419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24419",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Really Simple Google Tag Manager \u003c= 1.0.6 - Cross-Site Request Forgery via plugin_activation",
    "slug": "really-simple-google-tag-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23801",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Muslim Prayer Time BD \u003c= 2.4 - Cross-Site Request Forgery to Settings Reset",
    "slug": "muslim-prayer-time-bd",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4758",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flatsome | Multi-Purpose Responsive WooCommerce Theme \u003c= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes",
    "slug": "flatsome",
    "type": "theme",
    "affected_version": "* - 3.18.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5346",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3CX Live Chat \u003c= 8.0.07 - Cross-Site Scripting",
    "slug": "wp-live-chat-support",
    "type": "plugin",
    "affected_version": "* - 8.0.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.07",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-11105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11105",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CLUEVO LMS, E-Learning Platform \u003c= 1.10.0 - Cross-Site Request Forgery",
    "slug": "cluevo-lms",
    "type": "plugin",
    "affected_version": "* - 1.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40607",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MapFig Studio \u003c= 0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mapfig-studio",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6712",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Textmetrics \u003c= 3.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "webtexttool",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46229",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Table by WBW \u003c= 2.1.4 - Reflected Cross-Site Scripting",
    "slug": "woo-product-tables",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31086",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Contact form 7 DB \u003c= 1.8.6 - Authenticated Arbitrary File Deletion",
    "slug": "advanced-cf7-db",
    "type": "plugin",
    "affected_version": "[*, 1.8.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24905",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Crayon Syntax Highlighter \u003c= 2.8.4 - Cross-Site Request Forgery",
    "slug": "crayon-syntax-highlighter",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47167",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wordpress publish post email notification \u003c= 1.0.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "publish-post-email-notification",
    "type": "plugin",
    "affected_version": "* - 1.0.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41731",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WDContactFormBuilder \u003c= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "contact-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5048",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4359",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ApplyOnline – Application Form Builder and Manager \u003c= 2.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "apply-online",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24391",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Download Counter \u003c= 2.0 - Authenticated (Author+) Arbitrary File Read",
    "slug": "simple-download-counter",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1730",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JobZilla - Job Board WordPress Theme \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "jobzilla",
    "type": "theme",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49382",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GigPress \u003c= 2.3.29 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gigpress",
    "type": "plugin",
    "affected_version": "* - 2.3.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7233",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Posts for WordPress \u003c= 2.2.1 - Cross-Site Request Forgery",
    "slug": "related-posts-for-wp",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0592",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Smart Online Order for Clover \u003c= 1.5.4 - Reflected Cross-Site Scripting",
    "slug": "clover-online-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46312",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Picasa-Image \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-picasa-image",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4591",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking for Appointments and Events Calendar – Amelia Premium \u003c= 7.7 and Lite \u003c= 1.2.4 - Missing Authorization to Sensitive Information Exposure",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6332",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Booking for Appointments and Events Calendar – Amelia Premium \u003c= 7.7 and Lite \u003c= 1.2.4 - Missing Authorization to Sensitive Information Exposure",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6332",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "League Table \u003c= 1.13 - Cross-Site Request Forgery",
    "slug": "league-table-lite",
    "type": "plugin",
    "affected_version": "* - 1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48334",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Maintenance Mode \u003c= 2.0.6 - Missing Authorization",
    "slug": "wp-maintenance-mode",
    "type": "plugin",
    "affected_version": "[*, 2.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20155",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Chained Quiz \u003c= 1.1.8.1 - Reflected Cross-Site Scripting",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "[*, 1.1.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-7104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7104",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via addCountS",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4166",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.4.1 - Authenticated (Author+) SQL Injection via addCountS",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4166",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons \u0026 100 Styles \u003c= 1.9.2 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "maxi-blocks",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6885",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Error Log Viewer By WP Guru \u003c= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read",
    "slug": "error-log-viewer-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12849",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Responsive Contact Form Builder \u0026 Lead Generation Plugin \u003c= 1.8.9 - Missing Authorization",
    "slug": "lead-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1416",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSVPMaker \u003c= 9.9.3 - Authenticated (Admin+) SQL Injection via 'delete' parameter",
    "slug": "rsvpmaker",
    "type": "plugin",
    "affected_version": "* - 9.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25047",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Chart Builder for WordPress \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-chart-builder",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25077",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kognetiks Chatbot for WordPress \u003c= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Update",
    "slug": "chatbot-chatgpt",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10531",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TheCartPress eCommerce Shopping Cart \u003c= 1.1.5 - Cross-Site Scripting",
    "slug": "thecartpress",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-5207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5207",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenverse \u003c= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutenverse",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43920",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPPizza \u003c= 3.19.4 - Reflected Cross-Site Scripting",
    "slug": "wppizza",
    "type": "plugin",
    "affected_version": "* - 3.19.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26991",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Card \u003c= 1.0.0 - Cross-Site Request Forgery to Arbitrary Card Deletion",
    "slug": "business-card-by-esterox-100",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4532",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Carousel \u003c= 2.0 - Unauthenticated SQL Injection",
    "slug": "multicarousel",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22553",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Photo Gallery by Ays – Responsive Image Gallery \u003c 1.0.1 - SQL Injection",
    "slug": "gallery-photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10921",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Rss Poster \u003c= 1.0.0 - SQL Injection",
    "slug": "wp-rss-poster",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-4938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4938",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37922",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Deliver via Shipos for WooCommerce \u003c= 2.1.7 - Reflected Cross-Site Scripting",
    "slug": "wc-shipos-delivery",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32533",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sandwich Adsense \u003c= 4.0.2 - Missing Authorization",
    "slug": "firsth3tagadsense",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31042",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Icegram Express  \u003c= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4845",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Music Player \u003c= 1.3 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-music-player",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22536",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ChatBot \u003c= 4.7.8 - Cross-Site Request Forgery via qc_wp_latest_update_check",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44993",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FormCraft \u003c= 1.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "formcraft-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3501",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crossword Compiler Puzzles \u003c= 5.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "crossword-compiler-puzzles",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-46490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46490",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Echoza \u003c= 0.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "echoza",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54243",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyPixs \u003c= 0.3 - Local File Inclusion",
    "slug": "mypixs",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-1000012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000012",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Paid Memberships Pro \u003c 1.7.15 - Directory Traversal",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "[*, 1.7.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.15",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-8801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8801",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Contact Form Builder by vcita \u003c= 4.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "contact-form-with-a-meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32199",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Like Box and Page by WpDevArt \u003c= 0.8.39 - Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "like-box",
    "type": "plugin",
    "affected_version": "* - 0.8.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23972",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Trinity Audio \u003c= 5.20.2 - Cross-Site Request Forgery",
    "slug": "trinity-audio",
    "type": "plugin",
    "affected_version": "* - 5.20.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.20.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9886",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multi Step for Contact Form \u003c= 2.7.7 - Unauthenticated SQL Injection",
    "slug": "cf7-multi-step",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-47331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47331",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MailArchiver \u003c= 2.10.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject",
    "slug": "mailarchiver",
    "type": "plugin",
    "affected_version": "* - 2.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3136",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email posts to subscribers \u003c= 6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "email-posts-to-subscribers",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41736",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker \u003c= 3.2.0 - Missing Authorization",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22697",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BP Better Messages \u003c= 2.4.32 - Missing Authorization",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "* - 2.4.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32802",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Mass Custom Fields Manager \u003c= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mass-custom-fields-manager",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23430",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ad Inserter – Ad Manager \u0026 AdSense Ads \u003c 1.5.3 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "ad-inserter",
    "type": "plugin",
    "affected_version": "[*, 1.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9497",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Schema - All In One Schema Rich Snippets \u003c= 1.6.5 - Cross-Site Request Forgery in rich_snippet_dashboard",
    "slug": "all-in-one-schemaorg-rich-snippets",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25058",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25058",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Text Hover \u003c= 4.1 - Admin+ Stored Cross-Site Scripting",
    "slug": "text-hover",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0737",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixabay Images \u003c= 3.4 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "pixabay-images",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4413",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tag",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2786",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mini Cart Drawer For WooCommerce \u003c= 4.0.0 - Missing Authorization via AJAX",
    "slug": "woo-mini-cart-drawer",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47694",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ScrollTo Bottom \u003c= 1.1.1 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "scrollto-bottom",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6321",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form Shortcode",
    "slug": "LayerSlider",
    "type": "plugin",
    "affected_version": "7.11.0",
    "from_version": "7.11.0",
    "from_inclusive": true,
    "to_version": "7.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4575",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Patreon WordPress \u003c= 1.7.0 - Reflected Cross-Site Scripting",
    "slug": "patreon-connect",
    "type": "plugin",
    "affected_version": "[*, 1.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24229",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Crafty Social Buttons \u003c 1.5.8 - Cross-Site Scripting",
    "slug": "crafty-social-buttons",
    "type": "plugin",
    "affected_version": "[*, 1.5.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18578",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Favicon Rotator \u003c= 1.2.10 - Reflected Cross-Site Scripting",
    "slug": "favicon-rotator",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-28001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-28001",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Delete Users by Email \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "bulk-delete-users-by-email",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4266",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fintelligence Calculator \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fintelligence-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53731",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Warranty Requests \u003c= 2.2.7 - Missing Authorization",
    "slug": "woocommerce-warranty",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51495",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Official SalesWizard CRM Plugin \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "official-saleswizard-crm",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Testimonial \u003c 1.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "testimonial-builder",
    "type": "plugin",
    "affected_version": "[*, 1.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24598",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "I Recommend This \u003c= 3.7.2 - Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "i-recommend-this",
    "type": "plugin",
    "affected_version": "* - 3.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-125099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-125099",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Table of Contents Plus \u003c= 2106 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "table-of-contents-plus",
    "type": "plugin",
    "affected_version": "* - 2106",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2106",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4479",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2414",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Product Time Countdown for WooCommerce \u003c= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "product-countdown-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47505",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Disable Auto Updates \u003c= 1.4 - Cross-Site Request Forgery to Auto-update Disable",
    "slug": "disable-auto-updates",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13336",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HTML5 Lyrics Karaoke Player \u003c= 2.4 - Reflected Cross-Site Scripting",
    "slug": "html5-lyrics-karaoke-player",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52473",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Automatic Translation \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload",
    "slug": "automatic-translation",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50493",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Luzuk Testimonials \u003c= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "luzuk-testimonials",
    "type": "plugin",
    "affected_version": "* - 0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51872",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Database Backups \u003c= 1.2.2.6 - Cross-Site Request Forgery",
    "slug": "database-backups",
    "type": "plugin",
    "affected_version": "* - 1.2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24174",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.36",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.36",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.24",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.20",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.14",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.16",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.11",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.9",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.5",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.37",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.36",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.36",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.13",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.10",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.7",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.4",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.39",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.39",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.39",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.39",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.33",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.33",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.28",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.21",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.29",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.29",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.27",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.24",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.17",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 6.0.3 - Reflected Cross-Site Scripting via SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.2",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-43497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Option Tree \u003c= 2.5.5 - Cross-Site Scripting",
    "slug": "option-tree",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10895",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Tag Cloud Plugin – Tag Groups \u003c= 2.0.3 - Missing Authorization to Information Exposure",
    "slug": "tag-groups",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43237",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "User Registration \u003c= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3343",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lightweight Sidebar Manager \u003c= 1.1.4 - Cross-Site Request Forgery Bypass",
    "slug": "sidebar-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36747",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bravis User \u003c= 1.0.0 - Authentication Bypass to Account Takeover",
    "slug": "bravis-user",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5060",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Login With OTP Over SMS, Email, WhatsApp and Google Authenticator \u003c= 1.0.4 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "miniorange-google-authenticator",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0875",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Advanced All in One Admin Search by WP Spotlight \u003c= 1.1.1 - Cross-Site Request Forgery",
    "slug": "wp-spotlight-search",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32261",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LoginWP \u003c 3.0.0.5 - Reflected Cross-Site Scripting via rul_login_url, rul_logout_url Parameter",
    "slug": "peters-login-redirect",
    "type": "plugin",
    "affected_version": "[*, 3.0.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24939",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xhanch – My Twitter \u003c= 2.7.6 - Cross-Site Request Forgery",
    "slug": "xhanch-my-twitter",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-3253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3253",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.5.1.8 - Reflected Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-1002001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1002001",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Conditions \u003c= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dynamicconditions",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22642",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Contact form 7 DB \u003c= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosure",
    "slug": "advanced-cf7-db",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4319",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "The7 \u003c= 11.7.3 - Cross-Site Request Forgery",
    "slug": "dt-the7",
    "type": "theme",
    "affected_version": "* - 11.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32123",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GoodBarber \u003c= 1.0.23 - Cross-Site Request Forgery via admin_options",
    "slug": "goodbarber",
    "type": "plugin",
    "affected_version": "* - 1.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45107",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Membership Subscriptions \u003c= 2.15.5 - Unauthenticated Local File Inclusion",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54017",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Category Discount Woocommerce \u003c= 4.12 - Missing Authorization via wpcd_save_discount()",
    "slug": "woo-product-category-discount",
    "type": "plugin",
    "affected_version": "* - 4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0617",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks with AI by Kadence WP – Page Builder Features \u003c= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9655",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Conferencing with Zoom \u003c= 4.4.5 - Sensitive Information Exposure",
    "slug": "video-conferencing-with-zoom-api",
    "type": "plugin",
    "affected_version": "* - 4.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GD bbPress Attachments \u003c= 4.7.2 - Reflected Cross-Site Scripting",
    "slug": "gd-bbpress-attachments",
    "type": "plugin",
    "affected_version": "* - 4.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11278",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eCommerce Shop Styling \u003c 2.6 - Directory Traversal",
    "slug": "wp-ecommerce-shop-styling",
    "type": "plugin",
    "affected_version": "[*, 2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-5468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5468",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Category Posts Widget \u003c= 4.9.17 - Authenticated (Admin+) Stored Cross-Site SCripting",
    "slug": "category-posts",
    "type": "plugin",
    "affected_version": "* - 4.9.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9638",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exifography \u003c= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "thesography",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38521",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ivory Search – WordPress Search Plugin \u003c= 5.5.6 - Information Exposure via AJAX Search Form",
    "slug": "add-search-to-menu",
    "type": "plugin",
    "affected_version": "* - 5.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6835",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Icegram Engage \u003c= 3.1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 3.1.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13482",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Surfer \u003c= 1.6.4.574 - Missing Authorization",
    "slug": "surferseo",
    "type": "plugin",
    "affected_version": "* - 1.6.4.574",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4.574",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58603",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Uncanny Groups for LearnDash \u003c= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation",
    "slug": "uncanny-learndash-groups",
    "type": "plugin",
    "affected_version": "* - 6.1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8349",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WebinarIgnition \u003c= 2.14.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "webinar-ignition",
    "type": "plugin",
    "affected_version": "* - 2.14.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25023",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.30",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.30",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.27",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.2",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.3",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.28",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.24",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.19",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.27",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.20",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.18",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.6",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.11",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.30",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.30",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.15",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.14",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Cache Poisoning",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.10",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17673",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Bootstrap Blocks for WP Editor v2 \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-editor-bootstrap-blocks",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12495",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Switch \u003c= 1.1.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wp-user-switch",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37560",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slideshow, Image Slider by 2J \u003c= 1.3.54 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "2j-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.3.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.54",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44242",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi-language Responsive Contact Form \u003c= 2.8 - Missing Authorization",
    "slug": "responsive-contact-form",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29000",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "header-enhancement",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "generate-child-theme",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-instagram-feed-gallery-widget",
    "type": "plugin",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-import-export",
    "type": "plugin",
    "affected_version": "[*, 1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-under-construction",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-duplicate-switcher",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-ids",
    "type": "plugin",
    "affected_version": "[*, 2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-sticky-menu",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "essential-widgets",
    "type": "plugin",
    "affected_version": "[*, 1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-infinite-scroll",
    "type": "plugin",
    "affected_version": "[*, 1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "to-top",
    "type": "plugin",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-themes-demo-import",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-breadcrumb",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "essential-content-types",
    "type": "plugin",
    "affected_version": "[*, 1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-web-tools",
    "type": "plugin",
    "affected_version": "[*, 2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "CatchThemes Plugins (Various Versions) - Missing Authorization",
    "slug": "catch-scroll-progress-bar",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24752",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Spider Elements – Addons for Elementor \u003c= 1.6.3 - Missing Authorization",
    "slug": "spider-elements",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32216",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Count per Day \u003c= 3.1 - Arbitrary File Download",
    "slug": "count-per-day",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-0896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-0896",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Inquiries \u003c= 0.2.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-inquiries",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32685",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Slider by Soliloquy \u003c= 2.7.2 - Missing Authorization",
    "slug": "soliloquy-lite",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51519",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Booster Plus for WooCommerce \u003c= 7.2.4 - Reflected Cross-Site Scripting",
    "slug": "booster-plus-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 7.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39446",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Invoices and Packing Slips For WooCommerce \u003c= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "pdf-invoices-and-packing-slips-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1773",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Admin debug wordpress – enable debug \u003c= 1.0.13 - Cross-Site Request Forgery",
    "slug": "dzs-enable-debug",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22503",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JS MultiHotel \u003c= 2.2.1 - Reflected Cross-Site Scripting",
    "slug": "js-multihotel",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-7419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7419",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon by Supsystic \u003c= 1.7.10 - Cross Site Request Forgery",
    "slug": "coming-soon-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-22714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22714",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple File List \u003c= 3.2.7 - Arbitrary File Download",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1119",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "YouSayToo auto-publishing plugin \u003c= 1.0 - Cross-Site Scripting",
    "slug": "yousaytoo-auto-publishing-plugin",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-0901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-0901",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar \u003c= - Authenticated (Admin+) Stored Cross-Site Scripting via Notification Settings",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.6.7.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7877",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Creative Mail \u003c= 1.5.4 - Cross-Site Request Forgery to Plugin Deactivation",
    "slug": "creative-mail-by-constant-contact",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40686",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Seed Social \u003c= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "seed-social",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3836",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mesa Mesa Reservation Widget \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mesa-mesa-reservation-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48319",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FeedWordPress \u003c 2015.0514 - SQL Injection",
    "slug": "feedwordpress",
    "type": "plugin",
    "affected_version": "[*, 2015.0514)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2015.0514",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-4018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4018",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "B Testimonial – testimonial plugin for WP \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "b-testimonial",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11880",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nirweb support \u003c= 2.7.9 - SQL Injection",
    "slug": "nirweb-support",
    "type": "plugin",
    "affected_version": "* - 2.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0781",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Content Repeater – Custom Posts Simplified \u003c= 1.1.13 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "content-repeater",
    "type": "plugin",
    "affected_version": "* - 1.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44632",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.3.5 - Multiple Unprotected AJAX Actions",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38134",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4624",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetElements \u003c= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7144",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Filter Custom Fields \u0026 Taxonomies Light \u003c= 1.05 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "filter-custom-fields-taxonomies-light",
    "type": "plugin",
    "affected_version": "* - 1.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.05",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-31094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31094",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Random Banner \u003c= 4.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "random-banner",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0210",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JSON Content Importer \u003c= 1.5.6 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "json-content-importer",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38723",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CorreosExpress \u003c= 2.6.0 - Sensitive Data Exposure",
    "slug": "correos-express",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25009",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Social Sharing Plugin – Kiwi \u003c= 2.1.7 - Information Disclosure",
    "slug": "kiwi-social-share",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3228",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BuddyForms \u003c= 2.8.9 - Email Verification Bypass due to Insufficient Randomness",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5149",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Duplicate Post Page Menu \u0026 Custom Post Type \u003c= 2.3.1 - Missing Authorization to Post Duplication",
    "slug": "duplicate-post-page-menu-custom-post-type",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4792",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appointment Hour Booking – WordPress Booking Plugin \u003c= 1.1.45 - Cross-Site Scripting",
    "slug": "appointment-hour-booking",
    "type": "plugin",
    "affected_version": "[*, 1.1.46)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.46",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-13505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via URLs",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 2.21.2 - Cross-Site Request Forgery",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.21.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.21.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2260",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Quick Interest Slider  \u003c= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quick-interest-slider",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26738",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nice Backgrounds \u003c= 1.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "nicebackgrounds",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49330",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gp-notification-bar",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31610",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.17.2 - Reflected Cross-Site Scripting via Import Tool",
    "slug": "give",
    "type": "plugin",
    "affected_version": "[*, 2.17.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0252",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Frontend Admin \u003c= 1.22.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "display-admin-page-on-frontend",
    "type": "plugin",
    "affected_version": "* - 1.22.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57898",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Universal Video Player \u003c= 1.4.0 - Reflected Cross-Site Scripting",
    "slug": "elementor_widget_universal_video_player",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31057",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mediamatic – Media Library Folders \u003c= 2.8.1 - Cross-Site Request Forgery",
    "slug": "mediamatic",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0294",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Schema \u0026 Structured Data for WP \u0026 AMP \u003c= 1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "schema-and-structured-data-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51677",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookie Notice Bar \u003c= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cookie-notice-bar",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13849",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Author Base \u003c= 1.1.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "custom-author-base",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8050",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Virtual Bot \u003c= 1.0.0 - Unauthenticated SQL Injection",
    "slug": "virtual-bot",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22542",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Login with phone number \u003c= 1.7.16 - Unauthorized Account Password Change to Privilege Escalation",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "* - 1.7.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32507",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Missing Authorization to Product Manipulation",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4938",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Amazon Affiliates - Wordpress Plugin \u003c= 14.0.10 - Authenticated (Subscriber+) SQL Injection",
    "slug": "woozone",
    "type": "plugin",
    "affected_version": "* - 14.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.0.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33546",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Classic Widgets with Block-based Widgets \u003c= 1.0.1 - Missing Authorization",
    "slug": "classic-widgets-with-block-based-widgets",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58029",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Button Generator – easily Button Builder \u003c= 2.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "button-generation",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27452",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Giveaways \u003c= 2.36.1 - Reflected Cross-Site Scripting",
    "slug": "giveasap",
    "type": "plugin",
    "affected_version": "[*, 2.36.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.36.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24298",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49829",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Membership Subscriptions – Effortless Memberships, Recurring Payments \u0026 Content Restriction \u003c= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10261",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Web Directory Free \u003c= 1.7.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "web-directory-free",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30908",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "QueryWall \u003c= 1.1.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "querywall",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2492",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Carousel Slider \u003c= 2.2.13 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "carousel-slider",
    "type": "plugin",
    "affected_version": "* - 2.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6850",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ArtiBot Free Chat Bot for WordPress WebSites \u003c= 1.1.6 - Missing Authorization to Settings Update",
    "slug": "artibot",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0447",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Office Locator \u003c= 1.3.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "office-locator",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52501",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Ride Booking \u003c= 2.4 - Cross-Site Request Forgery",
    "slug": "wp-ride-booking",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30531",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive Lightbox2 \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-lightbox2",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3987",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conversios.io \u003c= 7.2.3 - Missing Authorization",
    "slug": "enhanced-e-commerce-for-woocommerce-store",
    "type": "plugin",
    "affected_version": "* - 7.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30909",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Easy Duplicate Product \u003c= 0.3.0.7 - Missing Authorization via wedp_duplicate_product_action",
    "slug": "woo-easy-duplicate-product",
    "type": "plugin",
    "affected_version": "* - 0.3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51523",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor \u003c= 3.9.12 - Insufficient Authorization Checks to Block Usual",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1803",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Title Experiments Free \u003c= 9.0.4 - Missing Authorization",
    "slug": "wp-experiments-free",
    "type": "plugin",
    "affected_version": "* - 9.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22561",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Widget For Elementor Page Builder \u0026 Gutenberg Blocks \u003c= 1.1.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "ht-contactform",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0484",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spam protection, AntiSpam, FireWall by CleanTalk \u003c= 6.20 - Cross-Site Request Forgery via apbct_settings__update_account_email",
    "slug": "cleantalk-spam-protect",
    "type": "plugin",
    "affected_version": "* - 6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51696",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Frontend File Manager \u003c= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "[*, 18.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4368",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Portable phpMyAdmin \u003c= 1.4.1 - Information Disclosure",
    "slug": "portable-phpmyadmin",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-4454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4454",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WpTravelly \u003c= 1.7.7 - Missing Authorization",
    "slug": "tour-booking-manager",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43212",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AIO Performance Profiler, Monitor, Optimize, Compress \u0026 Debug \u003c= 1.2 - Unauthenticated Sensitive Information Exposure",
    "slug": "all-in-one-performance-accelerator",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31788",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP PDF Generator \u003c= 1.2.2 - Cross-Site Request Forgery to PDF Settings Update",
    "slug": "wp-pdf-generator",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35038",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Location Google Map \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "multiple-location-google-map",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32617",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments - wpDiscuz \u003c= 7.3.11 Sensitive Information Disclosure",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.11",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-23984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23984",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "User Activity Log Pro \u003c= 2.3.3 - Tracking Bypass via IP Spoofing",
    "slug": "user-activity-log-pro",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5133",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FormCraft \u003c= 1.3.7 - SQL Injection",
    "slug": "formcraft",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-7187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7187",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EazyDocs 2.3.8 - 2.3.9 -  Missing Authorization",
    "slug": "eazydocs",
    "type": "plugin",
    "affected_version": "2.3.8 - 2.3.9",
    "from_version": "2.3.8",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0248",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Buttons Creator \u003c=1.04 - Cross-Site Request Forgery to Arbitrary Button Deletion",
    "slug": "simple-buttons-creator",
    "type": "plugin",
    "affected_version": "* - 1.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2858",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "twenty20",
    "type": "plugin",
    "affected_version": "1.5.4",
    "from_version": "1.5.4",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "twenty20",
    "type": "plugin",
    "affected_version": "1.6.2",
    "from_version": "1.6.2",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "twenty20",
    "type": "plugin",
    "affected_version": "1.6.3",
    "from_version": "1.6.3",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "seo-optimized-images",
    "type": "plugin",
    "affected_version": "2.1.2",
    "from_version": "2.1.2",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "11.9.3 - 11.9.4",
    "from_version": "11.9.3",
    "from_inclusive": true,
    "to_version": "11.9.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "wpcom-member",
    "type": "plugin",
    "affected_version": "1.3.15",
    "from_version": "1.3.15",
    "from_inclusive": true,
    "to_version": "1.3.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "wpcom-member",
    "type": "plugin",
    "affected_version": "1.3.16",
    "from_version": "1.3.16",
    "from_inclusive": true,
    "to_version": "1.3.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "social-warfare",
    "type": "plugin",
    "affected_version": "4.4.6.4 - 4.4.7.1",
    "from_version": "4.4.6.4",
    "from_inclusive": true,
    "to_version": "4.4.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "contact-form-7-multi-step-addon",
    "type": "plugin",
    "affected_version": "1.0.4 - 1.0.5",
    "from_version": "1.0.4",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "simply-show-hooks",
    "type": "plugin",
    "affected_version": "1.2.1 - 1.2.2",
    "from_version": "1.2.1",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "britetechs-companion",
    "type": "plugin",
    "affected_version": "2.2.7",
    "from_version": "2.2.7",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "wrapper-link-elementor",
    "type": "plugin",
    "affected_version": "1.0.2 - 1.0.3",
    "from_version": "1.0.2",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "ad-invalid-click-protector",
    "type": "plugin",
    "affected_version": "1.2.9",
    "from_version": "1.2.9",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "blaze-widget",
    "type": "plugin",
    "affected_version": "2.2.5 - 2.5.2",
    "from_version": "2.2.5",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "3.2.3",
    "from_version": "3.2.3",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Several WordPress.org Plugins \u003c= Various Versions  - Injected Backdoor",
    "slug": "wp-server-stats",
    "type": "plugin",
    "affected_version": "1.7.6",
    "from_version": "1.7.6",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6297",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "One Click Accessibility \u003c= 3.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pojo-accessibility",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32640",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.0 - Missing Authorization",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1843",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Pedalo Connector \u003c= 2.0.5 - Authentication Bypass to Administrator",
    "slug": "pedalo-connector",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9822",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Login Page Styler \u003c= 7.1.1 - Missing Authorization to Authenticated (Subsciber+) Log Deletion and Session Termination",
    "slug": "login-page-styler",
    "type": "plugin",
    "affected_version": "* - 7.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13530",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Email Verification for WooCommerce \u003c= 3.5.0 - Reflected Cross-Site Scripting",
    "slug": "woo-confirmation-email",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39162",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hide Admin Bar \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "wp-hide-admin-bar",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28910",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Import Export for WooCommerce \u003c= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function",
    "slug": "product-import-export-for-woo",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1912",
    "auth_type": "Privileged",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "PVN Auth Popup \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "pvn-auth-popup",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks with AI by Kadence WP – Page Builder Features \u003c= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10785",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50859",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Giveaways and Contests by PromoSimple \u003c= 1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "giveaways-contests-by-promosimple",
    "type": "plugin",
    "affected_version": "* - 1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23934",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aqua SVG Sprite \u003c= 3.0.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "aqua-svg-sprite",
    "type": "plugin",
    "affected_version": "* - 3.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9426",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobi2Go \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mobi2go",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58646",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Activity Log \u003c= 1.6.4 - Unauthenticated SQL Injection",
    "slug": "user-activity-log",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3435",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.32",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.31",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.6",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.1",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.34",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.34",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.24",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.19",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.15",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.23",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.22",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.18",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.14",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.10",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.7",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.2",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.31",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.28",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.4",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-28039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28039",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ARPrice \u003c= 4.0.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "arprice",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49666",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "코드엠샵 소셜톡 \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mshop-naver-talktalk",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58828",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YourChannel \u003c= 1.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'yrc_lang[Videos]'",
    "slug": "yourchannel",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0282",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.6.5 - Unauthenticated Time-Based SQL Injection",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4434",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Like Box and Page by WpDevArt \u003c= 0.8.40 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "like-box",
    "type": "plugin",
    "affected_version": "* - 0.8.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0177",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Starfish Review Generation \u0026 Marketing \u003c= 3.1.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "starfish-reviews",
    "type": "plugin",
    "affected_version": "* - 3.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39533",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Grid, Image Gallery \u0026 Portfolio for Elementor | PowerFolio \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "portfolio-elementor",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22150",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Giveaways \u003c= 2.48.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "giveasap",
    "type": "plugin",
    "affected_version": "* - 2.48.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.48.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30819",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Login/Signup Popup ( Inline Form + Woocommerce ) \u003c= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode",
    "slug": "easy-login-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1064",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Revision Diet \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "revision-diet",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39419",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WZone \u003c= 14.0.10 - Missing Authorization",
    "slug": "woozone",
    "type": "plugin",
    "affected_version": "* - 14.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33547",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YOP Poll \u003c= 6.5.26 - Race Condition to Vote Manipulation",
    "slug": "yop-poll",
    "type": "plugin",
    "affected_version": "* - 6.5.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6109",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Table Builder \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "smart-table-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9126",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields Pro \u003c= 6.3.1 - Cross-Site Request Forgery",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "* - 6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37251",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Buttons Creator \u003c=1.04 - Unauthenticated Stored Cross-Site Scripting via Add Button",
    "slug": "simple-buttons-creator",
    "type": "plugin",
    "affected_version": "* - 1.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.04",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2857",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DX Dark Site \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "devrix-dark-site",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54337",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyAnime Widget \u003c= 1.0 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "myanime-widget",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-23532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23532",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Nexos - Real Estate WordPress Theme \u003c 1.8 - Cross-Site Scripting",
    "slug": "nexos",
    "type": "theme",
    "affected_version": "[*, 1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-15364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-15364",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ever Accounting \u003c= 2.1.5 - Cross-Site Request Forgery",
    "slug": "wp-ever-accounting",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39593",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Invoice – Web Invoice and Billing \u003c= 4.1.0 - Missing Authorization",
    "slug": "wp-invoice",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-11010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11010",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Piotnet Addons For Elementor \u003c= 2.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "piotnet-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32197",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WBW Product Table PRO \u003c= 2.1.3 - Unauthenticated SQL Injection",
    "slug": "woo-producttables-pro",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31059",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Eventer \u003c= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export",
    "slug": "eventer",
    "type": "plugin",
    "affected_version": "* - 3.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11134",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce \u003c= 2.2.10 - Cross-Site Scripting",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.2.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-2069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2069",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid \u003c= 2.2.74 - Reflected Cross-Site Scripting",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.74",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.74",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30441",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Club Manager – WordPress Sports Club Plugin \u003c= 2.2.10 - Missing Authorization to Unauthenticated Event Permalink Update",
    "slug": "wp-club-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1177",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Booking Calendar \u003c= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 10.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13821",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sunny Search \u003c= 1.0.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "fast-search-powered-by-solr",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32592",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Weather Layer \u003c= 4.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "weather-layer",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30532",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom 404 Pro \u003c= 3.2.8 - Reflected Cross-Site Scripting",
    "slug": "custom-404-pro",
    "type": "plugin",
    "affected_version": "[*, 3.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-14789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14789",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meta Accelerator \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "meta-accelerator",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25164",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dashboard Notepads \u003c= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "dashboard-notepads",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39441",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uix Shortcodes \u003c= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "uix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39574",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LoginPress \u003c= 1.1.15 - Authenticated SQL Injection via Settings Import",
    "slug": "loginpress",
    "type": "plugin",
    "affected_version": "[*, 1.1.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15872",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Plugin Manager (wppm) \u003c= 1.6.4.b - Cross-Site Scripting",
    "slug": "wppm",
    "type": "plugin",
    "affected_version": "* - 1.6.4.b",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4.b",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4593",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customizr \u003c= 4.4.21 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "customizr",
    "type": "theme",
    "affected_version": "* - 4.4.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35771",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Adicon Server \u003c= 1.2 - Authenticated (Admin+) SQL Injection",
    "slug": "adicons",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7766",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Nested Menu \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-nested-menu",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49442",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CF7 Google Sheets Connector \u003c= 5.0.17 - Missing Authorization",
    "slug": "cf7-google-sheets-connector",
    "type": "plugin",
    "affected_version": "* - 5.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22686",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.26.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4656",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "* - 1.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10489",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Redirection \u003c= 2.2.8 - Reflected Cross-Site Scripting",
    "slug": "redirection",
    "type": "plugin",
    "affected_version": "[*, 2.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-5329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5329",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Oganro Travel Portal Search Widget for HotelBeds APITUDE API \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "oganro-travel-portal-search-widget-for-hotelbeds-apitude-api",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49966",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPQuiz \u003c= 0.4.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "wpquiz",
    "type": "plugin",
    "affected_version": "* - 0.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6739",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Forminator \u003c= 1.29.2 - Authenticated (Admin+) SQL Injection",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.29.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.29.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31077",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Locatoraid Store Locator \u003c= 3.9.11 - Cross Site Request Forgery in grab",
    "slug": "locatoraid",
    "type": "plugin",
    "affected_version": "* - 3.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25709",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-CFM  \u003c= 1.7.8 - Cross-Site Request Forgery via multiple AJAX functions",
    "slug": "wp-cfm",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24706",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.59 - Insufficient Access Control to Menu Settings Update",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4711",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cision Block \u003c= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "cision-block",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3782",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Cookie Banner \u003c= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "real-cookie-banner",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4507",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NotificationX \u003c= 1.8.2 - Cross-Site Request Forgery Bypass",
    "slug": "notificationx",
    "type": "plugin",
    "affected_version": "[*, 1.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36744",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hoo Addons for Elementor \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hoo-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51590",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Setka Editor \u003c= 2.1.20 - Cross-Site Request Forgery via handleRequest",
    "slug": "setka-editor",
    "type": "plugin",
    "affected_version": "* - 2.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24701",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Short URL \u003c= 1.6.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "shorten-url",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-46860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46860",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "tarteaucitron.js for WordPress \u003c= 0.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "tarteaucitron-wp",
    "type": "plugin",
    "affected_version": "* - 0.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11719",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. \u003c= 3.0.5 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "responsive-add-ons",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeoplePond \u003c= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "peoplepond",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8085",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Ajax Load More and Infinite Scroll \u003c= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "cpt-ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5586",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Article Analytics \u003c= 1.0 - Unauthenticated SQL Injection",
    "slug": "article-analytics",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5640",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MailPoet Newsletters \u003c= 2.6.6 - Arbitrary File Upload",
    "slug": "wysija-newsletters",
    "type": "plugin",
    "affected_version": "* - 2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-4725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4725",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RSS Feed Widget \u003c= 2.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "rss-feed-widget",
    "type": "plugin",
    "affected_version": "* - 2.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32690",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPide \u003c= 2.6 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "wpide",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40217",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Gallery with Slideshow Plugin \u003c= 1.5.2 - SQL Injection via gid",
    "slug": "image-gallery-with-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002012",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UpdraftPlus \u003c= 1.13.4 - Stored Cross-Site Scripting",
    "slug": "updraftplus",
    "type": "plugin",
    "affected_version": "* - 1.13.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18593",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Bulk Editor \u003c= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "seo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22587",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg \u0026 Elementor \u003c= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export",
    "slug": "post-block",
    "type": "plugin",
    "affected_version": "* - 6.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10536",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Soledad \u003c= 8.4.1 - Reflected Cross-Site Scripting",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49827",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Manager \u0026#8211; Customize and Control Cart page, Add to Cart button, Checkout fields easily \u003c= 1.2.4.5 - Missing Authorization",
    "slug": "innovs-woo-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50008",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page Builder KingComposer \u003c= 2.9.6 - Authenticated Arbitrary Profile Creation and Stored Cross-Site Scripting",
    "slug": "kingcomposer",
    "type": "plugin",
    "affected_version": "* - 2.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25048",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N"
  },
  {
    "title": "DesignThemes Core Features \u003c= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_file",
    "slug": "designthemes-core-features",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13471",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "NextGEN Gallery \u003c= 3.37 - Cross-Site Request Forgery",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48328",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core - All Known Versions - Cleartext Storage of wp_signups.activation_key",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14990",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AI Infographic Maker \u003c= 4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "infographic-and-list-builder-ilist",
    "type": "plugin",
    "affected_version": "* - 4.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32696",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Slider Pro Lite \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slider-pro-lite",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11899",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ditty – Responsive News Tickers, Sliders, and Lists \u003c= 3.1.44 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6710",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider \u003c= 2.3.0 - Missing Authorization",
    "slug": "ultimate-store-kit",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24584",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.66 -  Zip Extraction to Arbitrary File Upload in File Manager",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.66",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.66",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-33930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33930",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP Social Bookmarking Light \u003c= 2.0.7 - Cross-Site Request Forgery",
    "slug": "wp-social-bookmarking-light",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25029",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Redirect \u0026 Thank You Page \u003c= 1.0.3 - Cross-Site Request Forgery via cf7rl_admin_table",
    "slug": "cf7-redirect-thank-you-page",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24395",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hamburger Icon Menu Lite \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "hamburger-icon-menu-lite",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32548",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPPizza \u003c= 3.18.2 - Reflected Cross-Site Scripting",
    "slug": "wppizza",
    "type": "plugin",
    "affected_version": "* - 3.18.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46622",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Protección de Datos RGPD \u003c= 3.1.0 - Reflected Cross-Site Scripting",
    "slug": "click-datos-lopd",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46071",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My WP Translate \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "my-wp-translate",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18568",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulgarisation for WooCommerce \u003c= 3.0.14 - Cross-Site Request Forgery",
    "slug": "bulgarisation-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2395",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WPLMS  \u003c= 4.970 - Missing Authorization",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "* - 4.970",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.970",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58668",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Better WP Security \u003c= 3.2.4 - Multiple Cross-Site Scripting",
    "slug": "better-wp-security",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-4264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4264",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Invoices \u0026 Packing Slips Generator for WooCommerce \u003c= 2.2.1 - Reflected Cross-Site Scripting",
    "slug": "pdf-invoicing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11361",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Defa Online Image Protector Free Edition \u003c= 3.4 - Reflected Cross-Site Scripting",
    "slug": "defa-online-image-protector",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000129",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BigBlueButton \u003c= 3.0.0-beta.4 - Reflected Cross-Site Scripting",
    "slug": "bigbluebutton",
    "type": "plugin",
    "affected_version": "[*, 3.0.0-beta.4]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0-beta.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39991",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPack Lite for Beaver Builder \u003c= 1.3.0.3 - Authenticated (Editor+) Local File Inclusion",
    "slug": "powerpack-addon-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37410",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cost of Goods for WooCommerce \u003c= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cost-of-goods-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48240",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eShop \u003c= 6.3.14 - Multiple Cross-Site Scripting",
    "slug": "eshop",
    "type": "plugin",
    "affected_version": "* - 6.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-0765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-0765",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Companion Sitemap Generator – HTML \u0026 XML \u003c= 3.6.6 - Cross-Site Request Forgery and Local File Inclusion",
    "slug": "companion-sitemap-generator",
    "type": "plugin",
    "affected_version": "* - 3.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15113",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Statistics \u003c= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 14.15.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.15.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9816",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Flipclock \u003c= 1.7.4 - Authenticated (Contributor+) Stored Cross Site Scripting",
    "slug": "wp-flipclock",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23728",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetTabs \u003c= 2.2.9 - Authenticated (Subscriber+) Information Exposure",
    "slug": "jet-tabs",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53985",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Wholesale Market for WooCommerce \u003c= 1.0.6 - Unauthenticated Arbitrary File Download",
    "slug": "wholesale-market-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4106",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "DsgnWrks Twitter Importer \u003c= 1.1.4 - Reflected Cross-Site Scripting",
    "slug": "dsgnwrks-twitter-importer",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23762",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Hero \u003c= 8.2.0 - Cross-Site Request Forgery Bypass",
    "slug": "slider-hero",
    "type": "plugin",
    "affected_version": "* - 8.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4424",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Easy Post Types \u003c= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta",
    "slug": "easy-post-types",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10080",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inline Footnotes \u003c= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "inline-footnotes",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56019",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BP Profile Search \u003c= 5.5 - Reflected Cross-Site Scripting via BPS_FORM",
    "slug": "bp-profile-search",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22293",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP RSS Aggregator \u003c= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update",
    "slug": "wp-rss-aggregator",
    "type": "plugin",
    "affected_version": "* - 4.23.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.23.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6621",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Formidable Form Builder \u003c 2.05.03 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "[*, 2.05.03)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.05.03",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-20192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20192",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WooCommerce Canada Post Shipping \u003c= 2.8.3 - Missing Authorization",
    "slug": "woocommerce-shipping-canada-post",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51498",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attribute",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1497",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 5.16.5 - Authenticated SQL Injection",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 5.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.16.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24149",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "RegistrationMagic \u003c= 5.0.1.5 - SQL Injection",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.0.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24862",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Markup Markdown \u003c= 3.20.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "markup-markdown",
    "type": "plugin",
    "affected_version": "* - 3.20.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9541",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UpdraftPlus - Backup/Restore \u003c= 1.24.12 - Reflected Cross-Site Scripting",
    "slug": "updraftplus",
    "type": "plugin",
    "affected_version": "* - 1.24.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0215",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PayHere Payment Gateway \u003c= 2.2.11 - Information Disclosure via Log Files",
    "slug": "payhere-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 2.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6064",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Freshdesk (official) \u003c= 1.7 - Open Redirect",
    "slug": "freshdesk-support",
    "type": "plugin",
    "affected_version": "1.7",
    "from_version": "1.7",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10102",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution \u003c= 4.2.0 - Missing Authorization to Arbitrary Vendor Deletion",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8289",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Compress – Image Optimizer \u003c= 6.11.08 - Missing Authorization to Unauthenticated CDN Modification",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.11.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.11.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1934",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Mobigate \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "mobigatevn",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23721",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c= 3.2.4 - Reflected Cross-Site Scripting",
    "slug": "wp-all-import-pro",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9329",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c= 3.2.4 - Reflected Cross-Site Scripting",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9329",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPMK Ajax Finder \u003c= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "find-any-think",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1749",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid \u003c= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-post-grid",
    "type": "plugin",
    "affected_version": "* - 7.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35739",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Posts for WordPress \u003c= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "related-posts-for-wp",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3506",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon Booking System \u003c= 10.2 - Unauthenticated Arbitrary File Upload",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3229",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Travelpayouts \u003c= 1.1.13 - Reflected Cross-Site Scripting",
    "slug": "travelpayouts",
    "type": "plugin",
    "affected_version": "* - 1.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5932",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lenxel Core  \u003c= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lenxel-core",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53791",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Gallery – YouTube Gallery \u003c= 1.7.6 -  Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "gallery-videos",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25979",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Button for Elementor \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "download-button-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Export for WooCommerce \u003c= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "order-export-and-more-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13623",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Landing Pages \u003c= 1.8.7 - Cross-Site Scripting",
    "slug": "landing-pages",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10090",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clone \u003c= 2.4.5 - Missing Authorization",
    "slug": "wp-clone-by-wp-academy",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43298",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43298",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "eRoom – Zoom Meetings \u0026 Webinar \u003c= 1.3.7 - Cross-Site Request Forgery",
    "slug": "eroom-zoom-meetings-webinar",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25614",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.1.0 - Missing Authorization",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32143",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PB oEmbed HTML5 Audio \u003c= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "pb-oembed-html5-audio-with-cache-support",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25098",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Membership \u003c= 1.2.3 - Privilege Escalation",
    "slug": "wp-membership",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-4038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4038",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Flexible Refund and Return Order for WooCommerce \u003c= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund",
    "slug": "flexible-refund-and-return-order-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10570",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Open Graphite \u003c= 1.6.0 - Reflected Cross-Site Scripting via topic parameter",
    "slug": "open-graphite",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47439",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WoodMart \u003c= 7.2.1 - Missing Authorization",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 7.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32240",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cimy Header Image Rotator \u003c= 6.1.1 - Cross-Site Request Forgery",
    "slug": "cimy-header-image-rotator",
    "type": "plugin",
    "affected_version": "* - 6.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1885",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ACME Divi Modules \u003c= 1.3.5 - Missing Authorization",
    "slug": "acme-divi-modules",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31540",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Linux Promotional Plugin \u003c= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "linux-promotional-plugin",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7668",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Stories \u003c= 1.37.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "web-stories",
    "type": "plugin",
    "affected_version": "* - 1.37.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.37.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54317",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beam me up Scotty – Back to Top Button \u003c= 1.0.21 - Reflected Cross-Site Scripting",
    "slug": "beam-me-up-scotty",
    "type": "plugin",
    "affected_version": "* - 1.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8741",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Responsive Auto Fit Text \u003c= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-responsive-slab-text",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26904",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JQuery Accordion Menu Widget \u003c= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "jquery-vertical-accordion-menu",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4890",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Map Plugin \u003c 2.3.10 - Cross-Site Request Forgery",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "[*, 2.3.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9307",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All Bootstrap Blocks \u003c= 1.3.28 - Missing Authorization",
    "slug": "all-bootstrap-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54733",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Beautiful Taxonomy Filters \u003c= 2.4.4 - Unauthenticated SQL Injection",
    "slug": "beautiful-taxonomy-filters",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12270",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Plezi \u003c 1.0.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "plezi",
    "type": "plugin",
    "affected_version": "[*, 1.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0680",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feed Them Social – Page, Post, Video, and Photo Galleries \u003c= 2.8.6 - Cross-Site Request Forgery Bypass",
    "slug": "feed-them-social",
    "type": "plugin",
    "affected_version": "[*, 2.8.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36739",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zoho CRM Lead Magnet  \u003c= 1.7.5.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "zoho-crm-forms",
    "type": "plugin",
    "affected_version": "* - 1.7.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41978",
    "auth_type": "Auth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.38 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion and Arbitrary Title Update",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6824",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Short URL \u003c= 1.6.8 - Cross-Site Request Forgery via configuration_page",
    "slug": "shorten-url",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1604",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "JS Help Desk \u003c= 2.9.1 - Unauthenticated Arbitrary File Download",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30882",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "JS Help Desk \u003c= 2.7.1 - Missing Authorization",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46840",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Solar Wizard Lite \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "solar-wizard-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11764",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login Logo Editor \u003c= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "login-logo-editor-by-oizuled",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37523",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Manager, Code Editor, and Backup by Managefy \u003c= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Download",
    "slug": "softdiscover-db-file-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9345",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SMTP by BestWebSoft \u003c= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "bws-smtp",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13908",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Automate Hub Free by Sperse.IO \u003c= 1.7.0 - Reflected Cross-Site Scripting",
    "slug": "automate-hub-free-by-sperse-io",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11377",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram Express \u003c= 5.4.19 - Authenticated (Subscriber+) SQL Injection",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.4.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3981",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Restaurant \u0026 Cafe Addon for Elementor \u003c= 1.5.3 - Missing Authorization via multiple AJAX functions",
    "slug": "restaurant-cafe-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-47826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47826",
    "auth_type": "Auth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Event Manager – Easily Build your Calendar of Events! \u003c= 3.1.27 - Stored Cross Site Scripting",
    "slug": "wp-event-manager",
    "type": "plugin",
    "affected_version": "[*, 3.1.28)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.28",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1474",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Property Hive Mortgage Calculator \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via price Parameter",
    "slug": "property-hive-mortgage-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11940",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mautic Integration for WooCommerce \u003c 1.0.3 - Cross-Site Request Forgery leading to Arbitrary Options Update",
    "slug": "mautic-integration-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4426",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CubePoints \u003c= 3.2.1 - Cross-Site Request Forgery",
    "slug": "cubepoints",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28952",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GTDB Guitar Tuners \u003c= 4.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "guitar-tuner",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46438",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Posts List Designer by Category – List Category Posts Or Recent Posts \u003c= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-list-designer",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23502",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zippy \u003c= 1.6.1 - Authenticated (Contributor+) Sensitive Information Disclosure",
    "slug": "zippy",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26533",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "The Pack Elementor addons \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-pack-addon",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30925",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form to DB \u003c= 1.5.6 - Multiple Cross-Site Scripting",
    "slug": "contact-form-to-db",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18492",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Misiek Photo Album \u003c= 1.4.3 - Cross-Site Request Forgery to Album Deletion",
    "slug": "misiek-photo-album",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7817",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Structured Content \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Classic Editor Shortcode",
    "slug": "structured-content",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24839",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetBackup – WP Backup, Migrate \u0026 Restore \u003c= 1.4.1 - Missing Authorization to Unauthorized Backup Location Change",
    "slug": "backup",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36667",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar and Notification \u003c= 4.0.3 - Unauthenticated SQL Injection",
    "slug": "booking-calendar-and-notification",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31403",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "issuuPress \u003c= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "issuupress",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30545",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ComboBlocks \u003c= 2.2.86 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43155",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Directory Kit \u003c= 1.1.9 - Open Redirect",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31229",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.24.6 - Missing Authorization via fire_cron REST endpoint",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.24.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22151",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pexels: Free Stock Photos  \u003c= 1.2.2 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "wp-pexels-free-stock-photos",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25915",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Editor \u003c= 1.2.6.2 - Cross-Site Scripting",
    "slug": "wp-editor",
    "type": "plugin",
    "affected_version": "[*, 1.2.6.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10877",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "1-Click Backup \u0026amp; Restore Database \u003c= 1.0.3 - Missing Authorization",
    "slug": "1-click-backup-restore-database-by-sunbytes",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32246",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "W3P SEO \u003c= 1.8.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-perfect-plugin",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51684",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sociable \u003c= 4.3.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "sociable",
    "type": "plugin",
    "affected_version": "* - 4.3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24612",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ClickDesigns \u003c= 1.8.0 - Missing Authorization to API Key Modification or Removal",
    "slug": "clickdesigns",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12559",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Vanguard - Marketplace Digital Products PHP7 \u003c= 2.1 - Cross-Site Scripting",
    "slug": "vanguard",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-15537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-15537",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Help Desk – Best Help Desk \u0026 Support Plugin \u003c= 2.7.7 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25444",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Timed Popup WordPress Plugin \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "wp-timed-popup",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9525",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH Maintenance Mode \u003c= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting",
    "slug": "yith-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36845",
    "auth_type": "Privileged",
    "cvss_score": 6.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Car Dealer Automotive WordPress Theme \u003c 1.1.9 - Sensitive Information Disclosure",
    "slug": "cardealer",
    "type": "theme",
    "affected_version": "[*, 1.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9482",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Blossom Spa \u003c= 1.3.3 - Sensitive Information Exposure",
    "slug": "blossom-spa",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2107",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "DZS Video Gallery \u003c= 12.25 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "dzs-videogallery",
    "type": "plugin",
    "affected_version": "* - 12.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47553",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.99 - Unauthenticated Information Exposure",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.99",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.99",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38761",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Product Customizer Light \u003c= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "product-customizer-light",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9848",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team - WordPress Team Member Showcase Plugin \u003c= 4.1.1 - Directory Traversal to Arbitrary File Read/Deletion",
    "slug": "tlp-team",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2557",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Cross-Site Request Forgery via ajax_save_sort_order",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0729",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "NextGen Gallery Pro \u003c= 3.1.9 - Reflected Cross-Site Scripting",
    "slug": "nextgen-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24293",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Packages \u003c= 5.9.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "wpdm-premium-packages",
    "type": "plugin",
    "affected_version": "* - 5.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24659",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Happyforms \u003c= 1.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blocks",
    "slug": "happyforms",
    "type": "plugin",
    "affected_version": "* - 1.21.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0096",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPB Elementor Addons \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpb-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3063",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StoryMap \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "wp-storymap",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52797",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Google Map Plugin \u003c 2.3.10 - Cross-Site Request Forgery",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "[*, 2.3.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9309",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Adminify \u003c= 3.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "adminify",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44266",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Candidate Application Form \u003c= 1.3 - Arbitrary File Download",
    "slug": "candidate-application-form",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-1000005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000005",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Nias course \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nias-course",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54277",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infographic Maker – iList \u003c= 4.3.7 - SQL Injection",
    "slug": "infographic-and-list-builder-ilist",
    "type": "plugin",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0747",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bold Page Builder \u003c= 4.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "[*, 4.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2089",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Lightbox \u003c= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3516",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kata Plus \u003c= 1.5.3 - Unauthenticated PHP Object Injection",
    "slug": "kata-plus",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32572",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery Widget \u003c= 1.2.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "gallery-widget",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28969",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28969",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Shared Files \u003c= 1.7.28 - Unauthenticated Sensitive Information Exposure",
    "slug": "shared-files",
    "type": "plugin",
    "affected_version": "* - 1.7.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43230",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GD Star Rating \u003c= 1.9.22 - Cross-Site Request Forgery",
    "slug": "gd-star-rating",
    "type": "plugin",
    "affected_version": "* - 1.9.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-2838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2838",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfileGrid  \u003c= 5.9.5.1 - Missing Authorization",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48079",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3714",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Munk Sites \u003c= 1.0.7 - Cross-Site Request Forgery to Arbitrary Plugin Installation",
    "slug": "munk-sites",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25101",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Favicon by RealFaviconGenerator \u003c= 1.3.22 - Reflected Cross-Site Scripting",
    "slug": "favicon-by-realfavicongenerator",
    "type": "plugin",
    "affected_version": "[*, 1.3.23)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.23",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0471",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LoginPress | Custom Login Page Customizer \u003c= 1.6.2 - Missing Authorization to Settings Changes",
    "slug": "loginpress",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41839",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MicroCopy \u003c= 1.1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "microcopy",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24397",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NextScripts: Social Networks Auto-Poster \u003c= 4.4.3 - Unauthenticated Stored Cross-Site Scripting via User Agent",
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "type": "plugin",
    "affected_version": "* - 4.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1762",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Tables WordPress Plugin – Easy Pricing Tables \u003c= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute",
    "slug": "easy-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8323",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PopCash Code Integration Tool \u003c 1.1 - Reflected Cross-Site Scripting",
    "slug": "popcashnet-code-integration-tool",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-15810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-15810",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Estatik Mortgage Calculator \u003c= 2.0.11 - Reflected Cross-Site Scripting",
    "slug": "estatik-mortgage-calculator",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9354",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Symposium \u003c= 15.8.1 - Reflected Cross-Site Scripting",
    "slug": "wp-symposium",
    "type": "plugin",
    "affected_version": "* - 15.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9414",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Piotnet Forms \u003c= 1.0.30 - Cross-Site Request Forgery",
    "slug": "piotnetforms",
    "type": "plugin",
    "affected_version": "* - 1.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57933",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woo Tuner \u003c= 0.1.2 - Missing Authorization",
    "slug": "woo-tuner",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23761",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Curriculo Vitae Free \u003c= 6.3 - Arbitrary File Upload",
    "slug": "wp-curriculo-vitae",
    "type": "plugin",
    "affected_version": "* - 6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24222",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AwesomePress \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "awesomepress",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51616",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.48 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.48",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-34347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34347",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Sermons \u003c= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-sermons",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7599",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Birth Chart Compatibility \u003c= 2.0 - Unauthenticated Full Path Exposure",
    "slug": "birth-chart-compatibility",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6082",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WoodMart \u003c= 8.2.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 8.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6746",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NiceJob \u003c= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "nicejob",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44028",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEMA API \u003c= 3.64 - SQL Injection",
    "slug": "sema-api",
    "type": "plugin",
    "affected_version": "* - 3.64",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.64",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0836",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gou Manage My Account Menu \u003c= 1.0.1.8 - Missing Authorization",
    "slug": "gou-wc-account-tabs",
    "type": "plugin",
    "affected_version": "* - 1.0.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54310",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Google Language Translator \u003c= 6.0.9 - Reflected Cross-Site Scripting",
    "slug": "google-language-translator",
    "type": "plugin",
    "affected_version": "[*, 6.0.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4452",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "PostX \u003c= 4.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 4.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EAN for WooCommerce \u003c= 5.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ean-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48249",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Map Categories to Pages \u003c= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "map-categories-to-pages",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60146",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nirvana \u003c= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nirvana",
    "type": "theme",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44057",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Survey Plus \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-survey-plus",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24801",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic - Custom Registration Forms, User Registration and User Login Plugin \u003c= 4.6.0.2 - SQL Injection",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "[*, 4.6.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-8435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8435",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
  },
  {
    "title": "Library Bookshelves \u003c= 5.8 - Reflected Cross-Site Scripting",
    "slug": "library-bookshelves",
    "type": "plugin",
    "affected_version": "* - 5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52453",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Safe Search \u003c= 0.7 - Cross-Site Scripting",
    "slug": "wp-safe-search",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2010-4518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4518",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteAlert (Formerly WP Health) \u003c= 1.9.7 - Cross-Site Request Forgery",
    "slug": "my-wp-health-check",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46857",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wp-forecast \u003c= 7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-forecast",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-35725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-35725",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "New Year Firework \u003c= 1.1.9 - Reflected Cross-Site Scripting",
    "slug": "new-year-firework",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000140",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCHURCH - Church Management System for Wordpress Theme \u003c 13-07-2019 - SQL Injection",
    "slug": "church-management",
    "type": "plugin",
    "affected_version": "[*, 13-07-2019)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13-07-2019",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-14845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14845",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Interactive World Map \u003c= 3.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "interactive-world-map",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50462",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Images to WebP \u003c 1.9 - Cross-Site Request Forgery",
    "slug": "images-to-webp",
    "type": "plugin",
    "affected_version": "[*, 1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24641",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "ShopElement \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shopelement",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56260",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RIS Version Switcher \u0026#8211; Downgrade or Upgrade WP Versions Easily \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "ris-version-switcher",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57902",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57902",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Resido - Real Estate WordPress Theme \u003c= 3.6 - Missing Authorization to Unauthenticated Server-Side Request Forgery and API Key Settings Update",
    "slug": "resido",
    "type": "theme",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1285",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "bbPress2 shortcode whitelist \u003c= 2.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "bbpress2-shortcode-whitelist",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39432",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sidebar Widgets by CodeLights \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "codelights-shortcodes-and-widgets",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4460",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MDTF – Meta Data and Taxonomies Filter \u003c= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13340",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Carousel Slider for Elementor \u003c= 2.1.3 - Missing Authorization",
    "slug": "ecommerce-product-carousel-slider-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58816",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LH Add Media From Url \u003c= 1.23 - Reflected Cross-Site Scripting",
    "slug": "lh-add-media-from-url",
    "type": "plugin",
    "affected_version": "* - 1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7090",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Baseball Scoreboard \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-baseball-scoreboard",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48025",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BRW \u003c= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ova-brw",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49314",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.53 - Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14945",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP \u003c= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "* - 6.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12504",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ActiveHelper LiveHelp Live Chat \u003c 3.1.5 - Reflected Cross-Site Scripting",
    "slug": "activehelper-livehelp",
    "type": "plugin",
    "affected_version": "[*, 3.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4513",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SureDash \u003c= 1.1.0 - Authenticated (Subscriber+) Information Disclosure",
    "slug": "suredash",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54685",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SureTriggers \u003c= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation",
    "slug": "suretriggers",
    "type": "plugin",
    "affected_version": "* - 1.0.78",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.78",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3102",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form builder with drag \u0026 drop - Kali Forms \u003c= 2.3.36 - Insecure Direct Object Reference",
    "slug": "kali-forms",
    "type": "plugin",
    "affected_version": "* - 2.3.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22305",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Push Notifications \u003c= 1.1.8 - Reflected Cross-Site Scripting",
    "slug": "ultimate-push-notifications",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31548",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVGPlus \u003c= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "svgplus",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via filter_list parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6096",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sticky Content \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sticky-menu-block",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26881",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EazyDocs \u003c= 2.6.4 - Missing Authorization",
    "slug": "eazydocs",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32221",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "F4 Post Tree \u003c= 1.1.18 - Reflected Cross-Site Scripting",
    "slug": "f4-tree",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22499",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orders Tracking for WooCommerce \u003c= 1.2.5 - Authenticated (Administrator+) Directory Traversal via 'file_url'",
    "slug": "woo-orders-tracking",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-4216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4216",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "140+ Widgets | Best Addons For Elementor – FREE \u003c= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4471",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Save as PDF plugin by Pdfcrowd \u003c= 3.2.0 - Missing Authorization",
    "slug": "save-as-pdf-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33684",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Waymark \u003c= 1.4.1 - Reflected Cross-Site Scripting via 'content'",
    "slug": "waymark",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12325",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Revslider \u003c= 6.6.20 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2306",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SellKit \u003c= 1.8.1 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "sellkit",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30509",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \u003c= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12043",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YITH WooCommerce Product Add-Ons \u003c= 4.3.0 - Authenticated(Shop Manager+) PHP Object Injection",
    "slug": "yith-woocommerce-product-add-ons",
    "type": "plugin",
    "affected_version": "[*, 4.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-49777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49777",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Subscribe to Comments \u003c= 2.3 - Reflected Cross-Site Scripting",
    "slug": "subscribe-to-comments",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8792",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin side data storage for Contact Form 7 \u003c= 1.1.1 - Missing Authorization to Unauthenticated Bookmark Status Alteration",
    "slug": "admin-side-data-storage-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1778",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Twimp WP \u003c= 0.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "twimp-wp",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9397",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Icons Font Loader \u003c= 1.1.4 - Authenticated(Administrator+) Arbitrary File Upload",
    "slug": "icons-font-loader",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24714",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventPrime \u003c= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 4.0.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8369",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SureCart \u003c= 2.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "surecart",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41241",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Store Locator \u003c= 3.98.10 - Unauthenticated Local File Inclusion",
    "slug": "store-locator",
    "type": "plugin",
    "affected_version": "3.98.9",
    "from_version": "3.98.9",
    "from_inclusive": true,
    "to_version": "3.98.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12571",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Hotel Booking \u003c= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7855",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Search Analytics \u003c= 1.4.10 - Reflected Cross-Site Scripting",
    "slug": "search-analytics",
    "type": "plugin",
    "affected_version": "* - 1.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9209",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mail Options \u003c= 0.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-mail-options",
    "type": "plugin",
    "affected_version": "* - 0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28981",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP – Bulk SMS – by SMS.to \u003c= 1.0.12 - Reflected Cross-Site Scripting",
    "slug": "wp-bulk-sms",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11434",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image vertical reel scroll slideshow \u003c= 9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "image-vertical-reel-scroll-slideshow",
    "type": "plugin",
    "affected_version": "* - 9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45051",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Report Post \u003c= 2.1.2 Reflected Cross-Site Scripting",
    "slug": "wp-report-post",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45769",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StoreContrl Woocommerce \u003c= 4.1.3 - Unauthenticated Arbitrary File Download",
    "slug": "storecontrl-wp-connection",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39568",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Raygun4WP \u003c= 1.8.2 - Cross-Site Scripting",
    "slug": "raygun4wp",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18531",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-chgFontSize \u003c= 1.8 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting",
    "slug": "wp-chgfontsize",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1764",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Goodlayers Hotel \u003c= 3.1.4 - Unauthenticated SQL Injection",
    "slug": "gdlr-hotel",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39504",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP eStore \u003c= 8.5.4 - Reflected Cross-Site Scripting via REQUEST_URI",
    "slug": "wp-cart-for-digital-products",
    "type": "plugin",
    "affected_version": "* - 8.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6072",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search Keyword Redirect \u003c= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-search-keyword-redirect",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32080",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import Export Suite for CSV and XML Datafeed \u003c= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 7.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2007",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Import Export Suite for CSV and XML Datafeed \u003c= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "7.20",
    "from_version": "7.20",
    "from_inclusive": true,
    "to_version": "7.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2007",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Draft \u003c= 3.0.9 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "website-builder",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58033",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit File Manager \u003c= 5.0.0 - Information Disclosure",
    "slug": "file-manager",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-7204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-7204",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Popup Builder \u003c= 1.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-notify-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3236",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Login Redirect \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "custom-login-redirect",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24536",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Media Download \u003c= 1.1.5 - Contributor+ Stored Cross-Site Scripting",
    "slug": "easy-media-download",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24699",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3056",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SociallyViral \u003c= 1.0.10 - Cross-Site Request Forgery",
    "slug": "sociallyviral",
    "type": "theme",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37938",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "T1 Theme \u003c= 19.0 - Open Redirect",
    "slug": "t1",
    "type": "theme",
    "affected_version": "* - 19.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3771",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "builty",
    "type": "theme",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "kinsley",
    "type": "theme",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "kaffen",
    "type": "theme",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "oblo",
    "type": "theme",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "ober",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "lesya",
    "type": "theme",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "minterio",
    "type": "theme",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "starbelly",
    "type": "theme",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "luique",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "samantha",
    "type": "theme",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "ashley",
    "type": "theme",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "courtney",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "lettery",
    "type": "theme",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "itsulu",
    "type": "theme",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "larson",
    "type": "theme",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by bslthemes \u003c= Various Version - Unauthenticated Local File Inclusion",
    "slug": "ruizarch",
    "type": "theme",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Classic Editor and Classic Widgets \u003c= 1.2.5 - Cross-Site Request Forgery via render_settings_page",
    "slug": "classic-editor-and-classic-widgets",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27434",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Total Hacks \u003c= 4.7.2 - Authenticated (Subscriber+) Plugin Options Update to Cross-Site Scripting",
    "slug": "wp-total-hacks",
    "type": "plugin",
    "affected_version": "* - 4.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3096",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReDi Restaurant Reservation \u003c= 24.0422 - Missing Authorization",
    "slug": "redi-restaurant-reservation",
    "type": "plugin",
    "affected_version": "* - 24.0422",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.0422",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38737",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jupiter X Core \u003c= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 4.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7781",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sirv \u003c= 7.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "* - 7.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46233",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Daisycon prijsvergelijkers \u003c= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "daisycon",
    "type": "plugin",
    "affected_version": "* - 4.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4590",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ni WooCommerce Custom Order Status \u003c= 1.9.6 - SQL Injection",
    "slug": "ni-woocommerce-custom-order-status",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24846",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Client Power Tools Portal \u003c= 1.9.0 - Reflected Cross-Site Scripting",
    "slug": "client-power-tools",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49670",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Tickets \u003c= 5.2.1 - Open Redirect",
    "slug": "event-tickets",
    "type": "plugin",
    "affected_version": "* - 5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25028",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Upfrontwp \u003c= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "upfrontwp",
    "type": "theme",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24009",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster Plus for WooCommerce \u003c 7.1.2 - Missing Authorization to Arbitrary Page/Post Deletion",
    "slug": "booster-plus-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 7.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-52232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52232",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \u003c= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9502",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leader \u003c= 2.6.1 - Missing Authorization",
    "slug": "leader",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56007",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.4.24.1 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "[*, 3.4.24.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.24.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-12462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12462",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MetalpriceAPI \u003c= 1.1.4 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "metalpriceapi",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48140",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Status Notifier Lite \u003c= 1.11.0 - Reflected Cross-Site Scripting",
    "slug": "post-status-notifier-lite",
    "type": "plugin",
    "affected_version": "* - 1.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47766",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BackWPup \u003c= 4.0.3 - Sensitive Information Exposure",
    "slug": "backwpup",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7164",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.7 - 1.7.3",
    "from_version": "1.7",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6691",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "0.0 - 0.0.13",
    "from_version": "0.0",
    "from_inclusive": true,
    "to_version": "0.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6691",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.3 - 1.3.1",
    "from_version": "1.3",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6691",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.6 - 1.6.4",
    "from_version": "1.6",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6691",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.0 - 1.0.6",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6691",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.1 - 1.1.1",
    "from_version": "1.1",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6691",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.2 - 1.2.4",
    "from_version": "1.2",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6691",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.4 - 1.4.4",
    "from_version": "1.4",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6691",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "SureForms – Drag and Drop Form Builder for WordPress \u003c= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "1.5",
    "from_version": "1.5",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6691",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Magazine Blocks – Blog Designer, Magazine \u0026 Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid \u003c= 1.3.14 - Reflected Cross-Site Scripting",
    "slug": "magazine-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9218",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Pro \u003c= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementskit",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7064",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gravity Forms Toolbar \u003c= 1.7.0 - Reflected Cross-Site Scripting",
    "slug": "gravity-forms-toolbar",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8718",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy WP SMTP \u003c= 1.3.9 - Missing Authorization to Arbitrary Options Update",
    "slug": "easy-wp-smtp",
    "type": "plugin",
    "affected_version": "[*, 1.3.9.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-25141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25141",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Responsive Tabs horizontal vertical and accordion Tabs \u003c= 1.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-horizontal-vertical-and-accordion-tabs",
    "type": "plugin",
    "affected_version": "* - 1.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Show Google Analytics widget \u003c= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "show-google-analytics-widget",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22515",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tags Cloud Manager \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "tags-cloud-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28166",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Platform.ly for WooCommerce \u003c= 1.1.6 - Unauthenticated Blind Server-Side Request Forgery",
    "slug": "platformly-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13904",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "XML Sitemap Generator for Google \u003c= 1.3.3 - Cross-Site Request Forgery to Plugin Settings Changes",
    "slug": "xml-sitemap-generator-for-google",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26514",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tiny Bootstrap Elements Light \u003c= 4.3.34 - Unauthenticated Local File Inclusion",
    "slug": "tiny-bootstrap-elements-light",
    "type": "plugin",
    "affected_version": "* - 4.3.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9991",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PlugNedit Adaptive Editor \u003c 6.2.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "plugnedit",
    "type": "plugin",
    "affected_version": "[*, 6.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9423",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Cross-Site Request Forgery",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1472",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "金数据 \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jinshuju",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58864",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments – wpDiscuz \u003c= 7.6.21 - Unauthenticated HTML Injection",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6704",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Subscribe Sidebar plugin by Blubrry \u003c= 1.3.1 - Reflected Cross-Site Scripting",
    "slug": "subscribe-sidebar",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25033",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Review \u0026 Structure Data Schema Plugin – Review Schema \u003c= 2.1.14 - Missing Authorization to Arbitrary Review Update",
    "slug": "review-schema",
    "type": "plugin",
    "affected_version": "* - 2.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0836",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Total Branding \u003c= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via title Parameter",
    "slug": "wp-total-branding",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6625",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Gallery \u003c= 1.8.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_gallery_shortcode",
    "slug": "file-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23676",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks – Page Builder Features \u003c= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6884",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.23",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.15",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.10",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.4",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.2",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.31",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.24",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.22",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.19",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.6",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.1",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.34",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.18",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.32",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.32",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.31",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.14",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.7",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.34",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.5.2 - Deserialization Gadget",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.28",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-28032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28032",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CryptoCloud - Crypto Payment Gateway \u003c= 2.1.2 - Missing Authorization",
    "slug": "cryptocloud-crypto-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48147",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lemonade Social Networks Autoposter Pinterest \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "lemonade-sna-pinterest-edition",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56028",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brave Popup Builder \u003c= 0.6.5 - Unauthenticated Server-Side Request Forgery",
    "slug": "brave-popup-builder",
    "type": "plugin",
    "affected_version": "* - 0.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-30453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30453",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unite Gallery Lite \u003c= 1.7.62 - Authenticated (Contributor+) SQL Injection",
    "slug": "unite-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 1.7.62",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.62",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43207",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "VOD Infomaniak \u003c= 1.5.9 - Missing Authorization",
    "slug": "vod-infomaniak",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22729",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EasyRotator for WordPress \u003c= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easyrotator-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5742",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c= 8.8.00.002 - Reflected Cross-Site Scripting",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 8.8.00.002",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.00.002",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37416",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ragic Shortcode \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ragic-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11431",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobBoardWP \u003c= 1.2.2 - Missing Authorization to Job Posting Manipulation",
    "slug": "jobboardwp",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23715",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "eForm - WordPress Form Builder \u003c 4.19.1 - Reflected Cross-Site Scripting",
    "slug": "wp-fsqm-pro",
    "type": "plugin",
    "affected_version": "[*, 4.19.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-48333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48333",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Best Addons for Elementor \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "best-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53763",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery \u003c= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5481",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"
  },
  {
    "title": "Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "[*, 2.7.31)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.31",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-6967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6967",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "[2.8, 2.8.23.2)",
    "from_version": "2.8",
    "from_inclusive": true,
    "to_version": "2.8.23.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-6967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6967",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "[3, 3.0.10.2)",
    "from_version": "3",
    "from_inclusive": true,
    "to_version": "3.0.10.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-6967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6967",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form by Bit Form - Bit Form \u003c= 2.20.3 - Unauthenticated Arbitrary File Upload",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.20.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6679",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dokan Pro \u003c= 4.0.5 - Authenticated (Vendor+) Privilege Escalation",
    "slug": "dokan-pro",
    "type": "plugin",
    "affected_version": "* - 4.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5931",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FundEngine \u003c= 1.7.4 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "wp-fundraising-donation",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48302",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "subscribe2",
    "type": "plugin",
    "affected_version": "* - 10.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "sheets-to-wp-table-live-sync",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "dashboard-welcome-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "faq-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "ajax-load-more-anything",
    "type": "plugin",
    "affected_version": "* - 3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "current-template-name",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "top-table-of-contents",
    "type": "plugin",
    "affected_version": "* - 1.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "chat-help",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "boostify-header-footer-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "gallery-box",
    "type": "plugin",
    "affected_version": "* - 1.7.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Appsero \u003c= 2.0.0 - Missing Authorization via handle_optin_optout",
    "slug": "unlimited-elementor-inner-sections-by-boomdevs",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SearchIQ \u003c= 4.5 - Unauthenticated Sensitive Information Exposure",
    "slug": "searchiq",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31259",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Donate Me \u003c= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "donate-me",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53776",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.25.3 - Authenticated (Admin+) PHP Object Injection",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.25.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32513",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bookly \u003c= 21.5 - Unauthenticated Stored Cross-Site Scripting via Name",
    "slug": "bookly-responsive-appointment-booking-tool",
    "type": "plugin",
    "affected_version": "21.5",
    "from_version": "21.5",
    "from_inclusive": true,
    "to_version": "21.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1172",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Envo Extra \u003c= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget",
    "slug": "envo-extra",
    "type": "plugin",
    "affected_version": "* - 1.8.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5645",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Armour Extended \u003c= 1.26 - Reflected Cross-Site Scripting",
    "slug": "wp-armour-extended",
    "type": "plugin",
    "affected_version": "* - 1.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43948",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hover Image Button \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hover-image-button",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27266",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mollie Payments for WooCommerce \u003c= 8.0.2 - Unauthenticated Insecure Direct Object Reference",
    "slug": "mollie-payments-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 8.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39362",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Visual Form Builder \u003c= 3.0.5 - CSV Injection",
    "slug": "visual-form-builder",
    "type": "plugin",
    "affected_version": "[*, 3.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0142",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WC Plus \u003c= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulation",
    "slug": "wc-plus",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7821",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 3.4.7 - Unauthenticated Subscriber Download",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-6015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6015",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SRS Simple Hits Counter \u003c= 1.1.0 - Cross-Site Request Forgery",
    "slug": "srs-simple-hits-counter",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22709",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hunk Companion \u003c= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation",
    "slug": "hunk-companion",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9707",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Internal Linking of Related Contents \u003c= 1.1.8 - Missing Authorization",
    "slug": "internal-linking-of-related-contents",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49884",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Member – User Profile, User Registration, Login \u0026 Membership Plugin \u003c= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3361",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "PrintXtore \u003c= 1.7.5 - Unauthenticated Local File Inclusion",
    "slug": "bw-printxtore",
    "type": "theme",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28946",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Creative Contact Form \u003c 1.0.0 - Arbitrary File Upload",
    "slug": "sexy-contact-form",
    "type": "plugin",
    "affected_version": "[*, 1.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-8739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8739",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Zillow Review Slider \u003c= 2.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-zillow-review-slider",
    "type": "plugin",
    "affected_version": "[*, 2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1915",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGateway \u003c= 3.5 - Unauthenticated Privilege Escalation",
    "slug": "wpgateway",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3180",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Interact: Embed A Quiz On Your Site \u003c= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "interact-quiz-embed",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5659",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WidgetKit \u003c= 2.5.4 - Missing Authorization to Notice Dismissal",
    "slug": "widgetkit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33908",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33908",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CM Popup Plugin for WordPress – Popup Maker \u003c= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cm-pop-up-banners",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5004",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AuraMart \u003c= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "auramart",
    "type": "theme",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26922",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blocksy Companion \u003c= 2.0.42 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "blocksy-companion",
    "type": "plugin",
    "affected_version": "* - 2.0.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35633",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recover abandoned cart for WooCommerce \u003c= 2.5 - Unauthenticated SQL Injection",
    "slug": "recover-wc-abandoned-cart",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47608",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Forminator \u003c= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.42.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.42.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3487",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Max Addons Pro for Bricks \u003c= 1.6.1 - Reflected Cross-Site Scripting",
    "slug": "max-addons-pro-bricks",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32952",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KiotViet Sync \u003c= 1.8.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "kiotvietsync",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32573",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Magic Buttons for Elementor \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode",
    "slug": "magic-buttons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6687",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Picsmize \u003c= 1.0.0 - Unauthenticated Arbitrary File Upload",
    "slug": "picsmize",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52380",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BA Book Everything \u003c= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ba-book-everything",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3672",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ALD Login Page \u003c= 1.1 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ald-login-page",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32518",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – PDF Stamper \u003c= 1.0 - Cross-Site Scripting",
    "slug": "edd-pdf-stamper",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Democracy Poll \u003c 5.4 - Cross-Site Scripting",
    "slug": "democracy-poll",
    "type": "plugin",
    "affected_version": "[*, 5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18520",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wordpress login form to anywhere \u003c= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-show-login-form",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28914",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "reCAPTCHA for all \u003c= 2.22 - Cross-Site Request Forgery",
    "slug": "recaptcha-for-all",
    "type": "plugin",
    "affected_version": "* - 2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30862",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ListingPro - WordPress Directory \u0026 Listing Theme \u003c 2.0.14.5 - Stored Cross-Site Scripting",
    "slug": "listingpro",
    "type": "theme",
    "affected_version": "* - 2.0.14.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19541",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 6.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11829",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Snow Storm \u003c= 1.4.6 - Reflected Cross-Site Scripting",
    "slug": "snow-storm",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30858",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscribe To Comments Reloaded \u003c= 220725 - Unauthenticated Sensitive Information Exposure",
    "slug": "subscribe-to-comments-reloaded",
    "type": "plugin",
    "affected_version": "* - 220725",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "220725",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31249",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP ERP \u003c= 1.12.3 - Reflected Cross-Site Scripting",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.12.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34008",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Viral Mag \u003c= 1.0.9 - Missing Authorization to Arbitrary Plugin Activation",
    "slug": "viral-mag",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28990",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Twitget \u003c 3.3.3 - Cross-Site Request Forgery",
    "slug": "twitget",
    "type": "plugin",
    "affected_version": "[*, 3.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-2559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2559",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress \u003c= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2108",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5941",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
  },
  {
    "title": "Newsletters \u003c= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13739",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goodlayers Hotel \u003c= 3.1.4 - Unauthenticated PHP Object Injection",
    "slug": "gdlr-hotel",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39503",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tera Charts \u003c 1.0 - Directory Traversal",
    "slug": "tera-charts",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4940",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Falang multilanguage for WordPress \u003c= 1.3.52 - Missing Authorization to Translation Update and Information Exposure",
    "slug": "falang",
    "type": "plugin",
    "affected_version": "* - 1.3.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6869",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Custom 404 Pro \u003c= 3.7.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "custom-404-pro",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47605",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SoundCloud Shortcode \u003c= 3.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "soundcloud-shortcode",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34018",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TaxoPress \u003c= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "simple-tags",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2169",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0710",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recently Purchased Products For Woo \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter",
    "slug": "recently-purchased-products-for-woo",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1008",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Filterable Portfolio \u003c= 1.0.19 - Reflected Cross-Site Scripting",
    "slug": "responsive-filterable-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2119",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextGen Gallery \u003c= 2.1.10 - Local File Inclusion",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9538",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Shoppable Images \u003c= 1.2.3 - Cross Site Request Forgery",
    "slug": "mabel-shoppable-images-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25698",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "FlyingPress \u003c= 3.9.6 - Missing Authorization",
    "slug": "flying-press",
    "type": "plugin",
    "affected_version": "* - 3.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4948",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "130+ Widgets | Best Addons For Elementor – FREE \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2250",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Zoom \u003c= 1.8.8 - Missing Authorization",
    "slug": "image-zoom",
    "type": "plugin",
    "affected_version": "* - 1.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41619",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Store Locator Widget \u003c= 2025r2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "store-locator-widget",
    "type": "plugin",
    "affected_version": "* - 2025r2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2025r2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30919",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Behance Portfolio Manager \u003c= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "portfolio-manager-powered-by-behance",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57913",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dropdown Menu Widget \u003c= 1.9.7 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "dropdown-menu-widget",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2704",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Compress – Image Optimizer [All-In-One] \u003c= 6.20.13 - Reflected Cross-Site Scripting",
    "slug": "wp-compress-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 6.20.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.20.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47384",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Manager \u003c= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'",
    "slug": "contact-manager",
    "type": "plugin",
    "affected_version": "* - 8.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8783",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dokan \u003c= 3.6.5 - Cross-Site Request Forgery",
    "slug": "dokan-lite",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3194",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Wall \u003c= 3.0 - Reflected Cross-Site Scripting",
    "slug": "image-wall",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30869",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Service Finder Bookings \u003c= 5.0 - Unauthenticated Privilege Escalation via Account Takeover",
    "slug": "sf-booking",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13442",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Posts Ticker \u003c= 1.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-posts-ticker",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4725",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SrcSet Responsive Images for WordPress \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "truenorth-srcset",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51702",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1806",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WM Options Import Export \u003c= 1.0.1 - Unauthenticated Information Exposure",
    "slug": "wm-options-import-export",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23781",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Logger \u003c= 2.2 - Missing Authorization",
    "slug": "wp-data-logger",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39456",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SEO Scout \u003c= 0.9.83 - Cross-Site Request Forgery to Settings Update",
    "slug": "ab-rankings-testing-tool",
    "type": "plugin",
    "affected_version": "* - 0.9.83",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.83",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36358",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPS Hide Login \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "wps-hide-login",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9498",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Capturly \u003c= 2.0.1 - Unauthenticated Local File Inclusion",
    "slug": "capturly-optimize-your-website",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39379",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "White Label CMS \u003c= 2.4 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "white-label-cms",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4302",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pop-Up Chop Chop \u003c= 2.1.7 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "pop-up",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31432",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS – eLearning and online course solution \u003c= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5438",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Language \u003c= 1.2.1 - Missing Authorization",
    "slug": "wordpress-language",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38383",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BookingPress \u003c= 1.1.28 - Authenticated (Administrator+) SQL Injection",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.1.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31910",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Event Tickets \u003c= 5.20.0 - Reflected Cross-Site Scripting",
    "slug": "event-tickets",
    "type": "plugin",
    "affected_version": "* - 5.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30794",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 4.15.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.15.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11179",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Comments Import \u0026 Export \u003c= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "comments-import-export-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3919",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c= 8.5.02.005 - IP Spoofing",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 8.5.02.005",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.02.005",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49774",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Private Message \u003c 1.0.6 - Insecure Direct Object Reference",
    "slug": "wp-private-message",
    "type": "plugin",
    "affected_version": "[*, 1.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-0453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0453",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "Viral Quiz Maker - OnionBuzz \u003c 1.2.2 - SQL Injection",
    "slug": "onionbuzz-viral-quiz",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-14231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14231",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "terser (JS Package) \u003c 5.14.2 - Denial of Service",
    "slug": "retro-winamp-block",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-25858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25858",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "terser (JS Package) \u003c 5.14.2 - Denial of Service",
    "slug": "sophi",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-25858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25858",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "terser (JS Package) \u003c 5.14.2 - Denial of Service",
    "slug": "elasticpress",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-25858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25858",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "terser (JS Package) \u003c 5.14.2 - Denial of Service",
    "slug": "simple-podcasting",
    "type": "plugin",
    "affected_version": "[*, 1.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": false,
    "severity": "low",
    "cve": "CVE-2022-25858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25858",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "terser (JS Package) \u003c 5.14.2 - Denial of Service",
    "slug": "simple-local-avatars",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-25858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25858",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Arconix Shortcodes \u003c= 2.1.16 - Reflected Cross-Site Scripting",
    "slug": "arconix-shortcodes",
    "type": "plugin",
    "affected_version": "* - 2.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47673",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.25.1 - Authenticated (Contributor+) Arbitrary Content Deletion",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23672",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 6.1.4 - Unauthenticated Blind SQL Injection via time Parameter",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "[*, 6.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24946",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Content Copy Protection \u0026 Prevent Image Save \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "prevent-content-copy-image-save",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24333",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Responsive Gallery Grid \u003c= 2.3.14 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "responsive-gallery-grid",
    "type": "plugin",
    "affected_version": "* - 2.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4091",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Blocks with Lightbox \u003c= 2.2.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "simply-gallery-block",
    "type": "plugin",
    "affected_version": "[*, 2.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24667",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0311",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 4.2.5 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6294",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "aDirectory – WordPress Directory Listing Plugin \u003c= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion",
    "slug": "adirectory",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13541",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c 1.8.3 - Object Injection",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 1.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-4825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4825",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Auto Featured Image \u003c= 1.2 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "auto-featured-image",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6054",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Database Backup for WordPress \u003c= 2.2.4 - Missing Authorization",
    "slug": "wp-db-backup",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-10076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10076",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "EditorsKit \u003c= 1.31.5 - Authenticated (Contributor+) Code Injection",
    "slug": "block-options",
    "type": "plugin",
    "affected_version": "* - 1.31.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24546",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WebEngage Feedback, Survey and Notification \u003c 2.0.1 - Cross-Site Scripting",
    "slug": "webengage",
    "type": "plugin",
    "affected_version": "[*, 2.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4574",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Alone – Charity Multipurpose Non-profit WordPress Theme \u003c= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion",
    "slug": "alone",
    "type": "theme",
    "affected_version": "* - 7.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5393",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Bootstrap Shortcodes Ultimate \u003c= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bs-shortcode-ultimate",
    "type": "plugin",
    "affected_version": "* - 4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47851",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add custom page template \u003c= 2.0.1 - Authenticated (Administrator+) PHP Code Injection to Remote Code Execution",
    "slug": "add-custom-page-template",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3491",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Use Any Font \u003c= 6.2.0 - Unauthenticated Arbitrary CSS Appending",
    "slug": "use-any-font",
    "type": "plugin",
    "affected_version": "[*, 6.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24977",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gettext override translations \u003c= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gettext-override-translations",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3036",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OnePress \u003c= 2.3.6 - Cross-Site Request Forgery via save_settings()",
    "slug": "onepress",
    "type": "theme",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37448",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Blogster Lite \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "video-blogster-lite",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60132",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GenerateBlocks \u003c= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "generateblocks",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24751",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mailing Group Listserv \u003c= 2.0.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-mailing-group",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22527",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "uListing \u003c= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4345",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "All-in-One Video Gallery \u003c= 3.5.2 - Missing Authorization",
    "slug": "all-in-one-video-gallery",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31248",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Utech Spinning Earth \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "utech-spinning-earth",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51839",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Electric Studio Client Login \u003c= 0.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "electric-studio-client-login",
    "type": "plugin",
    "affected_version": "* - 0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27425",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Maspik – Spam blacklist \u003c= 0.10.3 - Bypass",
    "slug": "contact-forms-anti-spam",
    "type": "plugin",
    "affected_version": "* - 0.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48271",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.27",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.15",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.21",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.17",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.11",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.27",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.16",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.7",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.8",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.25",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.24",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.24",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.12",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - PHAR Unserialization",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-1000773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000773",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AtaraPay WooCommerce Payment Gateway \u003c= 2.0.13 - Reflected Cross-Site Scripting",
    "slug": "atarapay-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52460",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Heateor Social Login WordPress \u003c= 1.1.32 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "heateor-social-login",
    "type": "plugin",
    "affected_version": "* - 1.1.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.32",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-35706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35706",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hover Effects Ultimate \u003c= 9.7.0 - Reflected Cross-Site Scripting via effects",
    "slug": "image-hover-effects-ultimate",
    "type": "plugin",
    "affected_version": "* - 9.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25031",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icons Font Loader \u003c= 1.1.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "icons-font-loader",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46084",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NextScripts \u003c= 4.4.6 - Reflected Cross-Site Scripting",
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37275",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "React Webcam \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "react-webcam",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0365",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support \u003c= 6.3.1 - Missing Authorization",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54289",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form To Online Booking \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "cf7-calendly-integration",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23653",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backend Localization \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "kau-boys-backend-localization",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-10014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10014",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Debug Log Manager \u003c= 2.2.2 - Directory Listing to Sensitive Information Disclosure",
    "slug": "debug-log-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6383",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPLingo – Forum Plugin \u003c= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "wplingo",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23534",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "VOD Infomaniak \u003c= 1.5.7 - Cross-Site Request Forgery",
    "slug": "vod-infomaniak",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49274",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPGYM \u003c= 67.7.0 - Missing Authorization to Admin Account Creation",
    "slug": "gym-management",
    "type": "plugin",
    "affected_version": "* - 67.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "67.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6080",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Floating Video Player \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "floating-player",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54421",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SalesKing \u003c= 1.6.15 - Missing Authorization to Settings Change",
    "slug": "salesking",
    "type": "plugin",
    "affected_version": "* - 1.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22156",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Estatik Real Estate Plugin  \u003c= 4.1.0 - Unauthenticated PHP Object Injection",
    "slug": "estatik",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6049",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation",
    "slug": "countdown-for-the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4950",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation",
    "slug": "events-notification-bar-addon",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4950",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation",
    "slug": "cool-timeline",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4950",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation",
    "slug": "cryptocurrency-donation-box",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4950",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation",
    "slug": "events-search-addon-for-the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4950",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation",
    "slug": "cryptocurrency-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-4950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4950",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation",
    "slug": "event-page-templates-addon-for-the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4950",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation",
    "slug": "template-events-calendar",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4950",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation",
    "slug": "cryptocurrency-price-ticker-widget",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4950",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation",
    "slug": "events-widgets-for-elementor-and-the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4950",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Meks Flexible Shortcodes \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meks-flexible-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47621",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Giveaways \u003c= 2.45.0 - Authenticated(Admin+) Stored Cross-Site Scripting via form fields",
    "slug": "giveasap",
    "type": "plugin",
    "affected_version": "* - 2.45.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.45.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1121",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media \u003c= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletion",
    "slug": "evergreen-content-poster",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12071",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WhitePage \u003c= 1.1.5 - Cross-Site Request Forgery via params_api_form.php",
    "slug": "white-page-publication",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45109",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Brizy Page Builder \u003c= 2.4.1 - Authenticated Stored Cross-Site Scripting via Element URL",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2040",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 3.9.6 - Cross-Site Request Forgery to Order Title Update",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3201",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GD Rating System \u003c= 2.3 - Cross-Site Scripting",
    "slug": "gd-rating-system",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5288",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX \u003c= 4.1.2 - Missing Authorization to Arbitrary Options Update",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5326",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads Stripe Extension \u003c= 2.1.2 - Reflected Cross-Site Scripting",
    "slug": "stripe-gateway",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9529",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Student Result or Employee Database \u003c= 1.6.3 - Authentication Bypass",
    "slug": "simple-student-result",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14766",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lazy Social Comments \u003c= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Options",
    "slug": "lazy-facebook-comments",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23733",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yawave \u003c= 2.9.1 - Unauthenticated SQL Injection",
    "slug": "yawave",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1648",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Bubble Menu \u003c= 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bubble-menu",
    "type": "plugin",
    "affected_version": "[*, 3.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-3650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3650",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11052",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relevanssi \u003c= 4.21.2 (Free) and \u003c 2.25.0 (Premium) - Missing Authorization to Unauthorized Post Access",
    "slug": "relevanssi-premium",
    "type": "plugin",
    "affected_version": "[*, 2.25.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-7199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7199",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Relevanssi \u003c= 4.21.2 (Free) and \u003c 2.25.0 (Premium) - Missing Authorization to Unauthorized Post Access",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "* - 4.21.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7199",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Custom Users Order \u003c= 4.2 - Reflected Cross-Site Scripting",
    "slug": "custom-users-order",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23858",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmbedPress \u003c= 4.0.9 - Unauthenticated Local File Inclusion",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 4.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43328",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "140+ Widgets | Xpro Addons For Elementor – FREE \u003c= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10319",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CartFlows Pro \u003c= 1.11.12 - Cross-Site Request Forgery",
    "slug": "cartflows-pro",
    "type": "plugin",
    "affected_version": "* - 1.11.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36685",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Editor \u003c 1.2.6 - Incorrect Permission Assignment or Protection",
    "slug": "wp-editor",
    "type": "plugin",
    "affected_version": "[*, 1.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10886",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP YouTube Live \u003c= 1.8.2 - Admin+ Stored Cross-Site Scripting",
    "slug": "wp-youtube-live",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1334",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 6.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6701",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "* - 6.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6701",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ContentStudio \u003c= 1.2.5 - Missing Authorization",
    "slug": "contentstudio",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-0556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0556",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Management Tickets Booking \u003c= 1.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "event-monster",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47525",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login Logout Shortcode \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter",
    "slug": "login-logout-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9421",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "URL Media Uploader \u003c= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding",
    "slug": "url-media-uploader",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1662",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.13",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.2",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.30",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.27",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.20",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.18",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.15",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.28",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.27",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.24",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.10",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.11",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.30",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.19",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.6",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Server Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.3",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17669",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ecwid Ecommerce Shopping Cart \u003c= 6.12.4 - Cross-Site Request Forgery",
    "slug": "ecwid-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 6.12.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.12.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51533",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Total Poll Lite \u003c= 4.9.9 - Missing Authorization",
    "slug": "totalpoll-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32821",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mortgage Calculator Estatik \u003c= 2.0.12 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "estatik-mortgage-calculator",
    "type": "plugin",
    "affected_version": "* - 2.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48136",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "InstaWP Connect – 1-click WP Staging \u0026 Migration \u003c= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.83",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.83",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13913",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Top 10 – Popular posts plugin for WordPress \u003c= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blocks",
    "slug": "top-10",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4570",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup by Supsystic \u003c= 1.10.19 - Cross-Site Request Forgery",
    "slug": "popup-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.10.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39997",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "SS Downloads \u003c= 1.4.4.1 - Cross-Site Scripting",
    "slug": "ss-downloads",
    "type": "plugin",
    "affected_version": "* - 1.4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4554",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brands for WooCommerce \u003c= 3.7.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "brands-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.7.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23667",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restrict Usernames Emails Characters \u003c= 3.1.3 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "restrict-usernames-emails-characters",
    "type": "plugin",
    "affected_version": "[*, 3.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6165",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Editorial Calendar \u003c= 2.6 - Authenticated (Admin+) SQL Injection",
    "slug": "editorial-calendar",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-10023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-10023",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AutoWP \u003c= 2.2.2 - Missing Authorization",
    "slug": "autowp-ai-content-writer-rewriter",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48350",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder \u003c= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5292",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Finance \u003c= 1.3.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-finance",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13096",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-in-One WP Migration \u003c= 7.58 - Directory Traversal to File Deletion on Windows Hosts",
    "slug": "all-in-one-wp-migration",
    "type": "plugin",
    "affected_version": "* - 7.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1476",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SupportCandy – Helpdesk \u0026 Customer Support Ticket System \u003c= 3.3.0 - Insecure Direct Object Reference",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13552",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Squelch Tabs and Accordions Shortcodes \u003c= 0.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via tab Shortcode",
    "slug": "squelch-tabs-and-accordions-shortcodes",
    "type": "plugin",
    "affected_version": "* - 0.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5946",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WOOF - Products Filter for WooCommerce \u003c= 1.1.9 - Local File Inclusion",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-8711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-8711",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tabulate \u003c= 2.10.3 - Reflected Cross-Site Scripting",
    "slug": "tabulate",
    "type": "plugin",
    "affected_version": "* - 2.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13223",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All in One SEO 4.1.3.1 - 4.1.5.2 - Authenticated SQL Injection",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "4.1.3.1 - 4.1.5.2",
    "from_version": "4.1.3.1",
    "from_inclusive": true,
    "to_version": "4.1.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-25037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25037",
    "auth_type": "Auth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
  },
  {
    "title": "Pie Register \u003c= 3.7.1.5 - Authentication Bypass",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "[*, 3.7.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24647",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shortcode \u003c= 0.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcode",
    "type": "plugin",
    "affected_version": "* - 0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58022",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon Page by SeedProd \u003c= 5.1.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "coming-soon",
    "type": "plugin",
    "affected_version": "[*, 5.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-15038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-15038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 – PayPal \u0026 Stripe Add-on \u003c= 2.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "contact-form-7-paypal-add-on",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47518",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF.js Shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pdfjs-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23943",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Builderall Builder for WordPress \u003c= 2.0.1 - Unauthenticated Server-Side Request Forgery",
    "slug": "builderall-cheetah-for-wp",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-30532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30532",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Curator.io: Show all your social media posts in a beautiful feed. \u003c= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via feed_id Attribute",
    "slug": "curatorio",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9057",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixgraphy \u003c= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pixgraphy",
    "type": "theme",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35740",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend File Manager \u003c= 18.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "[*, 18.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4365",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Small Package Quotes – UPS Edition \u003c= 4.5.16 - Unauthenticated SQL Injection",
    "slug": "small-package-quotes-ups-edition",
    "type": "plugin",
    "affected_version": "* - 4.5.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13475",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Hello FSE Blog \u003c= 1.0.6 - Missing Authorization",
    "slug": "hello-fse-blog",
    "type": "theme",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49970",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Defender Security \u003c= 4.2.0 - Masked Login Area Security Feature Bypass",
    "slug": "defender-security",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47189",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto \u003c= 8.0.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "tripetto",
    "type": "plugin",
    "affected_version": "* - 8.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13497",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GamiPress - Reset User \u003c= 1.0.0 - Cross-Site Request Forgery to GamiPress User Data Removal",
    "slug": "gamipress-reset-user",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8245",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI Power: Complete AI Pack – Powered by GPT-4 \u003c= 1.8.1 - Missing Authorization to Sensitive Data Exposure",
    "slug": "gpt3-ai-content-generator",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51527",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "EU Cookie Law \u003c= 3.1.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "eu-cookie-law",
    "type": "plugin",
    "affected_version": "[*, 3.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16522",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Registration for WooCommerce \u003c= 1.5.6 - Unauthenticated Privilege Escalation",
    "slug": "woocommerce-simple-registration",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32511",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FloristPress \u003c= 7.2.0 - Reflected Cross-Site Scripting",
    "slug": "bakkbone-florist-companion",
    "type": "plugin",
    "affected_version": "* - 7.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54347",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Notices Manager \u003c= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval",
    "slug": "admin-notices-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1717",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Cryptocurrency Widgets Pack \u003c= 1.8.1 - Unauthenticated SQL Injection",
    "slug": "cryptocurrency-widgets-pack",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-44588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44588",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Invisible Optin \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "invisible-optin",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48311",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c 5.5.7.1 - Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "[*, 5.5.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9299",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget or Sidebar Shortcode \u003c= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "widget-or-sidebar-per-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9885",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting via Ephox in Plupload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.1",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3439",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting via Ephox in Plupload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.1",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3439",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting via Ephox in Plupload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-3439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3439",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting via Ephox in Plupload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.5",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3439",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting via Ephox in Plupload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.5",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3439",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting via Ephox in Plupload",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.3",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3439",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CoDesigner WooCommerce Builder for Elementor \u003c= 4.21 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "woolementor",
    "type": "plugin",
    "affected_version": "* - 4.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22788",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.27.12 - Unauthenticated Sensitive Information Disclosure",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.27.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24689",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WpEvently \u003c= 4.2.9 - Missing Authorization",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 4.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30887",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "pootle button \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "pootle-button",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-15811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-15811",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directorist \u003c= 7.4.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3930",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Forms \u003c= 0.93 - Remote Code Execution",
    "slug": "wpgform",
    "type": "plugin",
    "affected_version": "[*, 0.94)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.94",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-20988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20988",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Car Dealer Automotive WordPress Theme – Responsive \u003c= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Deletion and Read",
    "slug": "cardealer",
    "type": "theme",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1282",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Videos \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "videos",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31384",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDataTables Lite plugin \u003c= 2.0.11 - SQL injection",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-6012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6012",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Edwiser Bridge \u003c= 3.0.7 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "edwiser-bridge",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49312",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Backup \u0026 Clone - Migrate for WordPress \u003c= 2.3.3 - Unauthenticated Arbitrary File Upload",
    "slug": "indeed-wp-superbackup",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9290",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VW Storefront \u003c= 0.9.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset",
    "slug": "vw-storefront",
    "type": "theme",
    "affected_version": "* - 0.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13686",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MyBookTable Bookstore \u003c= 3.5.3 - Cross-Site Request Forgery",
    "slug": "mybooktable",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22301",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Affiliate Platform \u003c 6.5.1 - Reflected Cross-Site Scripting via Banner Editing",
    "slug": "wp-affiliate-platform",
    "type": "plugin",
    "affected_version": "[*, 6.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-5286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5286",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Circle Image Slider With Lightbox \u003c= 1.0.15 - Reflected Cross-Site Scripting",
    "slug": "circle-image-slider-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0648",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Contact Forms by Cimatti \u003c= 1.5.7 - Missing Authorization",
    "slug": "contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35051",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form DB \u003c= 2.8.29 - Cross-site request forgery via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php",
    "slug": "contact-form-7-to-database-extension",
    "type": "plugin",
    "affected_version": "* - 2.8.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-1874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1874",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Affiliates Manager \u003c= 2.9.31 - Cross-Site Request Forgery via multiple AJAX actions",
    "slug": "affiliates-manager",
    "type": "plugin",
    "affected_version": "* - 2.9.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52130",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 4.0.6 - SQL Injection",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 4.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10888",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2085",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "immonex Kickstart \u003c= 1.11.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "immonex-kickstart",
    "type": "plugin",
    "affected_version": "* - 1.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58637",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lightbox Photo Gallery \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "lightbox-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9441",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kalium \u003c= 3.18.3 - Missing Authorization",
    "slug": "kalium",
    "type": "theme",
    "affected_version": "* - 3.18.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53348",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cowidgets – Elementor Addons \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cowidgets-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53786",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ghost Kit \u003c= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ghostkit",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9992",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Genki Pre-Publish Reminder \u003c= 1.4.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "genki-pre-publish-reminder",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1758",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PHP Compatibility Checker \u003c= 1.5.2 - Cross-Site Request Forgery",
    "slug": "php-compatibility-checker",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24421",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced post slider \u003c= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-post-slider",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38750",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chatbox Manager \u003c= 1.2.2 - Missing Authorization",
    "slug": "wa-chatbox-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30790",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Caret Country Access Limit \u003c= 1.0.2 - Cross-Site Request Forgery",
    "slug": "caret-country-access-limit",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45641",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DD Rating \u003c= 1.7.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "dd-rating",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30554",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c 1.4.18 - Multiple Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 1.4.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.18",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-2973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2973",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Advanced iFrame \u003c= 2025.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 2025.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2025.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8089",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Sala \u003c= 1.1.3 - Missing Authorization",
    "slug": "sala",
    "type": "theme",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52803",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Like Button Rating ♥ LikeBtn \u003c= 2.6.44 - Arbitrary e-mail Sending",
    "slug": "likebtn-like-button",
    "type": "plugin",
    "affected_version": "* - 2.6.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0745",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Feeds for YouTube (YouTube video, channel, and gallery plugin) \u003c= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "feeds-for-youtube",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6256",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.39 - Directory Traversal",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-0588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0588",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Backup Guard \u003c= 1.1.46 - Cross-Site Scripting",
    "slug": "backup",
    "type": "plugin",
    "affected_version": "[*, 1.1.47)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.47",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18488",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Favicon \u003c= 1.3.29 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "favicon-by-realfavicongenerator",
    "type": "plugin",
    "affected_version": "* - 1.3.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31422",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Agenda \u003c= 4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "smart-agenda-prise-de-rendez-vous-en-ligne",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22506",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mortgage Calculator Estatik \u003c= 2.0.11 - Reflected Cross-Site Scripting",
    "slug": "estatik-mortgage-calculator",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-40601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40601",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Translate \u003c= 5.3.0 - Missing Authorization",
    "slug": "wp-translate",
    "type": "plugin",
    "affected_version": "* - 5.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35663",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jayj Quicktag \u003c 1.3.2 - Cross-Site Request Forgery",
    "slug": "jayj-quicktag",
    "type": "plugin",
    "affected_version": "[*, 1.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18546",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ABCBiz Addons for Elementor \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "abcbiz-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54247",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54676",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Catch Popup \u003c= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "catch-popup",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11427",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Manager - Resume Manager \u003c= 2.1.0 - Cross-Site Request Forgery",
    "slug": "wp-job-manager-resumes",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37241",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PostX – Gutenberg Blocks for Post Grid \u003c= 2.9.9 - Unauthenticated Cross-Site Scripting",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-36385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36385",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 4.4.5 - Cross-Site Scripting",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 4.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-29171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-29171",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Filebird \u003c= 6.4.2.1 - Authenticated (Author+) Insecure Direct Object Reference",
    "slug": "filebird",
    "type": "plugin",
    "affected_version": "* - 6.4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26977",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form 7 \u003c= 5.9 - Reflected Cross-Site Scripting",
    "slug": "contact-form-7",
    "type": "plugin",
    "affected_version": "* - 5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2242",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "onOffice for WP-Websites \u003c= 6.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "onoffice-for-wp-websites",
    "type": "plugin",
    "affected_version": "* - 6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32127",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "360 Javascript Viewer \u003c= 1.7.11 - Missing Authorization",
    "slug": "360deg-javascript-viewer",
    "type": "plugin",
    "affected_version": "* - 1.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48779",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Creative Image Slider – Responsive Slider Plugin \u003c= 2.1.3 - Reflected Cross-Site Scripting",
    "slug": "creative-image-slider",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30447",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Professional Social Sharing Buttons, Icons \u0026 Related Posts – Shareaholic \u003c= 9.7.5 - Information Disclosure",
    "slug": "shareaholic",
    "type": "plugin",
    "affected_version": "* - 9.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0594",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Mail Subscribe List \u003c= 2.1.3 - Cross-Site Request Forgery",
    "slug": "mail-subscribe-list",
    "type": "plugin",
    "affected_version": "[*, 2.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1603",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-DownloadManager \u003c= 1.68.8 - Reflected Cross-Site Scripting",
    "slug": "wp-downloadmanager",
    "type": "plugin",
    "affected_version": "* - 1.68.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.68.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47341",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fruitful \u003c 3.8.2 - Stored Cross-Site Scripting",
    "slug": "fruitful",
    "type": "theme",
    "affected_version": "[*, 3.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36704",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Authorize.net Add-on for iThemes Exchange \u003c 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "exchange-addon-authorize-net",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9365",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.3",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2014-5240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5240",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.1",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2014-5240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5240",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "low",
    "cve": "CVE-2014-5240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5240",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.3",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2014-5240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5240",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Smart Manager \u003c= 8.52.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "smart-manager-for-wp-e-commerce",
    "type": "plugin",
    "affected_version": "* - 8.52.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.52.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22710",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Envira Gallery Lite \u003c= 1.8.3.2 - Cross-Site Scripting",
    "slug": "envira-gallery-lite",
    "type": "plugin",
    "affected_version": "[*, 1.8.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24126",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print, PDF, Email by PrintFriendly \u003c= 5.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "printfriendly",
    "type": "plugin",
    "affected_version": "* - 5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25032",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress SMTP Service, Email Delivery Solved! — MailHawk \u003c= 1.3.1 - Unauthenticated Local File Inclusion",
    "slug": "mailhawk",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31015",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fancy Product Designer \u003c= 4.6.8 - Unauthenticated Arbitrary File Upload",
    "slug": "fancy-product-designer",
    "type": "plugin",
    "affected_version": "[*, 4.6.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24370",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Integration for Szamlazz.hu \u0026 WooCommerce \u003c= 5.6.3.2 - Cross-Site Request Forgery",
    "slug": "integration-for-szamlazzhu-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.6.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41685",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP e-Commerce Style Email \u003c= 0.6.2 - Reflected Cross-Site Scripting",
    "slug": "wp-e-commerce-style-email",
    "type": "plugin",
    "affected_version": "* - 0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52462",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EMC2 Alert Boxes \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "emc2-alert-boxes",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22365",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spotlightr \u003c= 0.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spotlightr",
    "type": "plugin",
    "affected_version": "* - 0.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11411",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opal Estate Pro \u003c= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'",
    "slug": "opal-estate-pro",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6934",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Profiler – What Slowing Down Your WP \u003c= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via State Restoration",
    "slug": "profiler-what-slowing-down",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5814",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Front End Users \u003c= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "front-end-only-users",
    "type": "plugin",
    "affected_version": "* - 3.2.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7606",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid  \u003c= 5.9.4.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39586",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Seo 301 Meta \u003c= 1.9.1 - Stored Cross-Site Scripting",
    "slug": "seo-301-meta",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0701",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zotpress \u003c= 7.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zotpress",
    "type": "plugin",
    "affected_version": "* - 7.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47621",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "For the visually impaired \u003c= 0.58 - Cross-Site Request Forgery to Plugin Settings Changes",
    "slug": "for-the-visually-impaired",
    "type": "plugin",
    "affected_version": "* - 0.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25038",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Курс валют UAH \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ukrainian-currency",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51593",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ADFO – Custom data in admin dashboard \u003c= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "admin-form",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13390",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Maintenance Mode \u003c= 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49651",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBookit \u003c= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function",
    "slug": "wpbookit",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7852",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MainWP Child Reports \u003c= 2.1.1 - Cross-Site Request Forgery",
    "slug": "mainwp-child-reports",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33680",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Private Files – File Upload \u0026 Download Manager with Secure File Sharing \u003c= 2.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "user-private-files",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13799",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Corsa Theme \u003c= 1.5 - Authenticated Arbitrary File Upload",
    "slug": "corsa",
    "type": "theme",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23970",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8360",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ecwid by Lightspeed Ecommerce Shopping Cart \u003c= 6.12.27 - Cross-Site Request Forgery to Send Deactivation Message",
    "slug": "ecwid-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 6.12.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.12.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13795",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event monster \u003c= 1.4.3 - Information Exposure Via Visitors List Export",
    "slug": "event-monster",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11396",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Affiliate Platform \u003c= 6.3.9 - Reflected Cross-Site Scripting",
    "slug": "wp-affiliate-platform",
    "type": "plugin",
    "affected_version": "* - 6.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3896",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ContentLock \u003c= 1.0.3 - Cross-Site Request Forgery to Settings Update",
    "slug": "contentlock",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6022",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.20",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.20",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.18",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.17",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.8",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.5",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.4",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.17",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.14",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.10",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Authorization Bypass Allowing Post Meta Updates",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.9",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "DTracker \u003c= 1.5 - Authorization Bypass",
    "slug": "dtracker",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1002007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002007",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Visual Composer Website Builder \u003c= 45.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "visualcomposer",
    "type": "plugin",
    "affected_version": "* - 45.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "45.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48276",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Printeers Print \u0026 Ship \u003c= 1.17.0 - Cross-Site Request Forgery",
    "slug": "invition-print-ship",
    "type": "plugin",
    "affected_version": "* - 1.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58224",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Feed for Eventbrite \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "event-feed-for-eventbrite",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58623",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "School Management Pro \u003c= 10.3.4 - Authenticated (School Admin+) SQL Injection",
    "slug": "school-management-pro",
    "type": "plugin",
    "affected_version": "* - 10.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33911",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Store Locator 2.3 - 3.11 - SQL Injection",
    "slug": "store-locator",
    "type": "plugin",
    "affected_version": "[*, 3.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-8621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8621",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Paid Memberships Pro \u003c 2.9.8 - Unauthenticated SQL Injection",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-23488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23488",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Customizr \u003c= 4.3.0 - Cross-Site Request Forgery Bypass",
    "slug": "customizr",
    "type": "theme",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36755",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "History timeline \u003c= 0.7.2 - Reflected Cross-Site Scripting",
    "slug": "history-timeline",
    "type": "plugin",
    "affected_version": "* - 0.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23475",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.8.5 - Authenticated (Subscriber+) Information Disclosure and PHAR deserialization",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4237",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Caddy \u003c= 1.9.7 - Cross-Site Request Forgery",
    "slug": "caddy",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49854",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simplify Contact Management: WP Easy Contact \u003c= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-easy-contact",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5539",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "classyfrieds \u003c= 3.8 - Arbitrary File Upload",
    "slug": "classyfrieds",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24253",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.6.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1394",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1242",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grab \u0026 Save \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "save-grab",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47844",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WishList Member X \u003c= 3.25.1 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "wishlist-member-x",
    "type": "plugin",
    "affected_version": "* - 3.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37106",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BMA Lite \u003c= 1.4.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "bma-lite-appointment-booking-and-scheduling",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39518",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced Floating Content Lite \u003c= 1.2.5 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "advanced-floating-content-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32723",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Customer Area \u003c= 8.2.4 - Cross-Site Request Forgery to Event Log Deletion",
    "slug": "customer-area",
    "type": "plugin",
    "affected_version": "* - 8.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12280",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Namasha By Mdesign \u003c= 1.2.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via playicon_title Parameter",
    "slug": "namasha-by-mdesign",
    "type": "plugin",
    "affected_version": "* - 1.2.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6537",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ListingPro Plugin \u003c= 2.9.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "listingpro-plugin",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-39620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39620",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "MF Gig Calendar \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "mf-gig-calendar",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24510",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inline Related Posts \u003c= 3.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "intelly-related-posts",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6487",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4709",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Oshine Modules \u003c 3.3.8 - Unauthenticated Server-Side Request Forgery",
    "slug": "oshine-modules",
    "type": "plugin",
    "affected_version": "[*, 3.3.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-44055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44055",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Rating \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "simple-rating",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30572",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShiftController Employee Shift Scheduling \u003c= 4.9.64 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "shiftcontroller",
    "type": "plugin",
    "affected_version": "* - 4.9.64",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.64",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44040",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Local Avatars \u003c= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing",
    "slug": "simple-local-avatars",
    "type": "plugin",
    "affected_version": "* - 2.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10786",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Relevanssi – A Better Search \u003c= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update",
    "slug": "relevanssi-premium",
    "type": "plugin",
    "affected_version": "* - 2.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3213",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Relevanssi – A Better Search \u003c= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "* - 4.22.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.22.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3213",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page Builder Gutenberg Blocks – CoBlocks \u003c= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "coblocks",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2369",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Bypass sanitize_file_name Protection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.2",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-5839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Bypass sanitize_file_name Protection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.12",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-5839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Bypass sanitize_file_name Protection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.11",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-5839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Bypass sanitize_file_name Protection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.8",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-5839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Bypass sanitize_file_name Protection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.4",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-5839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Bypass sanitize_file_name Protection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-5839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Bypass sanitize_file_name Protection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.14",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-5839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Bypass sanitize_file_name Protection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.14",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-5839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Bypass sanitize_file_name Protection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.11",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-5839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Bypass sanitize_file_name Protection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.3",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-5839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5839",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Meks Flexible Shortcodes \u003c= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "meks-flexible-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4562",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailUp newsletter sign-up form \u003c 1.3.3 - Cross-Site Scripting",
    "slug": "wp-mailup",
    "type": "plugin",
    "affected_version": "[*, 1.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-0731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-0731",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Poster \u003c= 1.2 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "auto-poster",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31345",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Youtube Video Grid \u003c= 1.9 - Cross-Site Request Forgery",
    "slug": "youmax-channel-embeds-for-youtube-businesses",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54408",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields Pro \u003c= 5.9.0 - Reflected Cross-Site Scripting",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "[*, 5.9.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24241",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor \u003c= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.30.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.30.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8081",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Gratisfaction \u003c= 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29798",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Banhammer – Monitor Site Traffic, Block Bad Users and Bots \u003c= 3.4.8 - Unauthenticated Protection Mechanism Bypass",
    "slug": "banhammer",
    "type": "plugin",
    "affected_version": "* - 3.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10745",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ts-tree \u003c= 0.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "ts-tree",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23515",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bloog \u003c= 1.1 - Cross-Site Scripting",
    "slug": "Blooog-v1.1",
    "type": "theme",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-7129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7129",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ditty – Responsive News Tickers, Sliders, and Lists \u003c= 3.1.38 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.38",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3954",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP ERP \u003c= 1.13.4 - Missing Authorization",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.13.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30896",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "My Calendar \u003c= 3.4.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "my-calendar",
    "type": "plugin",
    "affected_version": "* - 3.4.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25916",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Human Resource Management \u003c 2.2.6 - Sensitive Information Disclosure",
    "slug": "hrm",
    "type": "plugin",
    "affected_version": "[*, 2.2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-9574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9574",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WPCargo Track \u0026 Trace \u003c= 8.0.1 - Unauthenticated SQL Injection",
    "slug": "wpcargo",
    "type": "plugin",
    "affected_version": "* - 8.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-44004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44004",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Slideshow Gallery \u003c= 1.7.8 - Cross-Site Request Forgery",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31354",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Sort\u0026Search \u003c= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-sortsearch",
    "type": "plugin",
    "affected_version": "* - 0.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24433",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dino Game – Embed Google Chrome Dinosaur Game in WordPress \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dino-game",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11388",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 3.2.4 - Unauthenticated Arbitrary File Deletion",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8141",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Piotnet Addons For Elementor \u003c= 2.4.32 - Authenticated (Contributor+) Post Disclosure",
    "slug": "piotnet-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10775",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.87 - Cross-Site Request Forgery via add_to_wishlist",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.87",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.87",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0512",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.11.16 - Authenticated (Editor+) PHP Object Injection",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.11.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54012",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Houzez \u003c= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "houzez",
    "type": "theme",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22303",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Small Package Quotes – Worldwide Express Edition \u003c= 5.2.17 - Unauthenticated SQL Injection",
    "slug": "small-package-quotes-wwe-edition",
    "type": "plugin",
    "affected_version": "* - 5.2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24667",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce \u003c 4.7.0 - Insecure Direct Object Reference via order_id Parameter",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "[*, 4.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-29156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-29156",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Pix 4x sem juros - Pagaleve \u003c= 1.6.9 - Unauthenticated PHP Object Injection",
    "slug": "wc-pagaleve",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48287",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YouTube Simple Gallery \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "youtube-simple-gallery",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29011",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode \u003c= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "chat-viber",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12457",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GetResponse Forms \u003c= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "getresponse",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59549",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile Contact Bar \u003c= 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mobile-contact-bar",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12739",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "B Slider \u003c= 1.1.30 - Missing Authorization",
    "slug": "b-slider",
    "type": "plugin",
    "affected_version": "* - 1.1.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54734",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Homey - Booking and Rentals WordPress Theme \u003c= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation \u0026 Post Deletion",
    "slug": "homey",
    "type": "theme",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1326",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Link Directory \u003c 14.8.1 - Reflected Cross-Site Scripting",
    "slug": "qc-simple-link-directory",
    "type": "plugin",
    "affected_version": "[*, 14.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-48297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48297",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder by AZEXO \u003c= 1.27.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "page-builder-by-azexo",
    "type": "plugin",
    "affected_version": "* - 1.27.133",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.133",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3051",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Share Buttons – Social Media \u003c= 1.0.2 - Unauthenticated SQL Injection",
    "slug": "rich-web-share-button",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-55982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55982",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.11",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.11",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.19",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.19",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.10",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.9",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.5",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.1",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.21",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.21",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.21",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.21",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.18",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.18",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.18",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.18",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Open Redirect in Admin Dashboard",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.15",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.15",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2017-14725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14725",
    "auth_type": "Privileged",
    "cvss_score": 3.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Hummingbird \u003c= 3.9.1 - Missing Authorization",
    "slug": "hummingbird-performance",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43118",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) \u003c= 4.4.9 - Missing Authorization to Unauthenticated Price, Date, and Note Updates",
    "slug": "gift-voucher",
    "type": "plugin",
    "affected_version": "* - 4.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13520",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RevivePress – Keep your Old Content Evergreen \u003c= 1.5.6 - Missing Authorization",
    "slug": "wp-auto-republish",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1844",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProductDyno \u003c= 1.0.24 - Reflected Cross-Site Scripting",
    "slug": "productdyno",
    "type": "plugin",
    "affected_version": "* - 1.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22320",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jupiter Theme \u003c= 6.10.1 - Authenticated Arbitrary Plugin Deletion",
    "slug": "jupiter",
    "type": "theme",
    "affected_version": "* - 6.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1658",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Custom Dash \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "custom-dash",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4942",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lead Form Data Collection to CRM \u003c= 3.0.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-leads-builder-any-crm",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30810",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.8 - Dependency Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 5.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-44223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-44223",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Htaccess File Editor \u003c= 1.0.18 - Missing Authorization",
    "slug": "htaccess-file-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49256",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 4.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1649",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category Icon \u003c= 1.0.2 - Authenticated (Author+) XML External Entity Injection",
    "slug": "category-icon",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31039",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Gwyn's Imagemap Selector \u003c= 0.3.3 - Reflected Cross-Site Scripting",
    "slug": "gwyns-imagemap-selector",
    "type": "plugin",
    "affected_version": "* - 0.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1221",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KingComposer \u003c= 2.8 - Reflected Cross-Site Scripting",
    "slug": "kingcomposer",
    "type": "plugin",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-9910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9910",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Renaming on Upload \u003c= 2.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "file-renaming-on-upload",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2684",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Manager for WooCommerce \u003c= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'mep_get_option' function",
    "slug": "mage-eventpress",
    "type": "plugin",
    "affected_version": "* - 3.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28422",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conversational Forms for ChatBot \u003c= 1.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "conversational-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23981",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wptf-image-gallery \u003c= 1.0.3 - Arbitrary File Download",
    "slug": "wptf-image-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-1000007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000007",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Menu Plugin — Superfly Responsive Menu \u003c= 5.0.25 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "superfly-menu",
    "type": "plugin",
    "affected_version": "* - 5.0.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32553",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MDR Webmaster Tools \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mdr-webmaster-tools",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51640",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) \u003c= 2.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "ai-scribe-the-chatgpt-powered-seo-content-creation-wizard",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12473",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Material Design Icons \u003c= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon Shortcode",
    "slug": "material-design-icons",
    "type": "plugin",
    "affected_version": "* - 0.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9024",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailMunch – Grow your Email List \u003c= 3.1.8 - Reflected Cross-Site Scripting",
    "slug": "mailmunch",
    "type": "plugin",
    "affected_version": "* - 3.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8735",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Amazon Affiliates - Wordpress Plugin \u003c= 14.0.10 - Unauthenticated SQL Injection",
    "slug": "woozone",
    "type": "plugin",
    "affected_version": "* - 14.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.0.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33544",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "CM Table Of Contents \u003c= 1.2.2 - Cross-Site Request Forgery",
    "slug": "cm-table-of-content",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5030",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Glass \u003c= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "glass",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24434",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Alt Renamer  0.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via _wp_attachment_image_alt postmeta",
    "slug": "media-alt-renamer",
    "type": "plugin",
    "affected_version": "0.0.1",
    "from_version": "0.0.1",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1434",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Push Notifications \u003c= 1.1.9 - Missing Authorization",
    "slug": "ultimate-push-notifications",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50028",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MapSVG Lite \u003c= 8.6.4 - Missing Authorization",
    "slug": "mapsvg-lite-interactive-vector-maps",
    "type": "plugin",
    "affected_version": "* - 8.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32684",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Transposh WordPress Translation \u003c= 1.0.9.1 -  Cross-Site Request Forgery",
    "slug": "transposh-translation-filter-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24912",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPGYM \u003c= 65.0 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "gym-management",
    "type": "plugin",
    "affected_version": "* - 65.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "65.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32549",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Restaurant Table Booking \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "easy-table-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4083",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 8.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27966",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flat UI Button \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode",
    "slug": "flat-ui-button",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10014",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Norse Rune Oracle Plugin \u003c= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "norse-runes-oracle",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31884",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CoSchedule \u003c= 3.3.11 - Unauthenticated Sensitive Information Exposure",
    "slug": "coschedule-by-todaymade",
    "type": "plugin",
    "affected_version": "* - 3.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60119",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Pro \u003c= 5.0.6 - Sensitive Data Disclosure",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "[*, 5.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24948",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MyBrain Utilities \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mybrain-utilities",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10126",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rencontre – Dating Site \u003c= 3.1.2 - SQL Injection",
    "slug": "rencontre",
    "type": "plugin",
    "affected_version": "[*, 3.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-13413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13413",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slides \u0026 Presentations \u003c= 0.0.39 - Missing Authorization to Content Injection",
    "slug": "slide",
    "type": "plugin",
    "affected_version": "* - 0.0.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23919",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Export any WordPress data to XML/CSV \u003c= 1.3.4 - Authenticated SQL Injection",
    "slug": "wp-all-export",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1800",
    "auth_type": "Privileged",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L"
  },
  {
    "title": "woo-popup \u003c= 1.2.2 - Reflecte Cross-Site Scripting",
    "slug": "woo-popup",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10095",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow Gallery LITE \u003c= 1.7.6 - Authenticated(Admin+) SQL Injection",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28491",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "WP Links Page \u003c= 4.9.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-links-page",
    "type": "plugin",
    "affected_version": "* - 4.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10175",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Timeline Block \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "timeline-block-block",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26754",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.0.9 - Cross-Site Request Forgery to Arbitrary Transaction Deletion",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "[*, 4.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0681",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Conditional Shipping for WooCommerce \u003c= 3.4.0 - Cross-Site Request Forgery",
    "slug": "conditional-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39564",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cozy Blocks \u003c= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cozy-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47355",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47355",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plainview Activity Monitor \u003c 20180826 - Remote Command Injection",
    "slug": "plainview-activity-monitor",
    "type": "plugin",
    "affected_version": "[*, 20180826)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20180826",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-15877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-15877",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 \u0026 4, Ultra-Customizable \u003c= 1.6.82 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "[*, 1.6.83)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.83",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2580",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "List of Posts from each Category plugin for WordPress \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "list-posts-by-category",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28894",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme Importer \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "theme-importer",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10312",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ShareThis Dashboard for Google Analytics \u003c= 2.5.1 - Reflected Cross-Site Scripting via ga_action parameter",
    "slug": "googleanalytics",
    "type": "plugin",
    "affected_version": "[*, 2.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24438",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme \u003c= 2.9.4 - Reflected Cross-Site Scripting",
    "slug": "kingcomposer",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-15299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-15299",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GTmetrix for WordPress \u003c= 0.4.5 - Reflected Cross-Site Scripting via 'url'",
    "slug": "gtmetrix-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 0.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23677",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stratum – Elementor Widgets \u003c= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot Widget",
    "slug": "stratum",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13642",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SupportCandy – Helpdesk \u0026 Customer Support Ticket System \u003c= 3.3.7 - Authentication Bypass to Support Session Takeover",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "* - 3.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10658",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Don8 \u003c= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "don8",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32582",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Field Template \u003c= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "custom-field-template",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6745",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6745",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Boostify Header Footer Builder for Elementor \u003c= 1.3.6 - Authenticated (Contributor+) Post Disclosure",
    "slug": "boostify-header-footer-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10794",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "LadiApp \u003c= 4.3 - Missing Authorization",
    "slug": "ladipage",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49158",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stagtools \u003c= 2.3.7 - Reflected Cross-Site Scripting",
    "slug": "stagtools",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41868",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One \u003c= 1.1.6 - Cross-Site Request Forgery",
    "slug": "ai-content-writing-assistant",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45063",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.6 - Cross-Site Request Forgery",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36854",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Field Template \u003c= 2.5.9 - Reflected Cross-Site Scripting",
    "slug": "custom-field-template",
    "type": "plugin",
    "affected_version": "* - 2.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38392",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seraphinite Accelerator Premium \u003c= 2.21.13 - Cross-Site Request Forgery to Arbitrary File Deletion",
    "slug": "seraphinite-accelerator-ext",
    "type": "plugin",
    "affected_version": "* - 2.21.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.21.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37940",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons for Elementor \u003c= 2.2.0 - Missing Authorization to Privilege Escalation",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 2.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-37999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37999",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Go Maps (formerly WP Google Maps) \u003c= 9.0.48 - Unauthenticated Cache Poisoning",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11703",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ARMember \u003c= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33323",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HashBar – WordPress Notification Bar \u003c= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "hashbar-wp-notification-bar",
    "type": "plugin",
    "affected_version": "[*, 1.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-51372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51372",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Configurator for WooCommerce \u003c= 1.2.31 - Arbitrary File Deletion",
    "slug": "expivi",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1953",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.2.10 - Authenticated SQL Injection via asc_or_desc Parameter",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.2.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-1393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1393",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Weblizar Pin Feeds \u003c 1.1.2 - Cross-Site Scripting",
    "slug": "weblizar-pinterest-feeds",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5655",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XStore Core \u003c= 5.3.8 - Reflected Cross-Site Scripting",
    "slug": "et-core-plugin",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33554",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forms by CaptainForm \u003c= 2.5.3 - Reflected Cross-Site Scripting via REQUEST_URI",
    "slug": "captainform",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49170",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks – Page Builder Gutenberg Blocks, Patterns \u0026 Templates \u003c= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5595",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.5.1.8 - Cross-Site Scripting",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.5.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-1002005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1002005",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IDonatePro \u003c= 2.1.8 - Unauthenticated Local File Inclusion",
    "slug": "idonate-pro",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30635",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ImbaChat \u003c= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "imbachat-widget",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52502",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixabay Images \u003c= 2.3 - Directory Traversal",
    "slug": "pixabay-images",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-1365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1365",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Google Maps Easy \u003c= 1.9.33 - Stored Cross-Site Scripting",
    "slug": "google-maps-easy",
    "type": "plugin",
    "affected_version": "* - 1.9.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39346",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming soon and Maintenance mode \u003c= 3.5.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "coming-soon-page",
    "type": "plugin",
    "affected_version": "[*, 3.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24577",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Typing Effect \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "animated-typing-effect",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40605",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes and extra features for Phlox theme \u003c= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer",
    "slug": "auxin-elements",
    "type": "plugin",
    "affected_version": "* - 2.17.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7064",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SMS Alert Order Notifications – WooCommerce \u003c= 3.8.1 - Unauthenticated SQL Injection",
    "slug": "sms-alert",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47682",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Change WP Admin Login \u003c= 1.0.9 - Missing Authorization Checks",
    "slug": "change-wp-admin-login",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1589",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N"
  },
  {
    "title": "Image Hover Effects Ultimate \u003c= 9.6.1 - Unauthenticated Arbitrary Options Update",
    "slug": "image-hover-effects-ultimate",
    "type": "plugin",
    "affected_version": "* - 9.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-36888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36888",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Invoice – Web Invoice and Billing \u003c= 4.1.0 - Missing Authorization",
    "slug": "wp-invoice",
    "type": "plugin",
    "affected_version": "[*, 4.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-11009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11009",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Linkz.ai \u003c= 1.1.8 - Missing Authorization to Unauthenticated Plugin Settings Update",
    "slug": "linkz-ai",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9586",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "ThinkTwit \u003c 1.7.1 - Stored Cross-Site Scripting",
    "slug": "thinktwit",
    "type": "plugin",
    "affected_version": "[*, 1.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24582",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CP Contact Form with PayPal \u003c= 1.3.01 - Cross-Site Scripting",
    "slug": "cp-contact-form-with-paypal",
    "type": "plugin",
    "affected_version": "* - 1.3.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14784",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP HTML Mail \u003c= 3.4.0 - Cross-Site Request Forgery via 'send_test'",
    "slug": "wp-html-mail",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40202",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Edwiser Bridge \u003c= 3.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "edwiser-bridge",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49311",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Engine \u003c= 6.2.5 - Authenticated (Author+) Insecure Direct Object Reference in ajax_generate_auth_token",
    "slug": "wplr-sync",
    "type": "plugin",
    "affected_version": "* - 6.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38513",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form, Survey, Quiz \u0026 Popup Form Builder – ARForms \u003c= 1.7.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "arforms-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10504",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.24.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11613",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Invoice – Web Invoice and Billing \u003c= 4.1.0 - Unauthorized Settings Change",
    "slug": "wp-invoice",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-11006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11006",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "UsersWP – Front-end login form, User Registration, User Profile \u0026 Members Directory plugin for WP \u003c= 1.2.44 - Authenticated (Subscriber+) SQL Injection",
    "slug": "userswp",
    "type": "plugin",
    "affected_version": "* - 1.2.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10003",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c= 3.6.7 - Admin+ Malicious File Upload",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1565",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Optimize More! – CSS \u003c= 1.0.3 - Cross-Site Request Forgery to Plugin Settings Reset",
    "slug": "optimize-more-css",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9945",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Affiliates Manager \u003c= 2.9.13 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "affiliates-manager",
    "type": "plugin",
    "affected_version": "* - 2.9.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2799",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CaptionPix \u003c= 1.8 - Reflected Cross-Site Scripting",
    "slug": "captionpix",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52788",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \u003c= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1720",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WC Fields Factory \u003c= 4.1.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "wc-fields-factory",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0277",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0277",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lana Text to Image \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "lana-text-to-image",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3387",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Event Manager \u003c= 3.1.51 - Unauthenticated Local File Inclusion",
    "slug": "wp-event-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.51",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48125",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Cross-Site Request Forgery via ajax_add_folder",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0724",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13217",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Mobilize \u003c= 3.0.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mobilize",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51649",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Restaurant Menu \u003c= 2.0.2 - Missing Authorization",
    "slug": "quick-restaurant-menu",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0555",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Contact Form Master \u003c= 1.0.7 - Reflected Cross-Site Scripting",
    "slug": "contact-form-master",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12587",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Community Events \u003c= 1.4.7 - Reflected Cross-Site Scripting",
    "slug": "community-events",
    "type": "plugin",
    "affected_version": "[*, 1.4.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24496",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.2.0 - Missing Authorization via REST API",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3133",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MP3-jPlayer \u003c= 2.4.2 - Full Path Disclosure",
    "slug": "mp3-jplayer",
    "type": "plugin",
    "affected_version": "[*, 2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-1000008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000008",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "LTL Freight Quotes – Unishippers Edition \u003c= 2.5.8 - Reflected Cross-Site Scripting",
    "slug": "ltl-freight-quotes-unishippers-edition",
    "type": "plugin",
    "affected_version": "* - 2.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22284",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Carousel For WooCommerce – WoorouSell \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woorousell",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Revolution \u003c= 6.6.12 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.6.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2359",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kish Guest Posting \u003c= 1.2 - Unauthenticated Arbitrary File Upload",
    "slug": "kish-guest-posting",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-5318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5318",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Variation Swatches for WooCommerce \u003c= 2.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "product-variation-swatches-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-42367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 5.3.6 - Multiple Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 5.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-7480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7480",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Find And Replace content for WordPress \u003c= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting",
    "slug": "find-and-replace-content",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10313",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seamless Donations: A Platform for Global Fundraising and Rebuilding using Stripe and PayPal \u003c= 5.1.7 - Cross-Site Request Forgery to Settings Chage",
    "slug": "seamless-donations",
    "type": "plugin",
    "affected_version": "* - 5.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1610",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Feedback \u003c= 1.0.7 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "userfeedback-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-39308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39308",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Youtube Gallery \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "wp-youtube-gallery",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12590",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Live Chat Support \u003c= 8.0.15 - Cross-Site Scripting",
    "slug": "wp-live-chat-support",
    "type": "plugin",
    "affected_version": "* - 8.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-18460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-18460",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Layer Slider \u003c= 1.1.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "slider-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47228",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tag Miner (Automatic Tag Extraction) \u003c 1.1.5 - Cross-Site Request Forgery",
    "slug": "fossura-tag-miner",
    "type": "plugin",
    "affected_version": "[*, 1.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10978",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YaySMTP – Simple WP SMTP Mail  \u003c= 2.2 - Sensitive Information Disclosure",
    "slug": "yaysmtp",
    "type": "plugin",
    "affected_version": "2.2",
    "from_version": "2.2",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2369",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue \u003c= 3.1.82 - Cross-Site Request Forgery",
    "slug": "mailin",
    "type": "plugin",
    "affected_version": "* - 3.1.82",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.82",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43287",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Animated Counters \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "animated-counters",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5774",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.7.1003 - Authenticated (Contributor+) Post Disclosure",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1003",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1003",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10798",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Login With Ajax \u003c 3.1 - Cross-Site Request Forgery",
    "slug": "login-with-ajax",
    "type": "plugin",
    "affected_version": "[*, 3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-2707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2707",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "SKT Addons for Elementor \u003c= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "skt-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8564",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Database Backup \u003c= 4.3 - Cross-Site Request Forgery",
    "slug": "wp-database-backup",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10876",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OneClick Chat to Order \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "oneclick-whatsapp-order",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29789",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "If-So Dynamic Content Personalization \u003c= 1.6.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "if-so",
    "type": "plugin",
    "affected_version": "* - 1.6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51492",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada | Website Builder For WordPress \u0026 WooCommerce \u003c= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.11.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.11.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1468",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Featured Image Generator \u003c= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Upload",
    "slug": "featured-image-generator",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5677",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MyTicket Events \u003c= 1.2.4 - Unauthenticated Limited File Read",
    "slug": "myticket-events",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27299",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses \u003c= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update",
    "slug": "wp-courses",
    "type": "plugin",
    "affected_version": "* - 3.2.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12172",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "FileOrganizer \u003c= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion",
    "slug": "fileorganizer",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11010",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Notification – Custom Notifications and Alerts for WordPress \u003c= 7.2.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "notification",
    "type": "plugin",
    "affected_version": "* - 7.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39340",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Matomo Integration (WP-Piwik) \u003c= 1.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-piwik",
    "type": "plugin",
    "affected_version": "* - 1.0.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4774",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI WP Writer \u003c= 3.8.4.4 - Cross-Site Request Forgery",
    "slug": "ai-wp-writer",
    "type": "plugin",
    "affected_version": "* - 3.8.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22297",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP ERP \u003c= 1.12.6 - Missing Authorization via admin notice dismissal",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.12.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45765",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Team Members \u003c= 5.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "team-members",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1568",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Language Switcher \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "easy-language-switcher",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56029",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BlindMatrix e-Commerce = 3.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "window-blinds-solution",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10406",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form Integrated With Google Maps 1.0 - 2.4 - Stored Cross-Site Scripting",
    "slug": "contact-form-integrated-with-google-maps",
    "type": "plugin",
    "affected_version": "1.0 - 2.4",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-7238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7238",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – Limb Image Gallery \u003c= 1.5.7 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "limb-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49260",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Markup Markdown \u003c= 3.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "markup-markdown",
    "type": "plugin",
    "affected_version": "* - 3.20.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49420",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 2.12.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6187",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Motors – Car Dealer, Classifieds \u0026 Listing \u003c= 1.4.9 - Missing Authorization",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5545",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WpTravelly \u003c= 1.8.7 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "tour-booking-manager",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30892",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Aviation Weather from NOAA \u003c= 0.7.2 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "aviation-weather-from-noaa",
    "type": "plugin",
    "affected_version": "* - 0.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28980",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Order Export \u0026 Order Import for WooCommerce \u003c= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function",
    "slug": "order-import-export-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13923",
    "auth_type": "Privileged",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Combo WP Rewrite Slugs \u003c= 1.0 - Missing Authorization to Authenticated (Subscriber+) Settings Change",
    "slug": "combo-wp-rewrite-slugs",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51817",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LambertGroup - AllInOne - Content Slider \u003c= 3.8 - Authenticated (Contributor+) SQL Injection",
    "slug": "all-in-one-contentSlider",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60109",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.18 - Reflected Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45070",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media File Renamer \u003c= 5.7.7 - Authenticated(Administrator+) Remote Code Execution",
    "slug": "media-file-renamer",
    "type": "plugin",
    "affected_version": "* - 5.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50897",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smartsupp – live chat, chatbots, AI and lead generation \u003c= 3.6 - Cross-Site Request Forgery",
    "slug": "smartsupp-live-chat",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38790",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FormCraft - Premium WordPress Form Builder \u003c= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload",
    "slug": "formcraft3",
    "type": "plugin",
    "affected_version": "* - 3.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0817",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp advertising management \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "advertising-management",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22358",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prenotazioni \u003c= 1.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "prenotazioni",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31102",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CM Registration and Invitation Codes \u003c= 2.5.5 - Missing Authorization",
    "slug": "cm-invitation-codes",
    "type": "plugin",
    "affected_version": "* - 2.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32210",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress \u003c= 2.0.73 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "* - 2.0.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32506",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Testimonial Builder \u003c= 1.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "testimonial-builder",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36857",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Browser Screenshots \u003c 1.7.6 - Stored Cross-Site Scripting",
    "slug": "browser-shots",
    "type": "plugin",
    "affected_version": "[*, 1.7.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24439",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OAuth Single Sign On – SSO (OAuth Client) \u003c= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()",
    "slug": "miniorange-login-with-eve-online-google-facebook",
    "type": "plugin",
    "affected_version": "* - 6.26.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.26.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-9485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9485",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.18",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.18",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.11",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.10",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.9",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.5",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.21",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.15",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.1",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.21",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.19",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Hide \u0026 Security Enhancer \u003c= 1.7.9.2 - Reflected Cross-Site Scripting",
    "slug": "wp-hide-security-enhancer",
    "type": "plugin",
    "affected_version": "* - 1.7.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2538",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JoomSport – for Sports: Team \u0026 League, Football, Hockey \u0026 more \u003c 3.4 - SQL Injection",
    "slug": "joomsport-sports-league-results-management",
    "type": "plugin",
    "affected_version": "[*, 3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-14348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14348",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Add to Cart Custom Redirect \u003c= 1.2.13 - Authenticated(Contributor+) Missing Authorization to Limited Arbitrary Options Update",
    "slug": "woocommerce-add-to-cart-custom-redirect",
    "type": "plugin",
    "affected_version": "* - 1.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1862",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.29 - Cross-Site Request Forgery",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1162",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Broken Link Checker \u003c= 2.4.1 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "broken-link-checker",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10903",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Transition Slider – Responsive Image Slider and Gallery \u003c= 2.20.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "transition-slider-lite",
    "type": "plugin",
    "affected_version": "* - 2.20.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37215",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pods \u003c= 2.7.26 - Authenticated Stored Cross-Site Scripting via Menu Label field",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "2.4.4.2 - 2.7.26",
    "from_version": "2.4.4.2",
    "from_inclusive": true,
    "to_version": "2.7.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24339",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Great Quotes \u003c= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "great-quotes",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24785",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visualizer \u003c= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23708",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Directory Free \u003c= 1.7.1 - Reflected Cross-Site Scripting",
    "slug": "web-directory-free",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3669",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ERP \u003c= 1.13.3 - Authenticated (Employee+) Insecure Direct Object Reference",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12812",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Popup by Supsystic \u003c= 1.10.18 - Prototype Pollution",
    "slug": "popup-by-supsystic",
    "type": "plugin",
    "affected_version": "[*, 1.10.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.19",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-3186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3186",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Client Invoicing by Sprout Invoices – Easy Estimates and Invoices \u003c= 20.8.1 - Missing Authorization",
    "slug": "sprout-invoices",
    "type": "plugin",
    "affected_version": "* - 20.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24606",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "REST API TO MiniProgram \u003c= 4.7.1 - Cross-Site Request Forgery",
    "slug": "rest-api-to-miniprogram",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28886",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page Builder by AZEXO \u003c= 1.27.133 - Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_save",
    "slug": "page-builder-by-azexo",
    "type": "plugin",
    "affected_version": "* - 1.27.133",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.133",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3055",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Posts List Designer by Category \u003c= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptiong via Shortcode",
    "slug": "post-list-designer",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4749",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReDi Restaurant Reservation \u003c= 23.0211 - Missing Authorization",
    "slug": "redi-restaurant-reservation",
    "type": "plugin",
    "affected_version": "* - 23.0211",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "23.0211",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36510",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1413",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smooth Dynamic Slider \u003c= 1.0 - Reflected Cross-Site Scriptign",
    "slug": "smooth-dynamic-slider",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23447",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Change Uploaded File Permissions \u003c= 4.0.0 - Cross-Site Request Forgery to Options Update",
    "slug": "change-uploaded-file-permissions",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1788",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessAlly \u003c= 3.5.6 - Information Exposure",
    "slug": "accessally",
    "type": "plugin",
    "affected_version": "* - 3.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24226",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Small Package Quotes – Worldwide Express Edition \u003c= 5.2.18 - Unauthenticated SQL Injection",
    "slug": "small-package-quotes-wwe-edition",
    "type": "plugin",
    "affected_version": "* - 5.2.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13534",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress-to-candidate for Salesforce CRM \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "salesforce-wordpress-to-candidate",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23657",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoho SalesIQ \u003c= 1.0.8 - Cross-Site Request Forgery",
    "slug": "zoho-salesiq",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-5963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5963",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Thank You Counter Button \u003c= 1.9.3 - Cross-Site Scripting",
    "slug": "thanks-you-counter-button",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-2315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2315",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leyka \u003c= 3.30.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "[*, 3.30.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.30.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2995",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Alpine PhotoTile for Instagram \u003c 1.2.7.6 - Reflected Cross-Site Scripting",
    "slug": "alpine-photo-tile-for-instagram",
    "type": "plugin",
    "affected_version": "[*, 1.2.7.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9432",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rehub \u003c= 19.6.1 - Authenticated (Editor+) Local File Inclusion",
    "slug": "rehub-theme",
    "type": "theme",
    "affected_version": "* - 19.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-31232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31232",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Product Vendors \u003c= 2.2.2 - Missing Authorization",
    "slug": "woocommerce-product-vendors",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52186",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c 5.5.7 - Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "[*, 5.5.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9300",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobify - Job Board WordPress Theme \u003c= 4.2.3 - Cross-Site Request Forgery",
    "slug": "jobify",
    "type": "theme",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52479",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Content Cards \u003c= 0.9.6 - Cross-Site Scripting",
    "slug": "content-cards",
    "type": "plugin",
    "affected_version": "* - 0.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17096",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookiebot \u003c= 4.5.8 - Cross-Site Request Forgery",
    "slug": "cookiebot",
    "type": "plugin",
    "affected_version": "* - 4.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53197",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Urna \u003c= 2.5.7 - Unauthenticated Local File Inclusion",
    "slug": "urna",
    "type": "theme",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54689",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cloak Front End Email \u003c= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "cloak-front-end-email",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0150",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoice Builder \u003c= 1.2.90 - Cross-Site Request Forgery via Save",
    "slug": "woo-pdf-invoice-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.90",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.90",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3764",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Piotnet Addons For Elementor Pro \u003c= 7.1.17 - Missing Authorization to Arbitrary Post/Page Deletion",
    "slug": "piotnet-addons-for-elementor-pro",
    "type": "plugin",
    "affected_version": "* - 7.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33635",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Art Direction \u003c= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "art-direction",
    "type": "plugin",
    "affected_version": "* - 0.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37983",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "mcjh button shortcode \u003c= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mcjh-button-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22558",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6976",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "7.0.1 - 7.0.3",
    "from_version": "7.0.1",
    "from_inclusive": true,
    "to_version": "7.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6976",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "affiliate-toolkit \u003c= 3.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via ratings",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29817",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29817",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeproDev CF7 Database \u003c= 1.8.0 - Cross-Site Request Forgery",
    "slug": "pepro-cf7-database",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41864",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Activation Email \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "user-activation-email",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38325",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BeePress \u003c= 6.9.8 - Cross-Site Request Forgery via beepress-pro.php",
    "slug": "beepress",
    "type": "plugin",
    "affected_version": "* - 6.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27197",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Visualizer: Tables and Charts Manager for WordPress \u003c= 3.10.15 - Missing Authorization to Arbitrary SQL Execution",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.10.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3750",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Button Block – Get fully customizable \u0026 multi-functional buttons \u003c= 1.1.4 - Authenticated (Contributor+) Post Disclosure",
    "slug": "button-block",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10671",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Sync Post With Other Site \u003c= 1.6 - Missing Authorization to Authenticated (Subscriber+) Post Creation and Update",
    "slug": "sync-post-with-other-site",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6709",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Widget Responsive for Youtube \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "youtube-widget-responsive",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5063",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Contact Form \u003c= 8.0.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quick-contact-form",
    "type": "plugin",
    "affected_version": "* - 8.0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23885",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram Collect \u003c= 1.3.8 - Authenticated(Contributor+) Cross-Site Scripting via Shortcode",
    "slug": "icegram-rainmaker",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25024",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coupon Referral Program \u003c= 1.8.3 - Unauthenticated PHP Object Injection",
    "slug": "coupon-referral-program",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-25100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25100",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Formzu WP \u003c= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "formzu-wp",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22310",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Repost \u003c= 0.1 - Missing Authorization",
    "slug": "wp-repost",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26522",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.1.7.1 - Unauthenticated PHP Object Injection",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-3360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3360",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Magazine \u003c= 1.2.2 - Unauthenticated Local File Inclusion",
    "slug": "eximious-magazine",
    "type": "theme",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53248",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Team \u003c= 5.0.6 - Missing Authorization",
    "slug": "tlp-team",
    "type": "plugin",
    "affected_version": "* - 5.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57975",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WPGuppy \u003c= 1.1.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wpguppy-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56280",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BU Section Editing \u003c= 0.9.9 - Reflected Cross-Site Scripting",
    "slug": "bu-section-editing",
    "type": "plugin",
    "affected_version": "* - 0.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56018",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cerber Security, Anti-spam \u0026 Malware Scan \u003c 2.7 - Stored Cross-Site Scripting",
    "slug": "wp-cerber",
    "type": "plugin",
    "affected_version": "[*, 2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-10990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10990",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Markup Markdown \u003c= 3.20.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "markup-markdown",
    "type": "plugin",
    "affected_version": "* - 3.20.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Hero \u003c= 8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "slider-hero",
    "type": "plugin",
    "affected_version": "* - 8.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29922",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "reviews-feed",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8200",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Abstracts \u003c= 2.6.2 - Cross-Site Request Forgery",
    "slug": "wp-abstracts-manuscripts-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36517",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons \u003c= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 26.0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.0.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1513",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shipmozo Courier Tracking \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "webparex",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27293",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comment Reply Email \u003c= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "comment-reply-email",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45008",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SHOUT \u003c= 3.5.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "lbg-audio8-html5-radio_ads",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31637",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.3.4 - Account Takeover via Password Reset",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-41956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41956",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SMSA Shipping(official) \u003c= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "smsa-shipping-official",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12066",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IdeaPush \u003c= 8.71 - Missing Authorization to Board Term Deletion",
    "slug": "ideapush",
    "type": "plugin",
    "affected_version": "* - 8.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11844",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AutoWP \u003c= 2.0.8 - Cross-Site Request Forgery",
    "slug": "autowp-ai-content-writer-rewriter",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54300",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Blocks \u003c= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47493",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "amp-extensions",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "venture-event-manager",
    "type": "plugin",
    "affected_version": "[*, 3.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "flight-search-widget-blocks",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "stars-menu",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "yandex-money-button",
    "type": "plugin",
    "affected_version": "[*, 2.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "disable-image-right-click",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "seo-dashboard-by-gutewebsites-de",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "icons-with-links-widget",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "woo-whatsapp-request-quote",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "woosaleskit-bar",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "tr-easy-google-analytics",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "media-mirror",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "custom-scroll-bar-designer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "popup-modal-for-youtube",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "cool-facebook-page-feed-timeline",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "cf7-customizer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "exit-popup-show",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "border-loading-bar",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "custom-text-selection-colors",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "easy-google-map",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "seatgeek-affiliate-tickets",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "titan-framework",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "adblock-notify-by-bweb",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "live-chat-facebook-fanpage",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "woo-availability-date",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "email-my-posts",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "easy-gallery-slideshow",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "mobile-menu",
    "type": "plugin",
    "affected_version": "* - 2.8.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "sticky-related-posts",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "icustomizer",
    "type": "plugin",
    "affected_version": "* - 1.4.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "catchers-helpdesk",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "categories-gallery-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "categories-gallery",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "total-sales-for-woocommerce",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "share-woocommerce-email",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "template-events-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "simple-behace-portfolio",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "betteroptin",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "project-app",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "aoi-tori",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "station-pro",
    "type": "plugin",
    "affected_version": "2.2.1",
    "from_version": "2.2.1",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "easy-justified-gallery",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "clinicalwp-core",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "webhotelier",
    "type": "plugin",
    "affected_version": "[*, 1.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "4k-icon-fonts-for-visual-composer",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "tcs3",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "w3s-cf7-zoho",
    "type": "plugin",
    "affected_version": "[*, 2.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= (Various Versions) - Reflected Cross-Site Scripting",
    "slug": "affiliate-pro",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IFrame Shortcode \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "flynsarmy-iframe-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29436",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iThemes Exchange \u003c 1.12.0 - Cross-Site Scripting",
    "slug": "ithemes-exchange",
    "type": "plugin",
    "affected_version": "[*, 1.12.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9363",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CF7 Invisible reCAPTCHA \u003c= 1.3.3 - Cross-Site Request Forgery via vsz_cf7_invisible_recaptcha_page",
    "slug": "cf7-invisible-recaptcha",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28167",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58633",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FluentAuth \u003c= 1.0.1 -  IP Spoofing to Protection Mechanism Bypass",
    "slug": "fluent-security",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4746",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PHP Everywhere \u003c= 2.0.2 - Cross-Site Request Forgery",
    "slug": "php-everywhere",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-23227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-23227",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Integration for WooCommerce and Salesforce \u003c= 1.7.5 - Open Redirect",
    "slug": "woo-salesforce-plugin-crm-perks",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47455",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP VR \u003c= 8.2.7 - Cross-Site Request Forgery",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25708",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rank Math SEO – AI SEO Tools to Dominate SEO Rankings \u003c= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.228",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.228",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9161",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "HT Mega – Absolute Addons for WPBakery Page Builder \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ht-mega-for-wpbakery",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53463",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spin 360 deg and 3D Model Viewer \u003c= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spin360",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30559",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.975",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.975",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4087",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complianz - GDPR/CCPA Cookie Consent \u003c= 6.4.4 - Cross-Site Request Forgery via maybe_install_suggested_plugins",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33333",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flexo Slider \u003c= 1.0013 - Reflected Cross-Site Scripting",
    "slug": "flexo-slider",
    "type": "plugin",
    "affected_version": "* - 1.0013",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0013",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23472",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easing Slider  \u003c= 3.0.8 - Missing Authorization to Unauthenticated Settings Reset",
    "slug": "easing-slider",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30490",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Password Change via Stolen Cookie",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.3",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5838",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Password Change via Stolen Cookie",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.2",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5838",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Password Change via Stolen Cookie",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.14",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5838",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Password Change via Stolen Cookie",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.11",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5838",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Password Change via Stolen Cookie",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.8",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5838",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Password Change via Stolen Cookie",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-5838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5838",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Password Change via Stolen Cookie",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.14",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5838",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Password Change via Stolen Cookie",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.12",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5838",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Password Change via Stolen Cookie",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.11",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5838",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Password Change via Stolen Cookie",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.4",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5838",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Signature \u003c= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wordpress-signature",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22704",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Tables WordPress Plugin – Easy Pricing Tables \u003c= 3.2.5 - Reflected Cross-Site Scripting",
    "slug": "easy-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8871",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy \u003c= 2.7.12 - Missing Authorization",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.7.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58594",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Restricted Site Access \u003c= 7.3.1 - Access Bypass via IP Spoofing",
    "slug": "restricted-site-access",
    "type": "plugin",
    "affected_version": "[*, 7.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1613",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Cloud SAML SSO - Single Sign On Login \u003c= 1.0.18 - Unauthenticated Local File Inclusion",
    "slug": "cloud-sso-single-sign-on",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49264",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BBE \u003c 1.53 - Authorization Bypass",
    "slug": "bbe",
    "type": "theme",
    "affected_version": "[*, 1.53)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.53",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-11244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11244",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Reales WP STPT \u003c= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update",
    "slug": "short-tax-post",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3610",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Quick Contact Form \u003c= 8.2.1 - Reflected Cross-Site Scripting",
    "slug": "quick-contact-form",
    "type": "plugin",
    "affected_version": "* - 8.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48245",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Abstracts \u003c= 2.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-abstracts-manuscripts-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44045",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rank Math SEO \u003c= 1.0.119 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "[*, 1.0.119.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.119.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-32600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32600",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Survey \u0026 Poll – Quiz, Survey and Poll Plugin for WordPress \u003c 1.2 - SQL Injection",
    "slug": "wp-survey-and-poll",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-2090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2090",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Members Membership Plugin \u003c= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.5.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9489",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Kama Click Counter \u003c= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kama-clic-counter",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49861",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Testimonials \u003c= 3.4.1 - SQL Injection",
    "slug": "wp-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-9418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9418",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Barcode Generator for WooCommerce \u003c= 2.0.4 - Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "embedding-barcodes-into-product-pages-and-orders",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32929",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Google Forms \u003c= 0.95 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wpgform",
    "type": "plugin",
    "affected_version": "* - 0.95",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.95",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3834",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51684",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "System Dashboard \u003c= 2.8.20 - Cross-Site Request Forgery",
    "slug": "system-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.8.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10377",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Embed Swagger UI \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embed-swagger-ui",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13700",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MaxSlider \u003c= 1.2.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "maxslider",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-47351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47351",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 Database Addon – CFDB7 \u003c= 1.2.6.8 - Unauthenticated Sensitive Information Exposure",
    "slug": "contact-form-cfdb7",
    "type": "plugin",
    "affected_version": "* - 1.2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3870",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ARForms Form Builder \u003c= 1.6.1 - Cross-Site Request Forgery",
    "slug": "arforms-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31272",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4983",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGYM - Wordpress Gym Management System \u003c 67.8.0 - Unauthenticated SQL Injection",
    "slug": "gym-management",
    "type": "plugin",
    "affected_version": "[*, 67.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "67.8.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-7442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7442",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Smart Slider 3 \u003c= 3.5.0.8 - Authenticated Stored Cross-Site Scripting",
    "slug": "smart-slider-3",
    "type": "plugin",
    "affected_version": "[*, 3.5.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24382",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Freetobook Responsive Widget \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "freetobook-responsive-widget",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32273",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "underConstruction \u003c= 1.19 - Cross-Site Request Forgery to Construction Mode Disabled",
    "slug": "underconstruction",
    "type": "plugin",
    "affected_version": "[*, 1.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1895",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Any Hostname \u003c= 1.0.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "any-hostname",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24481",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP JobSearch \u003c 1.5.1 - Reflected Cross-Site Scripting",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "[*, 1.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1168",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "YITH WooCommerce Product Add-Ons \u003c= 4.5.0 - Unuathenticated Cross-Site Scripting",
    "slug": "yith-woocommerce-product-add-ons",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27994",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CiyaShop \u003c= 4.18.0 - Unauthenticated PHP Object Injection",
    "slug": "ciyashop",
    "type": "theme",
    "affected_version": "* - 4.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.18.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39349",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Newsletter Plugin – Noptin \u003c= 1.10.3 - Unauthenticated CSV Injection",
    "slug": "newsletter-optin-box",
    "type": "plugin",
    "affected_version": "* - 1.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-46803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46803",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CP Contact Form with PayPal \u003c 1.1.6 - SQL Injection",
    "slug": "cp-contact-form-with-paypal",
    "type": "plugin",
    "affected_version": "[*, 1.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9234",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy EU Cookie law \u003c= 1.3.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "easy-eu-cookie-law",
    "type": "plugin",
    "affected_version": "* - 1.3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23434",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Challan \u003c= 3.7.58 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "webappick-pdf-invoice-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.7.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.58",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47462",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Co-marquage service-public.fr \u003c= 0.5.72 - Reflected Cross-Site Scripting via search_term",
    "slug": "co-marquage-service-public",
    "type": "plugin",
    "affected_version": "* - 0.5.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29758",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Location and IP \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "user-location-and-ip",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31217",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Event Manager, Event Calendar and Booking Plugin \u003c= 4.0.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "eventin-pro",
    "type": "plugin",
    "affected_version": "* - 4.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52730",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SMS \u003c= 6.6.2 - Cross-Site Request Forgery",
    "slug": "wp-sms",
    "type": "plugin",
    "affected_version": "* - 6.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30454",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sitewide Notice WP \u003c= 2.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "sitewide-notice-wp",
    "type": "plugin",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24592",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.8 \u0026 Secure Custom Fields \u003c= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 6.3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49593",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.8 \u0026 Secure Custom Fields \u003c= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "* - 6.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49593",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.8 \u0026 Secure Custom Fields \u003c= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "6.3.7",
    "from_version": "6.3.7",
    "from_inclusive": true,
    "to_version": "6.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49593",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.8 \u0026 Secure Custom Fields \u003c= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "6.3.8",
    "from_version": "6.3.8",
    "from_inclusive": true,
    "to_version": "6.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49593",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 6.3.8 \u0026 Secure Custom Fields \u003c= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "* - 6.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49593",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import Users from CSV \u003c= 1.2 - Authenticated (Admin+) PHP Object Injection",
    "slug": "import-users-from-csv",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32431",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "yPHPlista \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yphplista",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51805",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enhanced Plugin Admin \u003c= 1.16 - Cross-Site Request Forgery via epa_options_page",
    "slug": "enhanced-plugin-admin",
    "type": "plugin",
    "affected_version": "* - 1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28618",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Philantro – Donations and Donor Management \u003c= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "philantro",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Power Mag \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "power-mag",
    "type": "theme",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22816",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.25.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40211",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0 - Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-6944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6944",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.10 - Cross-Site Request Forgery",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54035",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP donimedia carousel \u003c= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-donimedia-carousel",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50511",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gecka Terms Thumbnails \u003c= 1.1 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "gecka-terms-thumbnails",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-52219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52219",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings \u003c= 8.1 - Privilege Escalation and Account Takeover via Weak OTP",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1570",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin \u003c= 4.2.16 - Unauthenticated Plugin Settings Reset",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "* - 4.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0444",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.26",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.26",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.24",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.23",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.16",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.6",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.23",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.20",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.15",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.14",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.11",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.10",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.9.7 - Authenticated Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.6",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-12895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-12895",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Permalink Manager Lite \u003c= 2.4.3.3 - Reflected Cross-Site Scripting",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.4.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37257",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Minimum Purchase for WooCommerce \u003c= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "minimum-purchase-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30492",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stop and Block bots plugin Anti bots \u003c= 1.48 - Missing Authorization",
    "slug": "antibots",
    "type": "plugin",
    "affected_version": "* - 1.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48166",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Real Estate \u003c= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure",
    "slug": "essential-real-estate",
    "type": "plugin",
    "affected_version": "* - 5.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12329",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Church Admin \u003c= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35764",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category D3 Tree \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "category-d3-tree",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23873",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Simple eCommerce for Selling Digital Files \u003c= 2.9.15 - Stored Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "[*, 2.9.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15116",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPS Telegram Chat \u003c= 4.6.0 - Missing Authorization to Information Exposure",
    "slug": "wps-telegram-chat",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9630",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Travel Tour \u003c 5.2.4 - Reflected Cross-Site Scripting",
    "slug": "traveltour",
    "type": "theme",
    "affected_version": "[*, 5.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-11846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11846",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Where I Was, Where I Will Be \u003c= 1.1.1 - Unauthenticated Remote File Inclusion",
    "slug": "where-i-was-where-i-will-be",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5577",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dynamics 365 Integration \u003c= 1.3.17 - Unauthenticated Sensitive Information Exposure",
    "slug": "integration-dynamics",
    "type": "plugin",
    "affected_version": "* - 1.3.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34550",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Progress Bar \u003c= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "progress-bar",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47441",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Canadian Sales Taxes Add-On for iThemes Exchange \u003c 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "exchange-addon-easy-canadian-sales-taxes",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9367",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add Function",
    "slug": "project-notebooks",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.3",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5304",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Docs \u003c= 1.9.9 - Reflected Cross-Site Scripting",
    "slug": "wp-docs",
    "type": "plugin",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-32106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32106",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stream Video Player \u003c= 1.4.1 - Cross-Site Request Forgery",
    "slug": "stream-video-player",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-2706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2706",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "StreamWeasels Twitch Integration \u003c= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-twitch-embed Shortcode",
    "slug": "streamweasels-twitch-integration",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9897",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3DPrint Lite \u003c=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'infill_text'",
    "slug": "3dprint-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3427",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Import Content in WordPress \u0026 WooCommerce with Excel \u003c= 4.2 - Reflected Cross-Site Scripting",
    "slug": "content-excel-importer",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32585",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Header \u0026 Footer Builder \u003c= 1.5.7 - Stored Cross-Site Scripting",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.5.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24256",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirection \u003c= 2.2.9 - Cross-Site Scripting",
    "slug": "redirection",
    "type": "plugin",
    "affected_version": "[*, 2.2.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-4562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-4562",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page and Post Clone \u003c= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure",
    "slug": "page-or-post-clone",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5942",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Denial of Service via oEmbed Protocol",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.11",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Denial of Service via oEmbed Protocol",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.4",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Denial of Service via oEmbed Protocol",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.14",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Denial of Service via oEmbed Protocol",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.12",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Denial of Service via oEmbed Protocol",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.11",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Denial of Service via oEmbed Protocol",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.8",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Denial of Service via oEmbed Protocol",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.3",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Denial of Service via oEmbed Protocol",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.2",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Denial of Service via oEmbed Protocol",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-5836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.5.3 - Denial of Service via oEmbed Protocol",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.14",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-5836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-5836",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Advanced Search by My Solr Server \u003c= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "advanced-search-by-my-solr-server",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3099",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin  \u003c= 3.1.1 - Improper Access Control to Information Disclosure",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-8605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8605",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Secure Passkeys \u003c= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion",
    "slug": "secure-passkeys",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10305",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Podiant \u003c= 1.1 - Unauthenticated Local File Inclusion",
    "slug": "podiant",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-44016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44016",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PostX - Gutenberg Post Grid Blocks \u003c= 3.0.5 - Reflected Cross-Site Scripting via 'postx_type'",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3992",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accelerated Mobile Pages \u003c= 1.0.88.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "accelerated-mobile-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.88.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.88.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48321",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AMO Team Showcase \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via amoteam_skills Shortcode",
    "slug": "amo-team-showcase",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1407",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Widget \u003c= 1.4.6 - Cross-Site Request Forgery",
    "slug": "new-contact-form-widget",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47491",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Visualizer: Tables and Charts Manager for WordPress \u003c= 3.3.0 - Server-Side Request Forgery",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-16932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16932",
    "auth_type": "Unauth",
    "cvss_score": 9.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.9.8 - Reflected Cross-Site Scripting",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43279",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "newseqo \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "newseqo",
    "type": "theme",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26739",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Burst Statistics \u003c= 2.0.6 - Cross-Site Request Forgery",
    "slug": "burst-statistics",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53193",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Digital Newspaper \u003c= 1.1.5 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "digital-newspaper",
    "type": "theme",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37198",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Outdoor \u003c= 3.9.6 - Reflected Cross-Site Scripting",
    "slug": "outdoor",
    "type": "theme",
    "affected_version": "* - 3.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29236",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooEvents \u003c= 4.1.7 - Missing Authorization",
    "slug": "woo-events",
    "type": "plugin",
    "affected_version": "* - 4.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60121",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Branda \u003c= 3.4.14 - IP Address Spoofing",
    "slug": "branda-white-labeling",
    "type": "plugin",
    "affected_version": "* - 3.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51542",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Albo Pretorio Online \u003c= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "albo-pretorio-on-line",
    "type": "plugin",
    "affected_version": "* - 4.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22302",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gravity Forms CSS Themes with Fontawesome and Placeholders \u003c= 8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gravity-forms-css-themes-with-fontawesome-and-placeholder-support",
    "type": "plugin",
    "affected_version": "* - 8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39428",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All in One SEO Pro \u003c= 4.2.5.1 - Authenticated (Admin+) Server Side Request Forgery",
    "slug": "all-in-one-seo-pack-pro",
    "type": "plugin",
    "affected_version": "* - 4.2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-42494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42494",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow Gallery \u003c= 1.8 - Unauthenticated Sensitive Information Exposure",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31353",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WC Affiliate \u003c= 2.9.2 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "wc-affiliate",
    "type": "plugin",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47660",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PropertyHive \u003c= 1.5.48 - Reflected Cross-Site Scripting via date_post_id",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 1.5.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22706",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Importer: Import any XML File to WordPress \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "wp-smart-import",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40209",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme Switcha \u003c= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "theme-switcha",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5614",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPvivid Backup and Migration \u003c= 0.9.106 - Missing Authorization",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.106",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.106",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56273",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooLentor \u003c= 2.6.2 - Cross-Site Request Forgery via process_data",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47172",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via Shortcode Brackets",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9031",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via Shortcode Brackets",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.4",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9031",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via Shortcode Brackets",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.4",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9031",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via Shortcode Brackets",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.2",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9031",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Cross-Site Scripting via Shortcode Brackets",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9031",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Toolkit for LearnDash \u003c= 3.6.4.1 - Cross-Site Request Forgery to Arbitrary Plugin Install and Activation",
    "slug": "uncanny-learndash-toolkit",
    "type": "plugin",
    "affected_version": "* - 3.6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23714",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.2.1 - Cross-Site Request Forgery",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37093",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hunk Companion \u003c= 1.8.5 -  Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation",
    "slug": "hunk-companion",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11972",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \u003c= 4.89 - Unauthenticated Time-Based SQL Injection via ‘bsa_pro_id'",
    "slug": "ap-plugin-scripteo",
    "type": "plugin",
    "affected_version": "* - 4.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5339",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "xili-tidy-tags \u003c= 1.12.03 - Cross-Site Request Forgery",
    "slug": "xili-tidy-tags",
    "type": "plugin",
    "affected_version": "* - 1.12.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47448",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup Like box \u003c= 3.6.0 - Reflected Cross-Site Scripting",
    "slug": "ays-facebook-popup-likebox",
    "type": "plugin",
    "affected_version": "[*, 3.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0641",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "App Builder \u003c= 5.5.3 - Missing Authorization",
    "slug": "app-builder",
    "type": "plugin",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49989",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Project Cost Calculator \u003c= 1.0.0 - Missing Authorization",
    "slug": "project-cost-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52775",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "what3words Address Field \u003c= 4.0.15 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "3-word-address-validation-field",
    "type": "plugin",
    "affected_version": "* - 4.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26768",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdminPad \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "adminpad",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2762",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS Elementor Addons \u003c= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tutor-lms-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29913",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Affiliate Links \u003c= 6.4.3.1 - Authenticated (Editor+) SQL Injection",
    "slug": "wp-auto-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 6.4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-34386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34386",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "SEO Redirection Plugin - 301 Redirect Manager \u003c= 6.3 - Reflected Cross-Site Scripting",
    "slug": "seo-redirection",
    "type": "plugin",
    "affected_version": "* - 6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24187",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shared Files \u003c= 1.7.19 - Missing Authorization",
    "slug": "shared-files",
    "type": "plugin",
    "affected_version": "* - 1.7.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34438",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "jAlbum Bridge \u003c= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via ar Parameter",
    "slug": "jalbum-bridge",
    "type": "plugin",
    "affected_version": "* - 2.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11853",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SULly \u003c= 4.3 - Reflected Cross-Site Scripting",
    "slug": "sully",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5032",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Explara Membership \u003c= 0.0.7 - Reflected Cross-Site Scripting",
    "slug": "explara-membership",
    "type": "plugin",
    "affected_version": "* - 0.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23583",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hover Image \u003c= 1.4.1 - Cross-Site Request Forgery",
    "slug": "hover-image",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47611",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Google Maps \u003c 7.10.43 - Reflected Cross-Site Scripting",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 7.10.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.10.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-9912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9912",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Bookmarking RELOADED \u003c= 3.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "social-bookmarking-reloaded",
    "type": "plugin",
    "affected_version": "* - 3.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31393",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Ajax Chat \u003c= 20240216 -  Unauthenticated Stored Cross-Site Scripting",
    "slug": "simple-ajax-chat",
    "type": "plugin",
    "affected_version": "* - 20240216",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20240216",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1983",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Products, Order \u0026 Customers Export for WooCommerce \u003c= 2.0.15 - Reflected Cross-Site Scripting",
    "slug": "export-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9377",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteGround Security \u003c= 1.2.5 - Authorization Weakness to Authentication Bypass",
    "slug": "sg-security",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0993",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LatePoint \u003c= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 4.9.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43992",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Toolkit Pro for LearnDash \u003c= 4.1.4 - Missing Authorization to Arbitrary Page/Post Duplication",
    "slug": "uncanny-toolkit-pro",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37439",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Edubin \u003c= 9.2.0 - Unauthenticated Server-Side Request Forgery",
    "slug": "edubin",
    "type": "plugin",
    "affected_version": "* - 9.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-39637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39637",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Olive One Click Demo Import \u003c= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload in olive_one_click_demo_import_save_file",
    "slug": "olive-one-click-demo-import",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-29102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29102",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Maintenance Switch \u003c= 1.5.2 - Cross-Site Request Forgery via 'admin_action_request'",
    "slug": "maintenance-switch",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29235",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Flash \u0026 HTML5 Video \u003c= 2.5.30 - Missing Authorization",
    "slug": "html5-video-player",
    "type": "plugin",
    "affected_version": "* - 2.5.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43296",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traffic Manager \u003c= 1.4.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "traffic-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7485",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Melapress File Monitor \u003c 2.2.0 - Missing Authorization",
    "slug": "website-file-changes-monitor",
    "type": "plugin",
    "affected_version": "[*, 2.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-3702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3702",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Extensions for Elementor \u003c= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "extensions-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39668",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ecwid Ecommerce Shopping Cart \u003c= 6.12.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ecwid-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 6.12.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.12.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2456",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider by Supsystic \u003c= 1.8.6 - Cross-Site Request Forgery",
    "slug": "slider-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47155",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Job Manager – Company Profiles \u003c= 1.7 - Reflected Cross-Site Scripting",
    "slug": "wp-job-manager-companies",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6978",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Rollback \u003c 1.2.3 - Cross-Site Scripting",
    "slug": "wp-rollback",
    "type": "plugin",
    "affected_version": "[*, 1.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9342",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Manager  \u003c= 1.4.5 - Stored Cross-Site Scripting",
    "slug": "business-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39332",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Membership Subscriptions – Effortless Memberships, Recurring Payments \u0026 Content Restriction \u003c= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1389",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Forms \u003c= 2.6.86 - Missing Authorization",
    "slug": "smart-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7203",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Activity Log \u003c= 1.6.6 - IP Address Spoofing",
    "slug": "user-activity-log",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4279",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Companion Auto Update \u003c= 3.2.0 - Local File Inclusion",
    "slug": "companion-auto-update",
    "type": "plugin",
    "affected_version": "[*, 3.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-20973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20973",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Analytics Tracker \u003c= 1.1.0 - Cross-Site Scripting",
    "slug": "analytics-tracker",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18554",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-dTree \u003c= 4.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "wp-dtree-30",
    "type": "plugin",
    "affected_version": "* - 4.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47423",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Membership Subscriptions – Effortless Memberships, Recurring Payments \u0026 Content Restriction \u003c= 2.11.1 - Missing Authorization via creating_pricing_table_page",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1390",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LuckyWP Scripts Control \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "luckywp-scripts-control",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29239",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Slider Revolution \u003c= 6.7.13 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.7.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37449",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Forms - Drag \u0026 Drop Form Builder WordPress  \u003c= 6.0.3 - Reflected Cross-Site Scripting",
    "slug": "super-forms",
    "type": "plugin",
    "affected_version": "* - 6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0402",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Titan Framework \u003c= 1.5.2 - Reflected Cross-Site Scripting",
    "slug": "titan-framework",
    "type": "plugin",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-6444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6444",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooDiscuz – WooCommerce Comments \u003c= 2.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "woodiscuz-woocommerce-comments",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33216",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JS Job Manager \u003c= 2.0.2 - Authenticated Insecure Direct Object Reference",
    "slug": "js-jobs",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31867",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Invite Anyone \u003c 1.3.16 - Email Injection",
    "slug": "invite-anyone",
    "type": "plugin",
    "affected_version": "[*, 1.3.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.16",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18543",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Post Author \u003c= 3.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-post-author",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37101",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "cformsII \u003c= 15.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cforms2",
    "type": "plugin",
    "affected_version": "* - 15.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52203",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "mgl-instagram-gallery Plugin (Unknown Versions) - Cross-Site Scripting",
    "slug": "mgl-instagram-gallery",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17869",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feedburner Optin Form \u003c= 0.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "feedburner-optin-form",
    "type": "plugin",
    "affected_version": "* - 0.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23925",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backpack Traveler \u003c= 2.7 - Unauthenticated Local File Inclusion",
    "slug": "backpacktraveler",
    "type": "theme",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39490",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.5.41.7212 - Reflected Cross-Site Scripting",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.41.7212",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.41.7212",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22299",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Font Awesome More Icons \u003c= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "font-awesome-more-icons",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5232",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RomethemeKit For Elementor \u003c= 1.5.3 - Missing Authorization in save_options and reset_widgets",
    "slug": "rometheme-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10326",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "rtMedia for WordPress, BuddyPress and bbPress \u003c= 4.6.18 - Authenticated (Contributor+) SQL Injection via rtmedia_gallery Shortcode",
    "slug": "buddypress-media",
    "type": "plugin",
    "affected_version": "* - 4.6.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3293",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smooth Slider \u003c 2.8.7 - Authenticated SQL Injection",
    "slug": "smooth-slider",
    "type": "plugin",
    "affected_version": "[*, 2.8.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-5373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5373",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Google Maps \u003c= 1.11.11 - Cross-Site Request Forgery",
    "slug": "google-maps-easy",
    "type": "plugin",
    "affected_version": "* - 1.11.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31269",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Floatbox Plus \u003c= 1.4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "floatbox-plus",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23617",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pearl \u003c= 1.3.9 - Cross-Site Request Forgery",
    "slug": "pearl-header-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31880",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Code Snippets \u003c= 2.14.3 - Reflected Cross-Site Scripting",
    "slug": "code-snippets",
    "type": "plugin",
    "affected_version": "* - 2.14.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25617",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Envo Extra \u003c= 1.9.3 - Authenticated (Contributor+) Post Disclosure",
    "slug": "envo-extra",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10770",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Admin Menu Editor \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "admin-menu-restriction",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0625",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit Form – Contact Form Plugin \u003c= 2.13.10 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.13.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-47319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47319",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.22",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.15",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.37",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.34",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.27",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.14",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.11",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.9",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.3",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.1",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.34",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.19",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.7",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.5",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.25",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.18",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.12",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.8",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.37",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.35",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.35",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.31",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.26",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.9.1 - jQuery Prototype Pollution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.22",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20083",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.69 - Reflected Cross-Site Scripting via sub_page Parameter",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "[*, 0.9.70)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.70",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0531",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Front End Users \u003c= 3.2.32 - Missing Authorization to Information Exposure",
    "slug": "front-end-only-users",
    "type": "plugin",
    "affected_version": "* - 3.2.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47580",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SupportCandy \u003c= 3.1.4 - Unauthenticated SQL Injection via parse_user_filters",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-1730",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1730",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Membership \u003c= 4.1.2 - Membership Privilege Escalation",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2273",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SIS Handball \u003c= 1.0.45 - Authenticated (Administrator+) SQL Injection via 'orderby'",
    "slug": "sis-handball",
    "type": "plugin",
    "affected_version": "* - 1.0.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.45",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-33924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33924",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Export WordPress Data with Advanced Filters \u003c 1.2 - SQL Injection",
    "slug": "wp-ultimate-exporter",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-11000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11000",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Real Media Library \u003c= 4.14.1 - Authenticated (Author) Stored Cross-Site Scripting",
    "slug": "real-media-library-lite",
    "type": "plugin",
    "affected_version": "* - 4.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34668",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SupportCandy – Helpdesk \u0026 Support Ticket System \u003c= 2.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "supportcandy",
    "type": "plugin",
    "affected_version": "[*, 2.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24879",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.4 - Missing Authorization to Post Modification",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5411",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Super Blank \u003c= 1.2.0 - Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "super-blank",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54741",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Table Addons for Elementor \u003c= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter",
    "slug": "table-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4313",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.24",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.16",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.15",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.7",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.27",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.25",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.24",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.27",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.17",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.12",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.8",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.21",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Stored Cross-Site Scripting via File Uploads",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.11",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20149",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Product Vendors \u003c= 2.1.76 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-product-vendors",
    "type": "plugin",
    "affected_version": "* - 2.1.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.76",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33332",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13127",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dropbox Folder Share \u003c= 1.9.7 - Unauthenticated Local File Inclusion",
    "slug": "dropbox-folder-share",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-4488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4488",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WishSuite \u003c= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wishsuite",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32962",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR Cookie Consent \u003c= 2.6.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "webtoffee-gdpr-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8397",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mailtree Log Mail \u003c= 1.0.0 - Unauthenticated Stored Cross-Site Scripting via Email Subject",
    "slug": "mailtree-log-mail",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3135",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Campaign Monitor Forms by Optin Cat \u003c= 2.5.7 - Reflected Cross-Site Scripting",
    "slug": "campaign-monitor-wp",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11326",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSSable Countdown \u003c= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cssable-countdown",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4384",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0334",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User IP and Location \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "user-ip-and-location",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30780",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Button \u003c= 6.0 - Cross-Site Request Forgery via process_bulk_action",
    "slug": "floating-button",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52149",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WebToffee Plugins \u003c= (Various Versions) - Arbitrary User Creation",
    "slug": "product-reviews-import-export-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-12074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12074",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WebToffee Plugins \u003c= (Various Versions) - Arbitrary User Creation",
    "slug": "comments-import-export-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.1.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-12074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12074",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WebToffee Plugins \u003c= (Various Versions) - Arbitrary User Creation",
    "slug": "order-xml-file-export-import-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-12074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12074",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WebToffee Plugins \u003c= (Various Versions) - Arbitrary User Creation",
    "slug": "xml-file-export-import-for-stampscom-and-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-12074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12074",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WebToffee Plugins \u003c= (Various Versions) - Arbitrary User Creation",
    "slug": "users-customers-import-export-for-wp-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.3.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-12074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12074",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WebToffee Plugins \u003c= (Various Versions) - Arbitrary User Creation",
    "slug": "order-import-export-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-12074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12074",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Server Health Stats \u003c= 1.7.3 - Cross-Site Request Forgery",
    "slug": "wp-server-stats",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31250",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-EMail \u003c= 2.68.2 - Spam Protection Bypass",
    "slug": "wp-email",
    "type": "plugin",
    "affected_version": "[*, 2.69.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.69.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1614",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Thumbnail carousel slider \u003c= 1.0.4 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-responsive-thumbnail-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-25222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25222",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Gallery Images Ape \u003c= 2.2.8 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "gallery-images-ape",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41785",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.6",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.31",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.18",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.9",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.21",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.14",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.33",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.27",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.23",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.33",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.30",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.30",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.22",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.17",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.13",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.5",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4048",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Unite Gallery Lite \u003c= 1.4.6 - Cross-Site Request Forgery \u0026 Authenticated SQL Injection",
    "slug": "unite-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9445",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart WooCommerce Search \u003c= 2.5.0 - Missing Authorization",
    "slug": "smart-woocommerce-search",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30783",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Link Whisper Free \u003c= 0.7.1 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "link-whisper",
    "type": "plugin",
    "affected_version": "* - 0.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2693",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ninja Forms \u003c= 3.6.25 - Denial of Service via Large Form Submissions",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.6.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35909",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "WordPress Meta Robots \u003c= 2.1 - SQL Injection",
    "slug": "wordpress-meta-robots",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9400",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Free Downloads EDD \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "free-downloads-edd",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53320",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Loginizer \u003c= 1.6.3 - SQL Injection",
    "slug": "loginizer",
    "type": "plugin",
    "affected_version": "[*, 1.6.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-27615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-27615",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Field Suite \u003c= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom Field",
    "slug": "custom-field-suite",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3561",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Banner System \u003c= 1.0.0 - Privilege Escalation",
    "slug": "banner-system",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52437",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Woo Labels \u003c= 2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-woo-labels",
    "type": "plugin",
    "affected_version": "* - 2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32188",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.69",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.69",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11937",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 6.5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 6.5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47373",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ViewSTL \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-viewstl",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10135",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appzend \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter",
    "slug": "appzend",
    "type": "theme",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5587",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booster Elite for WooCommerce \u003c= 7.1.2 - Authenticated(Subscriber+) Content Injection",
    "slug": "booster-elite-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 7.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-51511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51511",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AgentEasy Properties \u003c= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "agenteasy-properties",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44576",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Easy Menu \u003c= 0.41 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-easy-menu",
    "type": "plugin",
    "affected_version": "* - 0.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32477",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flo Forms \u003c= 1.0.42 - Missing Authorization",
    "slug": "flo-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35174",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Subscription Renewal Reminders for WooCommerce \u003c= 1.3.7 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "subscriptions-renewal-reminders",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28984",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 1.3.17 - Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 1.3.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9304",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.53, 1.6.53.4)",
    "from_version": "1.6.53",
    "from_inclusive": true,
    "to_version": "1.6.53.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.57, 1.6.57.4)",
    "from_version": "1.6.57",
    "from_inclusive": true,
    "to_version": "1.6.57.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "1.6.61.1",
    "from_version": "1.6.61.1",
    "from_inclusive": true,
    "to_version": "1.6.61.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.61.2, 1.6.61.2.1)",
    "from_version": "1.6.61.2",
    "from_inclusive": true,
    "to_version": "1.6.61.2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.54, 1.6.54.1)",
    "from_version": "1.6.54",
    "from_inclusive": true,
    "to_version": "1.6.54.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.58.2, 1.6.58.3)",
    "from_version": "1.6.58.2",
    "from_inclusive": true,
    "to_version": "1.6.58.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "1.6.59",
    "from_version": "1.6.59",
    "from_inclusive": true,
    "to_version": "1.6.59",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.60, 1.6.60.1)",
    "from_version": "1.6.60",
    "from_inclusive": true,
    "to_version": "1.6.60.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.66, 1.6.66.1)",
    "from_version": "1.6.66",
    "from_inclusive": true,
    "to_version": "1.6.66.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[*, 1.6.49.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.49.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.49.6.2, 1.6.49.6.3)",
    "from_version": "1.6.49.6.2",
    "from_inclusive": true,
    "to_version": "1.6.49.6.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.52, 1.6.52.3)",
    "from_version": "1.6.52",
    "from_inclusive": true,
    "to_version": "1.6.52.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.56, 1.6.56.1)",
    "from_version": "1.6.56",
    "from_inclusive": true,
    "to_version": "1.6.56.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "1.6.59.1",
    "from_version": "1.6.59.1",
    "from_inclusive": true,
    "to_version": "1.6.59.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.59.1.1, 1.6.59.1.2)",
    "from_version": "1.6.59.1.1",
    "from_inclusive": true,
    "to_version": "1.6.59.1.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.59.2, 1.6.59.4)",
    "from_version": "1.6.59.2",
    "from_inclusive": true,
    "to_version": "1.6.59.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.61.1.0, 1.6.61.1.1)",
    "from_version": "1.6.61.1.0",
    "from_inclusive": true,
    "to_version": "1.6.61.1.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.49.8, 1.6.49.9)",
    "from_version": "1.6.49.8",
    "from_inclusive": true,
    "to_version": "1.6.49.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.51, 1.6.51.4)",
    "from_version": "1.6.51",
    "from_inclusive": true,
    "to_version": "1.6.51.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.55, 1.6.55.8)",
    "from_version": "1.6.55",
    "from_inclusive": true,
    "to_version": "1.6.55.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "1.6.61",
    "from_version": "1.6.61",
    "from_inclusive": true,
    "to_version": "1.6.61",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.65, 1.6.65.1)",
    "from_version": "1.6.65",
    "from_inclusive": true,
    "to_version": "1.6.65.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.67, 1.6.67.1)",
    "from_version": "1.6.67",
    "from_inclusive": true,
    "to_version": "1.6.67.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "1.70.3",
    "from_version": "1.70.3",
    "from_inclusive": true,
    "to_version": "1.70.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons (Various Versions) - Missing Authorization",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "[1.6.50, 1.6.50.2)",
    "from_version": "1.6.50",
    "from_inclusive": true,
    "to_version": "1.6.50.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-10257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10257",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form by Supsystic \u003c= 1.7.28 - Authenticated (Admin+) Remote Code Execution",
    "slug": "contact-form-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-48042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48042",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "코드엠샵 소셜톡 \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mshop-naver-talktalk",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11904",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11904",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Analyticator \u003c= 6.5.5 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "google-analyticator",
    "type": "plugin",
    "affected_version": "* - 6.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4323",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Majestic Support – The Leading-Edge Help Desk \u0026 Customer Support Plugin \u003c= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "majestic-support",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13601",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Intro.JS Plugin \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-intro-js-tours",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23576",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spotify Play Button for WordPress \u003c= 2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via spotifyplaybutton Shortcode",
    "slug": "spotify-play-button-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11192",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Browser Sniff \u003c= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "browser-sniff",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9883",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Adminify – Best WordPress Custom Dashboard Plugin \u003c= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "adminify",
    "type": "plugin",
    "affected_version": "* - 4.0.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8959",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Email Marketing Plugin – WP Email Capture \u003c= 3.10 - Missing Authorization to Email Capture List Download",
    "slug": "wp-email-capture",
    "type": "plugin",
    "affected_version": "* - 3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28421",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "CLUEVO E-Learning Platform \u003c= 1.8.0 - Authenticated Cross-Site Scripting",
    "slug": "cluevo-lms",
    "type": "plugin",
    "affected_version": "[*, 1.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25029",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EZ SQL Reports Shortcode Widget and DB Backup 4.11.13 - 5.25.08 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "elisqlreports",
    "type": "plugin",
    "affected_version": "4.11.13 - 5.25.08",
    "from_version": "4.11.13",
    "from_inclusive": true,
    "to_version": "5.25.08",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2319",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Standard Box Sizes – for WooCommerce \u003c= 1.6.13 - Missing Authorization",
    "slug": "standard-box-sizes",
    "type": "plugin",
    "affected_version": "* - 1.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22318",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Booking Calendar \u003c= 1.6.7 - Reflected Cross-Site Scripting",
    "slug": "advanced-booking-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24232",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.5.15.727 - SQL Injection",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.15.727",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.15.727",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-25607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25607",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YaySMTP \u003c= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email",
    "slug": "yaysmtp",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3093",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Side Menu Lite \u003c= 4.0 - Cross-Site Request Forgery to Item Deletion",
    "slug": "side-menu-lite",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27418",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Short URL \u003c=  1.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting",
    "slug": "shorten-url",
    "type": "plugin",
    "affected_version": "1.6.4",
    "from_version": "1.6.4",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3130",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "URL Shortify \u003c= 1.5.0 - Cross-Site Request Forgery",
    "slug": "url-shortify",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24749",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ARMember \u003c= 4.0 - Reflected Cross-Site Scripting",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47140",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP \u003c 4.29.5 - Cross-Site Scripting",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "[*, 4.29.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.29.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-1906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-1906",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "AffiliateImporterEb \u003c= 1.0.6 - Reflected Cross-Site Scripting via 'ebdn_min_price'",
    "slug": "affiliateimportereb",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12733",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Tickets \u003c= 1.8.30 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "my-tickets",
    "type": "plugin",
    "affected_version": "[*, 1.8.31)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.31",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24796",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PostX \u003c= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 4.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Per Page Add To Head \u003c= 1.4.3 Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "per-page-add-to",
    "type": "plugin",
    "affected_version": "[*, 1.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24586",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ND Learning \u003c= 4.7 - Open Redirect",
    "slug": "nd-learning",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15775",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L"
  },
  {
    "title": "LifterLMS \u003c= 8.0.6 - Unauthenticated SQL Injection",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "* - 8.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52717",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Newsletter Popup \u003c= 1.2 - Cross-Site Request Forgery to List Deletion",
    "slug": "newsletter-popup",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3643",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BruteGuard – Brute Force Login Protection \u003c= 0.1.4 - Reflected Cross-Site Scripting",
    "slug": "bruteguard",
    "type": "plugin",
    "affected_version": "* - 0.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39408",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Poll Maker \u003c= 5.5.4 - Cross-Site Request Forgery to Poll Duplication",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12115",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Logo Scheduler \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "logo-scheduler-great-for-holidays-events-and-more",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30875",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2750",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fast Tube \u003c= 2.3.1 - Reflected Cross-Site Scripting",
    "slug": "fast-tube",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13218",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tag Groups is the Advanced Way to Display Your Taxonomy Terms \u003c= 2.0.4 - Reflected Cross-Site Scripting",
    "slug": "tag-groups",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22735",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder \u003c= 2.5.51 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "supreme-modules-for-divi",
    "type": "plugin",
    "affected_version": "* - 2.5.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5501",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory \u003c= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "* - 2.8.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.97",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13506",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShortPixel Adaptive Images \u003c= 3.8.3 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "shortpixel-adaptive-images",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35172",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AppPresser \u003c= 4.3.0 - Cross-Site Request Forgery via toggle_logging_callback()",
    "slug": "apppresser",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31268",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32194",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Boot-Modal \u003c= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "boot-modal",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22551",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Catalog Simple \u003c= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-type-x",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49305",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Developer Toolbar \u003c= 1.0.3 - Unauthenticated Information Exposure",
    "slug": "developer-toolbar",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2881",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Embed Bokun \u003c= 0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter",
    "slug": "embed-bokun",
    "type": "plugin",
    "affected_version": "* - 0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6221",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enter Addons – Ultimate Template Builder for Elementor \u003c= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget",
    "slug": "enteraddons",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3831",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Maker \u003c= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.20.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9490",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CAPTCHA 4WP \u003c= 7.0.6.1 - Cross-Site Request Forgery to Local File Inclusion",
    "slug": "advanced-nocaptcha-recaptcha",
    "type": "plugin",
    "affected_version": "* - 7.0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2184",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.5.1 - Unauthenticated Arbitrary File Upload via uploadFile",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-52221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52221",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Travel Booking WordPress Theme \u003c 3.2.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "[*, 3.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-59011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59011",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Chronoforms \u003c= 7.0.9 - Cross-Site Request Forgery",
    "slug": "chronoforms",
    "type": "plugin",
    "affected_version": "* - 7.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47135",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Zingiri Web Shop \u003c 2.4.0 - Multiple Vulnerabilities",
    "slug": "zingiri-web-shop",
    "type": "plugin",
    "affected_version": "[*, 2.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-4033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4033",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Music Request Manager \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "music-request-manager",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6018",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WE – Testimonial Slider \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "we-testimonial-slider",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13460",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Marker.io  \u003c= 1.1.8 - Cross-Site Request Forgery",
    "slug": "marker-io",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31427",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Yatra \u003c= 2.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "yatra",
    "type": "plugin",
    "affected_version": "* - 2.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47436",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Moova for WooCommerce \u003c= 3.5 - Reflected Cross-Site Scripting",
    "slug": "moova-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34664",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nexa Blocks \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget",
    "slug": "nexa-blocks",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8624",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kebo Twitter Feed \u003c= 1.5.12 - Cross-Site Request Forgery via kebo_twitter_menu_render",
    "slug": "kebo-twitter-feed",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34384",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MOLIE – Instructure Canvas Linking tool \u003c= 0.5 - Reflected Cross-Site Scripting",
    "slug": "molie-instructure-canvas-linking-tool",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25006",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Management \u003c= 1.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "user-management",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52403",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Customer Area \u003c= 8.2.2 -  Reflected Cross-Site Scripting",
    "slug": "customer-area",
    "type": "plugin",
    "affected_version": "* - 8.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0665",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mongoose Page Plugin \u003c= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "facebook-page-feed-graph-api",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4675",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Brute Force of Cross-Site Request Forgery Tokens",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-5205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5205",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Brute Force of Cross-Site Request Forgery Tokens",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.3",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-5205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5205",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Brute Force of Cross-Site Request Forgery Tokens",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.3",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-5205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5205",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.9.2 - Brute Force of Cross-Site Request Forgery Tokens",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.1",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-5205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5205",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Classy Addons for Elementor \u003c= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "classy-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50553",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tripadvisor Shortcode \u003c= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tripadvisor-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48313",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Contact Forms by Cimatti \u003c= 1.5.7 - Cross-Site Request Forgery via _accua_forms_form_edit_action",
    "slug": "contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2563",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP SMS \u003c= 6.9.3 - Missing Authorization",
    "slug": "wp-sms",
    "type": "plugin",
    "affected_version": "* - 6.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43331",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Organizer \u003c= 1.2.1 - Path Disclosure",
    "slug": "organizer",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-6512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6512",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WPFront Scroll Top \u003c= 2.0.5 - Authenticated Stored Cross-Site Scripting",
    "slug": "wpfront-scroll-top",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24564",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.19.2 - Unauthenticated PHP Object Injection",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.19.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12877",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Video Players \u003c= 1.159 - Cross-Site Request Forgery via cincopa_mp_mt_options_page",
    "slug": "video-playlist-and-gallery-plugin",
    "type": "plugin",
    "affected_version": "* - 1.159",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.159",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23515",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Special Box for Content \u003c= 1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "special-box-for-content",
    "type": "plugin",
    "affected_version": "* - 1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31119",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.19",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.19",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.18",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.11",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.10",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.9",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.21",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.21",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.18",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.15",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.5",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.1",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - SQL Injection via Mishandled Placeholders",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.21",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.21",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14723",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Meta Store Elements \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meta-store-elements",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51592",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Order Export for WooCommerce \u003c= 3.1.3 - Cross-Site Scripting",
    "slug": "woo-order-export-lite",
    "type": "plugin",
    "affected_version": "[*, 3.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-11727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11727",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ocean Extra \u003c= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37489",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Banner Slider \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "banner-slider",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49635",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Views for WPForms \u003c= 3.2.2 - Missing Authorization via create_view",
    "slug": "views-for-wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0371",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meteor Slides \u003c= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meteor-slides",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4486",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Table by Supsystic \u003c= 1.8.1 - Cross-Site Request Forgery to Cross-Site Scripting and Setting Changes",
    "slug": "pricing-table-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-9394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9394",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Search \u0026 Filter \u003c= 1.2.17 - Cross-Site Request Forgery",
    "slug": "search-filter",
    "type": "plugin",
    "affected_version": "* - 1.2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48099",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPMobile.App — Android and iOS Mobile Application \u003c= 11.41 - Reflected Cross-Site Scripting",
    "slug": "wpappninja",
    "type": "plugin",
    "affected_version": "* - 11.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35694",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Wiki Tooltip \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-wiki-tooltip",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13462",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Media \u0026 Share Icons \u003c= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ultimate-social-media-icons",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37552",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider \u003c= 2.0.3 - Unauthenticated PHP Object Injection",
    "slug": "ultimate-store-kit",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8030",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Log Action \u003c= 0.51 - Reflected Cross-Site Scripting",
    "slug": "wp-log-action",
    "type": "plugin",
    "affected_version": "* - 0.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24619",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Conversion Tracking \u003c= 2.0.11 - Missing Authorization via wcct_install_happy_addons",
    "slug": "woocommerce-conversion-tracking",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24711",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Missing Authorization on ajax_save_folder_order",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0720",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "News Articles \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "news-articles",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51897",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Gifts Product \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "woo-gift-product",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58878",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Amazon S3 Plugin \u003c= 1.5 - Reflected Cross-Site Scripting",
    "slug": "wp-s3",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0423",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Paginate \u003c= 2.1.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-paginate",
    "type": "plugin",
    "affected_version": "[*, 2.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2050",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Userbase Access Control \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "userbase-access-control",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23553",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Checker by AIOSEO \u003c= 1.2.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "broken-link-checker-seo",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1264",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MDTF – Meta Data and Taxonomies Filter \u003c= 1.3.3.5 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12030",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MediaView \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "mediaview",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31898",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CGM Event Calendar \u003c= 0.8.5 - Reflected Cross-Site Scripting",
    "slug": "cgm-event-calendar",
    "type": "plugin",
    "affected_version": "* - 0.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31462",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Events Calendar Plugin – connectDaily \u003c= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "connect-daily-web-calendar",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58862",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YOP Poll \u003c= 6.5.28 - Reusable Captcha via validateImage",
    "slug": "yop-poll",
    "type": "plugin",
    "affected_version": "* - 6.5.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46611",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Mail Catcher \u003c= 2.1.9 - Reflected Cross-Site Scripting",
    "slug": "wp-mail-catcher",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47339",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mega Menu \u003c= 1.4.2 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "wp-megamenu",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54282",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPForms Lite \u003c= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter",
    "slug": "wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 1.9.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13403",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Remember Me Controls \u003c= 2.0.1 - Unauthenticated Full Path Disclosure",
    "slug": "remember-me-controls",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7415",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Comment Images Reloaded \u003c= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion",
    "slug": "comment-images-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5856",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "UpQode Google Maps \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "upqode-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0094",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.4.3 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31420",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sarada Lite \u003c= 1.1.2 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "sarada-lite",
    "type": "theme",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31429",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPFront User Role Editor \u003c= 4.2.1 - Cross-Site Request Forgery to Privilege Escalation via whitelist_options Function",
    "slug": "wpfront-user-role-editor",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3064",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3064",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Front End Users \u003c= 3.2.24 - Reflected Cross-Site Scripting",
    "slug": "front-end-only-users",
    "type": "plugin",
    "affected_version": "* - 3.2.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33322",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Facturante \u003c= 1.11 - Unauthenticated SQL Injection",
    "slug": "facturante",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47599",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GrandPrix \u003c= 1.6 - Unauthenticated Local File Inclusion",
    "slug": "grandprix",
    "type": "theme",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49296",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Twitter News Feed \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "twitter-news-feed",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23464",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plotly \u003c 1.0.3 - Stored Cross-Site Scripting",
    "slug": "wp-plotly",
    "type": "plugin",
    "affected_version": "[*, 1.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5484",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Favorites \u003c= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "my-favorites",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37114",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShareYourCart \u003c 1.7.1 - Sensitive Information Disclosure",
    "slug": "shareyourcart",
    "type": "plugin",
    "affected_version": "[*, 1.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-4332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4332",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Intl DateTime Calendar \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter",
    "slug": "intl-datetime-calendar",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8293",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Super Cache \u003c= 1.7.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-super-cache",
    "type": "plugin",
    "affected_version": "[*, 1.7.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24329",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Album and Image Gallery with Lightbox – Flagallery Photo Portfolio \u003c 2.72 - Cross-Site Scripting",
    "slug": "flash-album-gallery",
    "type": "plugin",
    "affected_version": "* - 2.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-3261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3261",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Automation By Autonami \u003c= 3.1.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-marketing-automations",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47328",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ninja Forms - File Uploads Extension \u003c= 3.3.12 - Reflected Cross-Site Scripting",
    "slug": "ninja-forms-uploads",
    "type": "plugin",
    "affected_version": "* - 3.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0889",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Warranty Requests \u003c= 2.2.7 - Missing Authorization",
    "slug": "woocommerce-warranty",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51496",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Views for WPForms \u003c= 3.2.2 - Cross-Site Request Forgery via save_view",
    "slug": "views-for-wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0373",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WassUp Real Time Analytics \u003c 1.9.1 - Cross-Site Scripting",
    "slug": "wassup",
    "type": "plugin",
    "affected_version": "[*, 1.9.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10919",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery Pro \u003c= 19.1.4.1 - Authenticated (Administrator+) SQL Injection via wp_user_id",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4154",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SB Child List \u003c= 4.5 - Cross-Site Request Forgery via 'sb_cl_update_settings'",
    "slug": "sb-child-list",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40210",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Directory Listings WordPress plugin – uListing \u003c= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1653",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPCargo Track \u0026 Trace \u003c= 6.9.4 - Admin+ Stored Cross Site Scripting",
    "slug": "wpcargo",
    "type": "plugin",
    "affected_version": "* - 6.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP smart CRM \u0026 Invoices FREE \u003c= 1.8.7 - Stored Cross-Site Scripting",
    "slug": "wp-smart-crm-invoices-free",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-25375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25375",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP All Import \u003c= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "* - 3.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-36386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36386",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Mega Addons For Elementor \u003c= 1.8 - Missing Authorization",
    "slug": "ultimate-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32515",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ENL Newsletter \u003c= 1.0.1 - Authenticated (Admin+) SQL Injection",
    "slug": "enl-newsletter",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4939",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Blocks – WordPress Gutenberg Blocks \u003c= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via section_tag Parameter",
    "slug": "responsive-block-editor-addons",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13732",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Smart Editor  \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "wp-smart-editor",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22148",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiline files upload for contact form 7 \u003c= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation",
    "slug": "multiline-files-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9891",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Custom Admin Interface \u003c= 7.31 - Missing Authorization via wpcai_pro_notice_disable",
    "slug": "wp-custom-admin-interface",
    "type": "plugin",
    "affected_version": "* - 7.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47763",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pay with Contact Form 7 \u003c= 1.0.4 - Reflected Cross-Site Scripting",
    "slug": "pay-with-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52777",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Base Terms \u003c= 1.0.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'base'",
    "slug": "custom-base-terms",
    "type": "plugin",
    "affected_version": "* - 1.0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2600",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Automator \u003c= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function",
    "slug": "uncanny-automator",
    "type": "plugin",
    "affected_version": "* - 6.4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3623",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Cozy Blocks \u003c= 2.1.22 - Missing Authorization",
    "slug": "cozy-addons",
    "type": "plugin",
    "affected_version": "* - 2.1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47485",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Question Answer \u003c= 1.2.70 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "question-answer",
    "type": "plugin",
    "affected_version": "* - 1.2.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.70",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32647",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "States Map US \u003c= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ymc-states-map",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12523",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3890",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UsersWP \u003c= 1.2.4 - Cross-Site Request Forgery",
    "slug": "userswp",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31936",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "아임포트 결제버튼 생성 플러그인 \u003c= 1.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "iamport-payment",
    "type": "plugin",
    "affected_version": "* - 1.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22530",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slightly troublesome permalink \u003c= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "slightly-troublesome-permalink",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57959",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ESV Bible Shortcode for WordPress \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "esv-bible-shortcode-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5534",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapSVG Lite \u003c= 8.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mapsvg-lite-interactive-vector-maps",
    "type": "plugin",
    "affected_version": "* - 8.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32683",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Password Protected Store for WooCommerce \u003c= 2.2 - Information Exposure via REST API",
    "slug": "password-protected-woo-store",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1088",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Forminator \u003c= 1.23.3 - Race Condition to Multiple Poll Voting",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.23.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2010",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.10 - Missing Authorization",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "* - 4.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30528",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Memberships, Groups and Communities \u003c= 5.7.9 - Insecure Direct Object Reference",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32772",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Aurum - WordPress \u0026 WooCommerce Shopping Theme \u003c= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import",
    "slug": "aurum",
    "type": "theme",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12781",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ni WooCommerce Product Enquiry \u003c= 4.1.8 - Missing Authorization",
    "slug": "ni-woocommerce-product-enquiry",
    "type": "plugin",
    "affected_version": "* - 4.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31580",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Staff / Employee Business Directory for Active Directory \u003c= 1.2.3 - Authenticated (Admin+) LDAP Passback",
    "slug": "ldap-ad-staff-employee-directory-search",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-4505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4505",
    "auth_type": "Privileged",
    "cvss_score": 2.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YITH WooCommerce Ajax Search \u003c= 2.8.0 - Unauthenticated SQL Injection",
    "slug": "yith-woocommerce-ajax-search",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-47350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47350",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Terminal Africa \u003c= 1.13.17 - Reflected Cross-Site Scripting",
    "slug": "terminal-africa",
    "type": "plugin",
    "affected_version": "* - 1.13.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32515",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapSVG \u003c= 8.5.31 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mapsvg",
    "type": "plugin",
    "affected_version": "* - 8.5.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47557",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dot html,php,xml etc pages \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "dot-htmlphpxml-etc-pages",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52779",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ajax-extend \u003c= 1.0 - Unauthenticated Remote Code Execution",
    "slug": "ajax-extend",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49254",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Random Posts, Mp3 Player + ShareButton \u003c= 1.4.1 - Reflected Cross-Site Scripting",
    "slug": "random-posts-mp3-player-sharebutton",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23744",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Posts Filter \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "posts-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51886",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Form Builder \u003c= 5.5.4 - Cross-Site Request Forgery",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "* - 5.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45806",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Woo Slider Pro - Drag Drop Slider Builder For WooCommerce \u003c= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion",
    "slug": "woo-slider-pro-drag-drop-slider-builder-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4597",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Laposta \u003c= 1.12 - Unauthenticated Full Path Disclosure",
    "slug": "laposta",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6574",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Giveaways and Contests by RafflePress \u003c= 1.12.16 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "rafflepress",
    "type": "plugin",
    "affected_version": "* - 1.12.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6887",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45456",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vayu Blocks \u003c= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter",
    "slug": "vayu-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4420",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Demo Awesome \u003c= 1.0.2 - Missing Authorization",
    "slug": "demo-awesome",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37207",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GMO Font Agent \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gmo-font-agent",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30553",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elemin \u003c 1.4.3 - Arbitrary File Upload",
    "slug": "elemin",
    "type": "theme",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-20002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-20002",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All Video Gallery Plugin for WordPress \u003c= 1.2 - Authenticated SQL Injection",
    "slug": "all-video-gallery",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5186",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WDContactFormBuilder \u003c= 1.0.68 - Cross-Site Request Forgery",
    "slug": "contact-form-builder",
    "type": "plugin",
    "affected_version": "[*, 1.0.69)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.69",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-11557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11557",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 3.0.2 - Spam Protection Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2010-5293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-5293",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Files",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-44000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44000",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Icegram Engage \u003c= 3.1.31 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 3.1.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12302",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ConvertPlus \u003c= 3.5.26 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "convertplug",
    "type": "plugin",
    "affected_version": "* - 3.5.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4838",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Full Stripe Free \u003c= 7.0.17 - Cross-Site Request Forgery",
    "slug": "wp-full-stripe-free",
    "type": "plugin",
    "affected_version": "* - 7.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47667",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Propovoice CRM \u003c= 1.7.6.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "propovoice",
    "type": "plugin",
    "affected_version": "* - 1.7.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4747",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bodi0’s Easy Cache \u003c= 0.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bodi0s-easy-cache",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12628",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Food ordering and Restaurant Menu \u003c= 1.1 - Unauthenticated Local File Inclusion",
    "slug": "wp-food",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31040",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate WooCommerce CSV Importer \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "simple-woocommerce-csv-loader",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1470",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Post Grid \u003c= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag",
    "slug": "the-post-grid",
    "type": "plugin",
    "affected_version": "* - 7.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1427",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StreamWeasels Twitch Integration \u003c= 1.7.8 - Unauthenticated Sensitive Information Exposure",
    "slug": "streamweasels-twitch-integration",
    "type": "plugin",
    "affected_version": "* - 1.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32716",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Waveform Player \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-waveform-player",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11881",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Getwid – Gutenberg Blocks \u003c= 2.0.4 - Captcha Bypass",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6963",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Icon Widget \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "icon-widget",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4763",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meta Box - WordPress Custom Fields Framework \u003c= 4.16.2 - File Deletion via attachment_id Parameter",
    "slug": "meta-box",
    "type": "plugin",
    "affected_version": "[*, 4.16.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-14793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14793",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP OAuth Server \u003c= 4.2.3 - Cross-Site Request Forgery to Arbitrary Post Deletion (wo_ajax_remove_client)",
    "slug": "oauth2-provider",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3894",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3894",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Everest Backup \u003c= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure",
    "slug": "everest-backup",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11380",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP-DownloadManager \u003c= 1.68.4 - Server-Side Request Forgery",
    "slug": "wp-downloadmanager",
    "type": "plugin",
    "affected_version": "[*, 1.68.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.68.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-24141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24141",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SearchWP Premium \u003c= 4.2.5 - Authenticated (Subscriber+) Nonce Leakage and Authorization Bypass",
    "slug": "searchwp",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40223",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Arkhe \u003c= 3.11.0 - Cross-Site Request Forgery to Local File Inclusion",
    "slug": "arkhe",
    "type": "theme",
    "affected_version": "* - 3.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26748",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Real Time Validation for Gravity Forms \u003c= 1.7.0 - Cross-Site Request Forgery",
    "slug": "real-time-validation-for-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48328",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WidgetKit \u003c= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "widgetkit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49074",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced iFrame \u003c= 2024.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Host Header",
    "slug": "advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 2024.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1439",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reservation.Studio widget \u003c= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "reservation-studio-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24397",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliates Manager \u003c= 2.9.13 - CSV Injection",
    "slug": "affiliates-manager",
    "type": "plugin",
    "affected_version": "* - 2.9.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-2798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2798",
    "auth_type": "Auth",
    "cvss_score": 9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Search \u0026 Replace \u003c= 3.2.2 - Unauthenticated PHP Object Injection",
    "slug": "search-and-replace",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-38759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38759",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multisite Post Duplicator \u003c= 1.7.6 - Cross-Site Request Forgery",
    "slug": "multisite-post-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10944",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BA Book Everything \u003c= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover",
    "slug": "ba-book-everything",
    "type": "plugin",
    "affected_version": "* - 1.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8795",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MT Addons for Elementor \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mt-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22811",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Symposium \u003c= 13.04 - Open Redirection",
    "slug": "wp-symposium",
    "type": "plugin",
    "affected_version": "* - 13.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2694",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bubble Menu – circle floating menu \u003c= 3.0.1 - Cross Site Request Forgery",
    "slug": "bubble-menu",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23984",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Crowdsignal Dashboard – Polls, Surveys \u0026 more \u003c= 3.0.7 - Reflected Cross-Site Scripting",
    "slug": "polldaddy",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2386",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPYog Documents \u003c= 1.3.5 - Reflected Cross-Site Scripting",
    "slug": "wpyog-documents",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27292",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.18",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.15",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.11",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.10",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.18",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.9",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.5",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.1",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.21",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.21",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Cross-Site Scripting in oEmbed",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.19",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14724",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant Reservations \u003c= 1.9 - Directory Traversal to Authenticated (Contributor+) Local File Inclusion",
    "slug": "nd-restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1382",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfileGrid \u003c= 5.3.0 - Missing Authorization to Arbitrary Password Reset",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0940",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Table Builder \u003c= 2.0.6 - Cross-Site Request Forgery",
    "slug": "wp-table-builder",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49286",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NextMove Lite \u003c= 2.17.0 -  Missing Authorization to Authenticated(Subscriber+) Plugin Activation",
    "slug": "woo-thank-you-page-nextmove-lite",
    "type": "plugin",
    "affected_version": "* - 2.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25092",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Bonus for Woo \u003c= 5.8.2 - Reflected Cross-Site Scripting",
    "slug": "bonus-for-woo",
    "type": "plugin",
    "affected_version": "* - 5.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5140",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 5.7.7 - Author+ Stored Cross-Site Scripting",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "[*, 5.7.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20986",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DigiWidgets Image Editor \u003c= 1.10 - Unauthenticated Remote Code Execution",
    "slug": "digiwidgets-image-editor",
    "type": "plugin",
    "affected_version": "* - 1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30580",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social button \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "social-button",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51866",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARForms - Premium WordPress Form Builder \u003c= 6.4.0 - Reflected Cross-Site Scripting",
    "slug": "arforms",
    "type": "plugin",
    "affected_version": "* - 6.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0427",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup Bolt \u003c= 1.3.0 - Sensitive Information Exposure",
    "slug": "backup-bolt",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7236",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Scylla lite \u003c= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode",
    "slug": "scylla-lite",
    "type": "theme",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5922",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Click To Tweet \u003c= 5.10.3 - Missing Authorization",
    "slug": "better-click-to-tweet",
    "type": "plugin",
    "affected_version": "* - 5.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45839",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Popup by Supsystic \u003c= 1.10.8 - Sensitive Information Disclosure",
    "slug": "popup-by-supsystic",
    "type": "plugin",
    "affected_version": "[*, 1.10.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0424",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder – Contact forms and much more \u003c= 8.8.1 - Unauthenticated Sensitive Information Exposure",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13498",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Mailchimp for WooCommerce \u003c= 2.7 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "mailchimp-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2267",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP-PostRatings \u003c= 1.89 - Race Condition",
    "slug": "wp-postratings",
    "type": "plugin",
    "affected_version": "* - 1.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.89",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36422",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Views Counter \u003c= 1.3.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "post-views-counter",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24613",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Proofreading \u003c= 1.2.1.1 - Reflected Cross-Site Scripting",
    "slug": "proofreading",
    "type": "plugin",
    "affected_version": "* - 1.2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12466",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elegant Visitor Counter \u003c= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "elegant-visitor-counter",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30627",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kudos Donations – Easy donations and payments with Mollie \u003c= 3.2.9 - Reflected Cross-Site Scripting",
    "slug": "kudos-donations",
    "type": "plugin",
    "affected_version": "* - 3.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11684",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Branded Social Images \u003c= 1.1.0 - Missing Authorization leading to Unauthenticated Plugin Settings Updates",
    "slug": "branded-social-images",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28536",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Thumbs \u003c= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "post-thumbs",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26569",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Quick FrontEnd Editor \u003c= 5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-quick-front-end-editor",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4378",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accessibility Checker by Equalize Digital \u003c= 1.31.0 - Missing Authorization",
    "slug": "accessibility-checker",
    "type": "plugin",
    "affected_version": "* - 1.31.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.31.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58976",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Hit Counter \u003c= 1.3.2 - Missing Authorization",
    "slug": "post-hit-counter",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36518",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Theme Switcher Reloaded \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "theme-switcher-reloaded",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53223",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 5.1.- - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47391",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Survey Maker \u003c= 4.0.9 - IP Address Spoofing",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 4.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35764",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Visual CSS Style Editor \u003c= 7.5.3 - Reflected Cross-Site Scripting via wyp_page_type parameter",
    "slug": "yellow-pencil-visual-theme-customizer",
    "type": "plugin",
    "affected_version": "* - 7.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24934",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.8.1 - Cross-Site Request Forgery",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6788",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Chaty Pro \u003c= 3.3.3 - Unauthenticated Arbitrary File Upload",
    "slug": "chaty-pro",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-26776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26776",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.13 - Cross-Site Request Forgery to Settings Update in disableOptimization",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1335",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Find My Blocks \u003c 3.4.0 - Sensitive Information Disclosure",
    "slug": "find-my-blocks",
    "type": "plugin",
    "affected_version": "[*, 3.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24677",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Code Embed \u003c= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "simple-embed-code",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10814",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Terms \u0026 Conditions Per Product \u003c= 1.2.15 - Missing Authorization",
    "slug": "terms-and-conditions-per-product",
    "type": "plugin",
    "affected_version": "* - 1.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30866",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Copy Protection \u0026 No Right Click \u003c= 3.1.4 - Missing Authorization to Arbitrary Plugin Installation/Activation",
    "slug": "wp-content-copy-protector",
    "type": "plugin",
    "affected_version": "[*, 3.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24188",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Featured Content Gallery \u003c= 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "featured-content-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34424",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnDash 3.0.0-3.1.1 - Reflected Cross Site Scripting issue on the [ld_profile] search field",
    "slug": "sfwd-lms",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.1.1",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-7108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7108",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Report Post \u003c= 2.1.2 - Authenticated (Editor+) SQL Injection",
    "slug": "wp-report-post",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-34168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34168",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Persian WooCommerce \u003c= 5.8.0 - Reflected Cross-Site Scripting",
    "slug": "persian-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24940",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Ban \u003c 1.64 - Improper Input Validation",
    "slug": "wp-ban",
    "type": "plugin",
    "affected_version": "[*, 1.64)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.64",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-6230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6230",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Fusion Builder \u003c= 3.11.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "fusion-builder",
    "type": "plugin",
    "affected_version": "* - 3.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-39309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39309",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.1.3",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-34622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34622",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YARPP - Yet Another Related Posts Plugin \u003c= 5.30.2 - Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "yet-another-related-posts-plugin",
    "type": "plugin",
    "affected_version": "[*, 5.30.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.30.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-0579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0579",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Import XML and RSS Feeds \u003c= 2.1.4 - Unauthenticated Remote Code Execution",
    "slug": "import-xml-feed",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-4521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4521",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Alley Elementor Widget \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "alley-elementor-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50521",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ThemeMakers Stripe Checkout \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "tmm_stripe_checkout",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1690",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grid \u003c= 2.3.1 - Cross-Site Request Forgery",
    "slug": "grid",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58657",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "2Checkout Payment Gateway for WooCommerce \u003c= 6.2 - Missing Authorization via sniff_ins",
    "slug": "woocommerce-2checkout-payment",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0629",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "uContext for Amazon \u003c= 3.9.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "ucontext-for-amazon",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2541",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WHMpress \u003c= 6.2-revision-9 - Unauthenticated Local File Inclusion",
    "slug": "whmpress",
    "type": "plugin",
    "affected_version": "[*, 6.2-revision-9]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2-revision-9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39491",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bulk Comment Remove \u003c= 2 - Cross-Site Request Forgery via brc_admin()",
    "slug": "bulk-comment-remove",
    "type": "plugin",
    "affected_version": "* - 2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48330",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Real Estate \u003c= 4.3.5 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "essential-real-estate",
    "type": "plugin",
    "affected_version": "* - 4.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6141",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider \u0026 Popup Builder by Depicter \u003c= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter",
    "slug": "depicter",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2011",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "URL Shortener | Conversion Tracking | AB Testing | WooCommerce \u003c= 9.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "easy-broken-link-checker",
    "type": "plugin",
    "affected_version": "* - 9.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1363",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PhonePe Payment Solutions \u003c= 1.0.15 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "phonepe-payment-solutions",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45835",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "PilotPress \u003c= 2.0.36 - Missing Authorization",
    "slug": "pilotpress",
    "type": "plugin",
    "affected_version": "* - 2.0.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58221",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "140+ Widgets | Xpro Addons For Elementor – FREE \u003c= 1.4.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54253",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup-Maker \u003c= 1.8.12 - Unauthenticated information disclosure",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17574",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Blog2Social: Social Media Auto Post \u0026 Scheduler \u003c 5.9.0 - Reflected Cross-Site Scripting via b2s_id Parameter",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "[*, 5.9.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-17550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17550",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All push notification for WP \u003c= 1.5.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "all-push-notification",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-25092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25092",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Paypal Payments \u003c= 5.7.26.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "quick-paypal-payments",
    "type": "plugin",
    "affected_version": "* - 5.7.26.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.26.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1554",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.2.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22786",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "uListing \u003c= 2.1.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32122",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Soumettre.fr \u003c= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion",
    "slug": "soumettre-fr",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-4654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4654",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quick Social Login \u003c= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quick-login",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10140",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opal Woo Custom Product Variation \u003c= 1.1.3 - Unauthenticated Arbitrary File Deletion",
    "slug": "opal-woo-custom-product-variation",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52444",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wpShopGermany IT-RECHT KANZLEI \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "wpshopgermany-it-recht-kanzlei",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30804",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GN Publisher \u003c= 1.5.5 - Reflected Cross-Site Scripting",
    "slug": "gn-publisher",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1080",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sendle Shipping \u003c= 6.02 - Cross-Site Request Forgery",
    "slug": "official-sendle-shipping-method",
    "type": "plugin",
    "affected_version": "* - 6.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60139",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HUSKY \u003c= 1.3.7 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52708",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Academic People List \u003c= 0.4.1 - Reflected Cross-Site Scripting",
    "slug": "wp-academic-people",
    "type": "plugin",
    "affected_version": "* - 0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38316",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hero Mega Menu - Responsive WordPress Menu Plugin \u003c= 1.16.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "hmenu",
    "type": "plugin",
    "affected_version": "* - 1.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49303",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6520",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rank Math SEO – AI SEO Tools to Dominate SEO Rankings \u003c= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math API",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.235",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.235",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13227",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All Bootstrap Blocks \u003c= 1.3.6 - Cross-Site Request Forgery to Plugin Settings Reset",
    "slug": "all-bootstrap-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35047",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Photo Video Gallery Master \u003c= 1.5.3 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "photo-video-gallery-master",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5724",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SmartEmailing.cz \u003c= 2.2.0 - Reflected Cross-Site Scripting",
    "slug": "smartemailing",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12261",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customer Reviews \u003c 3.0.9 - Cross-Site Scripting",
    "slug": "wp-customer-reviews",
    "type": "plugin",
    "affected_version": "[*, 3.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10901",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SecuPress Free — WordPress Security \u003c= 2.2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via secupress_check_ban_ips_form Shortcode",
    "slug": "secupress",
    "type": "plugin",
    "affected_version": "* - 2.2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9019",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DImage 360 \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dimage-360",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35774",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Filter Gallery Plugin \u003c= 0.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "filter-gallery",
    "type": "plugin",
    "affected_version": "* - 0.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4142",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quttera Web Malware Scanner \u003c= 3.5.1.41 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "quttera-web-malware-scanner",
    "type": "plugin",
    "affected_version": "* - 3.5.1.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1.41",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-8013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8013",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.3 - Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-6943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6943",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Rights Access Manager \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "user-rights-access-manager",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31122",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Terms of Service \u0026 Privacy Policy Generator \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "terms-of-service-and-privacy-policy",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49413",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woody Ad Snippets \u003c= 2.2.5 - Arbitrary Post Deletion",
    "slug": "insert-php",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-14773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14773",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Woocommerce Line Notify \u003c= 1.1.7 - Reflected Cross-Site Scripting",
    "slug": "woo-line-notify",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30972",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sina Extension for Elementor \u003c= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor Template",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9540",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Custom Post Type List Shortcode \u003c= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-post-type-list-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0542",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO SearchTerms Tagging 2 \u003c=1.535 - SQL Injection",
    "slug": "searchterms-tagging-2",
    "type": "plugin",
    "affected_version": "* - 1.535",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.535",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9458",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SpeedyCache \u003c= 1.1.3 - Missing Authorization to Plugin Options Update",
    "slug": "speedycache",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6598",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPGYM - Wordpress Gym Management System (Unknown Version) - SQL Injection",
    "slug": "gym-management",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-14844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14844",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Orbit Fox Companion \u003c= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6781",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Responsive Image Slider \u003c= 3.5.11 - Missing Authorization via AJAX action",
    "slug": "ultimate-responsive-image-slider",
    "type": "plugin",
    "affected_version": "* - 3.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6077",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Advanced Custom Fields: Extended \u003c= 0.8.8.6 - Admin+ SQL Injection",
    "slug": "acf-extended",
    "type": "plugin",
    "affected_version": "* - 0.8.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24865",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "iThemes Builder Style Manager \u003c 0.7.7 - Cross-Site Scripting",
    "slug": "builder-style-manager",
    "type": "plugin",
    "affected_version": "[*, 0.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9379",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Support System \u003c= 1.2.1 - Authenticated (Administrator+) SQL Injection via 'orderby'",
    "slug": "wc-support-system",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-41685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41685",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Contact Form, Drag and Drop Form Builder Plugin – Live Forms \u003c= 3.2.1 - Cross-Site Scripting",
    "slug": "liveforms",
    "type": "plugin",
    "affected_version": "[*, 3.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18497",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.25.1 - Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40312",
    "auth_type": "Privileged",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Branda – White Label WordPress, Custom Login Page Customizer \u003c= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "branda-white-labeling",
    "type": "plugin",
    "affected_version": "* - 3.4.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5191",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opal Portfolio \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "opal-portfolios",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31748",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Admin by DynamiApps \u003c= 3.28.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "acf-frontend-form-element",
    "type": "plugin",
    "affected_version": "* - 3.28.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.28.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49267",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GS Logo Slider – Ticker, Grid, List, Table \u0026 Filter Views \u003c= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gs-logo-slider",
    "type": "plugin",
    "affected_version": "* - 3.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4624",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Emag Marketplace Connector \u003c 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "emag-marketplace-connector",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-17043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17043",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donation Block For PayPal \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "donations-block",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22525",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HR Management Lite \u003c= 3.3 - Cross-Site Request Forgery",
    "slug": "hr-management-lite",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29005",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Email Notification on Login \u003c= 1.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "email-notification-on-login",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47622",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Loco Translate \u003c= 2.6.9 - Cross-Site Request Forgery",
    "slug": "loco-translate",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37236",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GEO my WordPress \u003c= 4.5.0.3 - Reflected Cross-Site Scripting",
    "slug": "geo-my-wp",
    "type": "plugin",
    "affected_version": "* - 4.5.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47327",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Automation By Autonami \u003c= 2.6.1 - Authenticated(Administrator+) SQL Injection",
    "slug": "wp-marketing-automations",
    "type": "plugin",
    "affected_version": "[*, 2.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50857",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GEO my WordPress \u003c= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "geo-my-wp",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5467",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tiny carousel horizontal slider plus \u003c= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tiny-carousel-horizontal-slider-plus",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24418",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "salavat counter Plugin \u003c= 0.9.4 - Reflected Cross-Site Scripting",
    "slug": "salavat-counter",
    "type": "plugin",
    "affected_version": "* - 0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simplr Registration Form Plus+ \u003c= 2.3.4 - Reflected Cross-Site Scripting",
    "slug": "simplr-registration-form",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10107",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PixFields \u003c= 0.7.0 - Cross-Site Request Forgery",
    "slug": "pixfields",
    "type": "plugin",
    "affected_version": "* - 0.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45655",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.5.1 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-0237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-0237",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Random Banner \u003c= 4.2.11 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "random-banner",
    "type": "plugin",
    "affected_version": "* - 4.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35645",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wallet for WooCommerce \u003c= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'",
    "slug": "woo-wallet",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6353",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "12 Step Meeting List \u003c= 3.14.33 - Reflected Cross-Site Scripting",
    "slug": "12-step-meeting-list",
    "type": "plugin",
    "affected_version": "* - 3.14.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35693",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Video Player \u003c= 10.1 - Missing Authorization",
    "slug": "fwduvp",
    "type": "plugin",
    "affected_version": "* - 10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49432",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Albo Pretorio Online \u003c= 4.6 - Reflected Cross-Site Scripting via 'Errore'",
    "slug": "albo-pretorio-on-line",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28750",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Custom CSS and JS \u003c= 1.20 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "add-custom-css-and-js",
    "type": "plugin",
    "affected_version": "* - 1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3903",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c 21.2.8.1 - Unauthenticated Stored Cross-Site Scripting via headers",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "[*, 21.2.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.2.8.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5307",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Getwid – Gutenberg Blocks \u003c= 2.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Content",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1948",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Namaste! LMS \u003c= 2.5.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'accept_other_payment_methods', 'other_payment_methods' Parameters",
    "slug": "namaste-lms",
    "type": "plugin",
    "affected_version": "* - 2.5.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0844",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor \u003c= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "[*, 3.12.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-0329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0329",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Debug Bar  \u003c= 0.8 - Reflected Cross-Site Scripting",
    "slug": "debug-bar",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-10021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-10021",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Discord Invite \u003c 2.5.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-discord-invite",
    "type": "plugin",
    "affected_version": "[*, 2.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5006",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "School Management System – SakolaWP \u003c= 1.0.8 - Unauthenticated Privilege Escalation",
    "slug": "sakolawp-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12470",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Twitter real time search scrolling \u003c= 7.0 - Reflected Cross-Site Scripting",
    "slug": "twitter-real-time-search-scrolling",
    "type": "plugin",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51716",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Dashboard \u003c= 3.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ultimate-dashboard",
    "type": "plugin",
    "affected_version": "* - 3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1523",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Document Embedder \u003c= 1.7.8 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure",
    "slug": "document-emberdder",
    "type": "plugin",
    "affected_version": "[*, 1.7.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24868",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue \u003c= 3.1.77 - Reflected Cross-Site Scripting",
    "slug": "mailin",
    "type": "plugin",
    "affected_version": "* - 3.1.77",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.77",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35668",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Apps Login \u003c= 3.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "google-apps-login",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3840",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Animated Headline \u003c= 4.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "animated-headline",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2304",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mail Log Plugin \u003c= 1.1.2 - Authenticated(Contributor+) Arbitrary File Upload",
    "slug": "wp-mail-log",
    "type": "plugin",
    "affected_version": "[*, 1.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-51410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51410",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Seraphinite Post .DOCX Source \u003c= 2.16.9 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "seraphinite-post-docx-source",
    "type": "plugin",
    "affected_version": "* - 2.16.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38728",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Announcements \u003c= 1.8 - Reflected Cross-Site Scripting",
    "slug": "wp-announcements",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23489",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nofollow Links \u003c= 1.0.10 - Cross-Site Scripting",
    "slug": "nofollow-links",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-4833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-4833",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wonder Slider Lite \u0026 Wonder Slider \u003c= 14.4 - Authenticated (Contributor+) Dom-based Stored Cross-Site Scripting",
    "slug": "wonderplugin-slider",
    "type": "plugin",
    "affected_version": "* - 14.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7501",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wonder Slider Lite \u0026 Wonder Slider \u003c= 14.4 - Authenticated (Contributor+) Dom-based Stored Cross-Site Scripting",
    "slug": "wonderplugin-slider-lite",
    "type": "plugin",
    "affected_version": "* - 14.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7501",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Easy Post Types \u003c 1.4.4 - Cross-Site Scripting",
    "slug": "easy-post-types",
    "type": "plugin",
    "affected_version": "[*, 1.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4524",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "magayo Lottery Results \u003c= 2.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "magayo-lottery-results",
    "type": "plugin",
    "affected_version": "* - 2.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Data Tables Generator By Supsystic \u003c= 1.10.19 - Cross-Site Scripting",
    "slug": "data-tables-generator-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.10.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2114",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup Guard \u003c= 1.6.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "backup",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-34148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34148",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CubeWP Framework \u003c= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cubewp-framework",
    "type": "plugin",
    "affected_version": "* - 1.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49882",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stock Ticker \u003c= 3.23.0 - Missing Authorization via AJAX actions",
    "slug": "stock-ticker",
    "type": "plugin",
    "affected_version": "* - 3.23.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.23.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27626",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Social Broadcast \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-social-broadcast",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23545",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy PayPal \u0026 Stripe Buy Now Button \u003c= 1.8.3 \u0026 Contact Form 7 – PayPal \u0026 Stripe Add-on \u003c= 2.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "contact-form-7-paypal-add-on",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1719",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy PayPal \u0026 Stripe Buy Now Button \u003c= 1.8.3 \u0026 Contact Form 7 – PayPal \u0026 Stripe Add-on \u003c= 2.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-ecommerce-paypal",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1719",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DICOM Support \u003c= 0.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dicom-support",
    "type": "plugin",
    "affected_version": "* - 0.10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.10.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12623",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder Pro \u003c= 3.10.0 - Reflected Cross-Site Scripting",
    "slug": "profile-builder-pro",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22142",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sensei LMS \u003c= 4.23.1 \u0026 Sensei Pro (WC Paid Courses) \u003c= 4.24.0.1.24.0 - Missing Authorization",
    "slug": "sensei-lms",
    "type": "plugin",
    "affected_version": "* - 4.23.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.23.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35686",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sensei LMS \u003c= 4.23.1 \u0026 Sensei Pro (WC Paid Courses) \u003c= 4.24.0.1.24.0 - Missing Authorization",
    "slug": "woothemes-sensei",
    "type": "plugin",
    "affected_version": "* - 4.23.1.1.23.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.23.1.1.23.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35686",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wp Social Login and Register Social Counter \u003c= 3.1.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-social",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1506",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MemberSpace \u003c= 2.1.13 - Reflected Cross-Site Scripting",
    "slug": "memberspace",
    "type": "plugin",
    "affected_version": "* - 2.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13727",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accordion Slider \u003c= 1.9.6 - Missing Authorization to Notice Dismissal",
    "slug": "accordion-slider",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40331",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content_template",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8913",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE \u003c= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2841",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Film Studio \u003c= 1.3.4 - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "wp-film-studio",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0500",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Give \u003c= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.22.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.22.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2025",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Web Push \u003c= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "web-push",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23720",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishlist for WooCommerce: Multi Wishlists Per Customer PRO 3.0.8 - 3.1.2 - Reflected Cross-Site Scripting via wtab Parameter",
    "slug": "wish-list-for-woocommerce-pro",
    "type": "plugin",
    "affected_version": "3.0.9",
    "from_version": "3.0.9",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishlist for WooCommerce: Multi Wishlists Per Customer PRO 3.0.8 - 3.1.2 - Reflected Cross-Site Scripting via wtab Parameter",
    "slug": "wish-list-for-woocommerce-pro",
    "type": "plugin",
    "affected_version": "3.1.0",
    "from_version": "3.1.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishlist for WooCommerce: Multi Wishlists Per Customer PRO 3.0.8 - 3.1.2 - Reflected Cross-Site Scripting via wtab Parameter",
    "slug": "wish-list-for-woocommerce-pro",
    "type": "plugin",
    "affected_version": "3.1.1",
    "from_version": "3.1.1",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishlist for WooCommerce: Multi Wishlists Per Customer PRO 3.0.8 - 3.1.2 - Reflected Cross-Site Scripting via wtab Parameter",
    "slug": "wish-list-for-woocommerce-pro",
    "type": "plugin",
    "affected_version": "3.1.2",
    "from_version": "3.1.2",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishlist for WooCommerce: Multi Wishlists Per Customer PRO 3.0.8 - 3.1.2 - Reflected Cross-Site Scripting via wtab Parameter",
    "slug": "wish-list-for-woocommerce-pro",
    "type": "plugin",
    "affected_version": "3.0.8",
    "from_version": "3.0.8",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Tooltips \u003c= 9.4.9 - Cross-Site Request Forgery",
    "slug": "wordpress-tooltips",
    "type": "plugin",
    "affected_version": "* - 9.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31285",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Team Rosters \u003c= 4.7 - Reflected Cross-Site Scripting",
    "slug": "team-rosters",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31905",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Upload Images \u003c= 3.3 - Cross-Site Request Forgery",
    "slug": "auto-upload-images",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-42880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42880",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WCP OpenWeather \u003c= 2.5.0 - Cross-Site Request Forgery",
    "slug": "wcp-openweather",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46638",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "* - 3.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3418",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Slideshow Gallery LITE \u003c= 1.8.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5543",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "TI WooCommerce Wishlist \u003c= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ti-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32920",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.20",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.20",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.17",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.10",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.9",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.8",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.5",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.4",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.18",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.17",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.5 - Cross-Site Scripting via Customizer",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.14",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-9063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9063",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress CRM, Email \u0026 Marketing Automation for WordPress | Award Winner — Groundhogg \u003c= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 4.1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4206",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 3.5.1 - Content-Spoofing Attacks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2204",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "JPG, PNG Compression and Optimization \u003c= 1.7.35 - Cross-Site Request Forgery",
    "slug": "wp-image-compression",
    "type": "plugin",
    "affected_version": "* - 1.7.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27316",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woocommerce Order address Print \u003c= 3.2 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-order-address-print",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34184",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Script Compressor \u003c= 1.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "script-compressor",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31391",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ntz Antispam \u003c= 2.0e - Cross-Site Request Forgery to Settings Update",
    "slug": "ntzantispam",
    "type": "plugin",
    "affected_version": "* - 2.0e",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0e",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8094",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP AmASIN – The Amazon Affiliate Shop \u003c= 0.9.6 - Local File Inclusion",
    "slug": "wp-amasin-the-amazon-affiliate-shop",
    "type": "plugin",
    "affected_version": "* - 0.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4577",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GoQSmile \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "goqsmile",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52455",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Rocket \u003c= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "social-rocket",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3136",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visualizer \u003c= 3.11.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-35736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35736",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "HappyFiles Pro \u003c= 1.8.1 - Missing Authorization",
    "slug": "happyfiles-pro",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25445",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Form Maker \u003c= 1.13.59 - Authenticated Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.13.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24526",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SearchIQ \u003c= 4.6 - Cross-Site Request Forgery",
    "slug": "searchiq",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56229",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advance Search \u003c= 1.1.6 - Cross-Site Request Forgery to Shortcode Deletion",
    "slug": "advance-search",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2739",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Linked Variation for WooCommerce \u003c= 1.0.5 - Cross-Site Request Forgery",
    "slug": "linked-variation-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48047",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FameTheme Demo Importer \u003c= 1.1.5 - Cross-Site Request Forgery",
    "slug": "famethemes-demo-importer",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33679",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Social Login and Register \u003c= 7.6.10 - Unauthenticated Local File Inclusion",
    "slug": "miniorange-login-openid",
    "type": "plugin",
    "affected_version": "* - 7.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47670",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TaxoPress \u003c= 3.0.7.1 - Stored Cross-Site Scripting",
    "slug": "simple-tags",
    "type": "plugin",
    "affected_version": "* - 3.0.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24444",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clone \u003c= 2.3.7 - Missing Authorization via wp_ajax_tifm_save_decision",
    "slug": "wp-clone-by-wp-academy",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25486",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Featured Image from URL (FIFU) \u003c= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url",
    "slug": "featured-image-from-url",
    "type": "plugin",
    "affected_version": "* - 4.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1496",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPack Addons for Elementor \u003c= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2492",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tayori Form \u003c= 1.2.9 - Reflected Cross-Site Scripting",
    "slug": "tayori",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46437",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Code Placement \u003c= 18.11 - Reflected Cross-Site Scripting",
    "slug": "easy-code-placement",
    "type": "plugin",
    "affected_version": "* - 18.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23790",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Attachments \u003c= 5.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-attachments",
    "type": "plugin",
    "affected_version": "* - 5.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4330",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SyncFields \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "syncfields",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22359",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-CRM System \u003c= 3.4.2 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "wp-crm-system",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47629",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ILC Thickbox \u003c= 1.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "ilc-thickbox",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7820",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "tagDiv Composer \u003c 4.0 - Reflected Cross-Site Scripting via ‘td_video_url’",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "[*, 4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-1596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1596",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bellows Accordion Menu \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "bellows-accordion-menu",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5164",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sovratec Case Management \u003c= 1.0.0 - Unauthenticated Arbitrary File Upload",
    "slug": "sovratec-case-management",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49324",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.140",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.140",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13155",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mega Addons For Elementor \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43267",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zapier for WordPress \u003c= 1.5.2 - Missing Authorization",
    "slug": "zapier",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50010",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Customers Manager \u003c= 29.7 - Missing Authorization to Information Exposure",
    "slug": "woocommerce-customers-manager",
    "type": "plugin",
    "affected_version": "* - 29.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "29.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1756",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Cleanfix \u003c= 3.0.1 - Cross-Site Request Forgery",
    "slug": "wp-cleanfix",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2108",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2108",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ChatBot \u003c= 4.7.8 - Authenticated (Administrator+) SQL Injection",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48741",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AllWebMenus WordPress Menu Plugin \u003c= 1.1.3 - Remote File Inclusion",
    "slug": "allwebmenus-wordpress-menu-plugin",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2011-3981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3981",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JNews \u003c= 11.6.5 - Missing Authorization",
    "slug": "jnews",
    "type": "theme",
    "affected_version": "* - 11.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39373",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BuddyPress Activity Plus \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "buddypress-activity-plus",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9455",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4570",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modal Dialog \u003c= 3.5.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "modal-dialog",
    "type": "plugin",
    "affected_version": "* - 3.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24001",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register \u003c= 3.7.1.5 - Unauthenticated SQL Injection",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "[*, 3.7.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24731",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "One Click Demo Import \u003c= 3.2.0 - Authenticated (Admin+) PHP Object Injection",
    "slug": "one-click-demo-import",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-34433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34433",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Vehica Core \u003c= 1.0.97 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "vehica-core",
    "type": "plugin",
    "affected_version": "* - 1.0.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.97",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3105",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced File Manager Shortcode \u003c= 2.5.3 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "file-manager-advanced-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7061",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages \u003c= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update",
    "slug": "wc4bp",
    "type": "plugin",
    "affected_version": "* - 3.4.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13358",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Duplicate Page and Post \u003c= 1.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "duplicate-post-and-page",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31466",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core 2.0.2 - 2.0.5 - Sensitive Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "2.0.2 - 2.0.5",
    "from_version": "2.0.2",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2006-4743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-4743",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ireca \u003c= 1.8.5 - Unauthenticated Local File Inclusion",
    "slug": "ireca",
    "type": "theme",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54716",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "tagDiv Composer \u003c= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3814",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JSP Store Locator \u003c= 1.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "jsp-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11267",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Order Audit Log for WooCommerce \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "order-audit-log-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22337",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.3.2 - Unauthenticated Insecure Direct Object Reference",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48272",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Responsive Meet The Team \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-responsive-meet-the-team",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11818",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BNE Testimonials \u003c= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bne-testimonials",
    "type": "plugin",
    "affected_version": "[*, 2.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-24411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24411",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Movylo Marketing Automation \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "movylo-widget",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32608",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Build App Online \u003c= 1.0.22 - Cross-Site Request Forgery",
    "slug": "build-app-online",
    "type": "plugin",
    "affected_version": "* - 1.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53751",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPML \u003c= 4.5.10 - Missing Authorization to Settings Change",
    "slug": "sitepress-multilingual-cms",
    "type": "plugin",
    "affected_version": "* - 4.5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38461",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CanvasFlow \u003c= 1.5.5 - Reflected Cross-Site Scripting",
    "slug": "canvasflow",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12275",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ivory Search \u003c= 5.4 - Multiple Admin+ Stored Cross-Site Scripting",
    "slug": "add-search-to-menu",
    "type": "plugin",
    "affected_version": "* - 5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25105",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wordpress Auto Spinner \u003c= 3.25.0 - Missing Authorization",
    "slug": "wp-auto-spinner",
    "type": "plugin",
    "affected_version": "* - 3.25.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47534",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Optimizer, Resizer and CDN – Sirv \u003c= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "* - 7.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10855",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Porto Theme - Functionality \u003c= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode",
    "slug": "porto-functionality",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3808",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Marketing and SEO Booster \u003c= 1.9.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "marketing-and-seo-booster",
    "type": "plugin",
    "affected_version": "* - 1.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9066",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.11 - Missing Authorization to Sensitive Information Disclosure",
    "slug": "redux-framework",
    "type": "plugin",
    "affected_version": "* - 4.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38314",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Filter \u0026 Grids \u003c= 2.8.32 - Unauthenticated Local File Inclusion",
    "slug": "ymc-smart-filter",
    "type": "plugin",
    "affected_version": "* - 2.8.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.32",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6164",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MStore API \u003c= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3202",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Really Simple Under Construction Page \u003c= 1.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "really-simple-under-construction",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47593",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tamara Checkout \u003c= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tamara-checkout",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23997",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp tabber widget \u003c= 4.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-tabber-widget",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53468",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Top Bar – PopUps – by WPOptin \u003c= 2.0.1 - Unauthenticated Local File Inclusion",
    "slug": "wpoptin",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-47645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47645",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LionScripts: Site Maintenance \u0026 Noindex Nofollow Plugin \u003c= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "maintenance-and-noindex-nofollow",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54425",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Direct checkout, Add to cart redirect for Woocommerce \u003c= 2.1.48 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "add-to-cart-direct-checkout-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.48",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.48",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28988",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Variation Swatches for WooCommerce \u003c= 2.3.7 - Reflected Cross-Site Scripting",
    "slug": "woo-product-variation-swatches",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37975",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon Booking System \u003c= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 8.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3427",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Photographers galleries \u003c= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "photographers-galleries",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11866",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Get Better Reviews for WooCommerce \u003c= 4.0.6 - Missing Authorization",
    "slug": "more-better-reviews-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37544",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "dTabs \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "dtabs",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0621",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ads Invalid Click Protection \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ads-invalid-click-protection",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52197",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Border Loading Bar \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "border-loading-bar",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38338",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by Ays \u003c= 5.2.6 - Cross-Site Request Forgery",
    "slug": "gallery-photo-gallery",
    "type": "plugin",
    "affected_version": "* - 5.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39917",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ivory Search \u003c= 4.6 - Reflected Cross Site Scripting",
    "slug": "add-search-to-menu",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24234",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Attachments \u003c= 1.3.1 - Unauthenticated Insecure Direct Object Reference",
    "slug": "download-attachments",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49995",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Activity Log \u003c= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup",
    "slug": "wp-security-audit-log",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2286",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Activity Log \u003c= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup",
    "slug": "wp-security-audit-log-premium",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2286",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woocommerce Vietnam Checkout \u003c= 2.0.7 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "woo-vietnam-checkout",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24885",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RT Easy Builder – Advanced addons for Elementor \u003c= 2.0 - Missing Authorization",
    "slug": "rt-easy-builder-advanced-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30484",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lafka Plugin \u003c= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update",
    "slug": "lafka-plugin",
    "type": "plugin",
    "affected_version": "* - 7.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1233",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.11.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10651",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "miniOrange Discord Integration \u003c= 2.1.5 - Missing Authorization to Plugin Options Update",
    "slug": "miniorange-discord-integration",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3082",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.31",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.27",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.17",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.5",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.30",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.23",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.22",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.21",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.18",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.13",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.3",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.33",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.30",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.14",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.6",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.9",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.4.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.33",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-4046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-4046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AA Audio Player \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "aa-audio-player",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52348",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Squelch Tabs and Accordions Shortcodes \u003c= 0.4.7 - Cross-Site Request Forgery",
    "slug": "squelch-tabs-and-accordions-shortcodes",
    "type": "plugin",
    "affected_version": "* - 0.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4463",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CP Blocks \u003c= 1.0.14 - Authenticated Stored Cross-Site Scripting via License ID settings",
    "slug": "cp-blocks",
    "type": "plugin",
    "affected_version": "[*, 1.0.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0448",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Hosting Benchmark tool \u003c= 1.3.6 - Cross-Site Request Forgery via execute_plugin()",
    "slug": "wpbenchmark",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31922",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Survey Maker \u003c= 3.4.6 - Reflected Cross-Site Scripting via 'page' parameter",
    "slug": "survey-maker",
    "type": "plugin",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2572",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Featured Image \u003c= 1.2.1 - Missing Authorization",
    "slug": "bulk-featured-image",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47591",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.3.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2249",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yoast SEO: Local \u003c= 14.8 - Reflected Cross-Site Scripting",
    "slug": "wpseo-local",
    "type": "plugin",
    "affected_version": "* - 14.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32300",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advance Post Prefix \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "advance-post-prefix",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Minimal Coming Soon \u0026 Maintenance Mode \u003c= 2.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting and Setting Changes",
    "slug": "minimal-coming-soon-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-6167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-6167",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-BibTeX \u003c= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting",
    "slug": "wp-bibtex",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12005",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seven Stars \u003c= 1.4.4 - Cross-Site Request Forgery",
    "slug": "sevenstars",
    "type": "theme",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31068",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Limb Gallery – Create Beautiful Image \u0026 Video Galleries \u003c= 1.3.2 - Cross-Site Scripting",
    "slug": "limb-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-14790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14790",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Avada \u003c= 7.8.1 - Cross-Site Request Forgery",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "* - 7.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-41996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41996",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hester \u003c= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hester",
    "type": "theme",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26734",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Email Alerts \u003c= 1.0.10 Reflected Cross-Site Scripting",
    "slug": "smart-email-alerts",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34642",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meks Easy Maps \u003c= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "meks-easy-maps",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9206",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Banner \u003c= 2.11.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "simple-banner",
    "type": "plugin",
    "affected_version": "* - 2.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2515",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Membership Simplified \u003c= 1.58 - SQL Injection",
    "slug": "membership-simplified-for-oap-members-only",
    "type": "plugin",
    "affected_version": "* - 1.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.58",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002009",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blog2Social: Social Media Auto Post \u0026 Scheduler \u003c= 5.5.0 - SQL Injection",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "[*, 5.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-13572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13572",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Formulario de contacto SalesUp! \u003c= 1.0.14 - Reflected Cross-Site Scripting",
    "slug": "formularios-de-contacto-salesup",
    "type": "plugin",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48143",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OOPSpam Anti-Spam \u003c= 1.1.44 - Cross-Site Request Forgery via empty_ham_entries and empty_spam_entries",
    "slug": "oopspam-anti-spam",
    "type": "plugin",
    "affected_version": "[*, 1.1.45)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.45",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-35913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35913",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "i-amaze \u003c= 1.3.7 - Cross-Site Request Forgery",
    "slug": "i-amaze",
    "type": "theme",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38731",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) \u003c= 2.7.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects Widget",
    "slug": "powerpack-lite-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5787",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGraphQL \u003c= 1.3.5 - Denial of Service",
    "slug": "wp-graphql",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-31157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-31157",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Melipayamak \u003c= 2.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "melipayamak",
    "type": "plugin",
    "affected_version": "* - 2.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30940",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ni WooCommerce Order Export \u003c= 3.1.6 - Reflected Cross-Site Scripting",
    "slug": "ni-woocommerce-order-export",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54231",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RRSSB \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rrssb",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46461",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPB Show Core \u003c= 2.2 - Unauthenticated Server Side Request Forgery",
    "slug": "wpb-show-core",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5974",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Team Builder \u003c= 1.5.7 - Missing Authorization",
    "slug": "a-team-showcase",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32308",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image horizontal reel scroll slideshow \u003c= 13.2 -  Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "image-horizontal-reel-scroll-slideshow",
    "type": "plugin",
    "affected_version": "* - 13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5412",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Cookie Law \u003c= 3.1 - Cross-Site Request Forgery via 'ecl_options'",
    "slug": "easy-cookie-law",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40198",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YaySMTP – Simple WP SMTP Mail \u003c= 2.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "yaysmtp",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2372",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.16",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.14",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.13",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.6",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.5",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.16",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.13",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.10",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.4",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Uploading Flash File",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.1",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5489",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Total Upkeep \u003c= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings",
    "slug": "boldgrid-backup",
    "type": "plugin",
    "affected_version": "* - 1.16.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9461",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.59 - Insufficient Access Control to Plugin Deactivation",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4702",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "* - 3.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2711",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Daisycon prijsvergelijkers \u003c= 4.8.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "daisycon",
    "type": "plugin",
    "affected_version": "* - 4.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32148",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Newsmag \u003c= 2.4.4 - Reflected Cross-Site Scripting",
    "slug": "newsmag",
    "type": "theme",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28493",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "SG Helper \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "sg-helper",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11093",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DHVC Form \u003c= 2.4.7 - Unauthenticated Privilege Escalation",
    "slug": "dhvc-form",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8420",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Staging CDN \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "staging-cdn",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23696",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "E2Pdf \u003c= 1.20.25 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "e2pdf",
    "type": "plugin",
    "affected_version": "* - 1.20.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6826",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5189",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro – Payfast Gateway Add On \u003c= 1.4.1 - Unauthenticated Information Exposure",
    "slug": "pmpro-payfast",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30514",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Job Manager \u003c= 0.7.25 - Insecure Direct Object Reference",
    "slug": "job-manager",
    "type": "plugin",
    "affected_version": "* - 0.7.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-6668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6668",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Country Blocker \u003c= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "country-blocker",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54226",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Recall – Registration, Profile, Commerce \u0026 More \u003c= 16.26.5 - Unauthenticated SQL Injection",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32709",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "NiceJob \u003c= 3.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nicejob",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44025",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BIC Media Widget \u003c= 1.0 - Cross-Site Scripting",
    "slug": "bic-media",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4516",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Dynamic Keywords Injector \u003c= 2.3.21 - Reflected Cross-Site Scripting",
    "slug": "wp-dynamic-keywords-injector",
    "type": "plugin",
    "affected_version": "* - 2.3.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32528",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Manager \u003c= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta",
    "slug": "seo-manager",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9521",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Order Export For WooCommerce \u003c= 3.1.7 - Reflected Cross-Site Scripting",
    "slug": "woo-order-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24169",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Header \u0026 Footer Builder \u003c= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1237",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rate my Post – WP Rating System \u003c= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "rate-my-post",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4673",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP on AWS \u003c= 5.2.1 - Reflected Cross-Site Scripting",
    "slug": "wp-migrate-2-aws",
    "type": "plugin",
    "affected_version": "* - 5.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12408",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rollover Tab \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rollover-tab",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23863",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29220",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meow Gallery \u003c= 5.2.7 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "meow-gallery",
    "type": "plugin",
    "affected_version": "* - 5.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47449",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XStore \u003c= 9.3.8 - Unauthenticated SQL Injection",
    "slug": "xstore",
    "type": "theme",
    "affected_version": "* - 9.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33559",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Recip.ly Plugin \u003c= 1.1.8 - Reflected Cross-Site Scripting",
    "slug": "reciply",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23598",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Masterstudy LMS Starter \u003c= 1.1.8 - Unauthenticated Sensitive Information Exposure",
    "slug": "ms-lms-starter-theme",
    "type": "theme",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43990",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple User Profile \u003c= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "simple-user-profile",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25140",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stockholm Core \u003c= 2.4.1 - Reflected Cross-Site Scripting",
    "slug": "stockholm-core",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34553",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Estate 7 \u003c= 3.5.2 - Unauthenticated Privilege Escalation",
    "slug": "realestate-7",
    "type": "theme",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39459",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DPD Baltic Shipping \u003c= 1.2.83 - Reflected Cross-Site Scripting",
    "slug": "woo-shipping-dpd-baltic",
    "type": "plugin",
    "affected_version": "* - 1.2.83",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.83",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9350",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RomethemeForm For Elementor \u003c= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdate",
    "slug": "romethemeform",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6325",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.6.7 - Missing Authorization",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2749",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "ConvertPlug \u003c= 3.5.25 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "convertplug",
    "type": "plugin",
    "affected_version": "* - 3.5.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3240",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gift Cards (Gift Vouchers and Packages) \u003c= 4.3.2 - Unauthenticated SQL Injection",
    "slug": "gift-voucher",
    "type": "plugin",
    "affected_version": "* - 4.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-28662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28662",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Database Backup \u003c= 5.1.1 - Cross-Site Scripting",
    "slug": "wp-database-backup",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14949",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SweepWidget Contests, Giveaways, Photo Contests, Competitions \u003c= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sweepwidget",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11756",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traffic Manager \u003c= 1.4.5 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "traffic-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-42460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42460",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Predictive Search \u003c= 5.8.0 - Cross-Site Request Forgery via multiple AJAX actions",
    "slug": "woocommerce-predictive-search",
    "type": "plugin",
    "affected_version": "* - 5.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32963",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WC Captcha \u003c= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wc-captcha",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46210",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yoast Duplicate Post \u003c= 2.6 - Cross-Site Scripting",
    "slug": "duplicate-post",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-10378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10378",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Incoming Links \u003c 0.9.10b - Stored Cross-Site Scripting",
    "slug": "incoming-links",
    "type": "plugin",
    "affected_version": "[*, 0.9.10b)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.10b",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9472",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple URLs \u003c= 114 - Authenticated (Subscriber+) SQL Injection",
    "slug": "simple-urls",
    "type": "plugin",
    "affected_version": "* - 114",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "114",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0098",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "eCommerce Product Catalog for WordPress \u003c= 3.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ecommerce-product-catalog",
    "type": "plugin",
    "affected_version": "* - 3.3.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47839",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Database Audit \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "database-audit",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23633",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "e.nigma buttons \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "enigma-buttons",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5535",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via \"Labels\"",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10517",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Datepicker \u003c= 2.1.4 - Reflected Cross-Site Scripting",
    "slug": "wp-datepicker",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12468",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopWP \u003c= 2.0.4 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "wpshopify",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-25214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25214",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media File Renamer – Auto \u0026 Manual Rename \u003c= 5.2.5 - Cross-Site Request Forgery",
    "slug": "media-file-renamer",
    "type": "plugin",
    "affected_version": "* - 5.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-36850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36850",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Visualization Charts \u003c= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-visualization-charts",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51862",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DH – Anti AdBlocker \u003c= 36 - Cross-Site Request Forgery",
    "slug": "dh-anti-adblocker",
    "type": "plugin",
    "affected_version": "* - 36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47162",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Affiliate Platform \u003c 6.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-affiliate-platform",
    "type": "plugin",
    "affected_version": "[*, 6.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-5284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5284",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "esri-map-view \u003c= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via esri-map-view Shortcode",
    "slug": "esri-map-view",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6259",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BookingPress \u003c= 1.0.76 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.76",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6219",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mailing Group Listserv \u003c= 3.0.5 - Cross-Site Request Forgery",
    "slug": "wp-mailing-group",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50036",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "XML Sitemaps \u003c= 4.0.9 - Authenticated Cross-Site Scripting",
    "slug": "google-sitemap-generator",
    "type": "plugin",
    "affected_version": "* - 4.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-16204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16204",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Author Box After Posts \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "author-box-after-posts",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46263",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ultimate CSV Importer \u003c= 7.9.8 - Sensitive Information Exposure via Directory Listing",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "* - 7.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4139",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "mybb Last Topics \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mybb-last-topics",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23749",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp NssUser Register \u003c= 1.0.0 - Unauthenticated Privilege Escalation",
    "slug": "wp-nssuser-register",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54363",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Content Pilot – Autoblogging \u0026 Affiliate Marketing Plugin \u003c= 1.3.3 - Authenticated (Contributor+) Content Injection",
    "slug": "wp-content-pilot",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45053",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Singsys -Awesome Gallery \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "awesome-gallery-singsys",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23748",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Superior FAQ \u003c= 1.0.2 - Cross Site Request Forgery",
    "slug": "superior-faq",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-22678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22678",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Media Library Folders \u003c= 8.1.8 - Authenticated (Author+) Directory Traversal",
    "slug": "media-library-plus",
    "type": "plugin",
    "affected_version": "* - 8.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31287",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Display product variations dropdown on shop page \u003c= 1.1.3 - Missing Authorization",
    "slug": "display-product-variations-dropdown-on-shop-page",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32226",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sticky Side Buttons \u003c 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sticky-side-buttons",
    "type": "plugin",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-3666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3666",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TuriTop Booking System \u003c= 1.0.10 - Missing Authorization",
    "slug": "turitop-booking-system",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31541",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Rich Table of Contents \u003c= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "rich-table-of-content",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4551",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Legal Pages \u003c= 1.4.2 - Cross-Site Request Forgery",
    "slug": "legal-pages",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32451",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product GTIN (EAN, UPC, ISBN) for WooCommerce \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "product-gtin-ean-upc-isbn-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0068",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Pro \u003c= 3.19.2 - Authenticated (Contributor+) Information Exposure",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.19.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23523",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Admin Management Xtended \u003c= 2.4.4 - Cross-Site Request Forgery",
    "slug": "admin-management-xtended",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29450",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP GDPR Cookie Consent \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "wp-gdpr-cookie-consen",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53316",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cal.com \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cal-com",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31604",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Library Downloader \u003c= 1.3.1 - Missing Authorization",
    "slug": "media-library-downloader",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46519",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Counter \u003c= 2.0.5 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "social-counter",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46473",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Apptivo Business Site CRM \u003c= 5.3 - Missing Authorization to Arbitrary Content Deletion",
    "slug": "apptivo-business-site",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31909",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slimstat Analytics \u003c= 3.9.2 - Cross-Site Scripting",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "[*, 3.9.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-1204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1204",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HD Quiz \u003c= 1.8.14 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "hd-quiz",
    "type": "plugin",
    "affected_version": "* - 1.8.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13383",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WN Flipbox Pro \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "wn-flipbox-pro",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58847",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Authors List \u003c= 2.0.2 - Reflected Cross-Site Scripting via al_id",
    "slug": "authors-list",
    "type": "plugin",
    "affected_version": "[*, 2.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-37981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37981",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SendPulse Free Web Push \u003c= 1.3.1 - Cross-Site Request Forgery via sendpulse_config",
    "slug": "sendpulse-web-push",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45274",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Select All Text Box \u003c= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-select-all-text-box",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25079",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PostX \u003c= 4.1.15 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 4.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50513",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup Migration \u003c= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6266",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce PDF Vouchers \u003c= 4.9.4 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-pdf-vouchers",
    "type": "plugin",
    "affected_version": "* - 4.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39652",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for WPBakery Page Builder \u003c= 3.19.14 - Authenticated(Contributor+) Local File Inclusion",
    "slug": "Ultimate_VC_Addons",
    "type": "plugin",
    "affected_version": "* - 3.19.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46205",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "bunny.net \u003c= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bunnycdn",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48236",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MP3 Audio Player for Music, Radio \u0026 Podcast by Sonaar \u003c= 4.10.1 - Unauthenticated Arbitrary File Download",
    "slug": "mp3-music-player-by-sonaar",
    "type": "plugin",
    "affected_version": "* - 4.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31343",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jibu Pro \u003c= 1.7 - Authenticated Stored Cross-Site Scripting",
    "slug": "jibu-pro",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-17138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17138",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comment Attachment \u003c= 1.5.5 - Cross-Site Scripting",
    "slug": "comment-attachment",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-6010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6010",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit File Manager – 100% free file manager for WordPress \u003c= 5.2.2 - Subscriber+ Arbitrary File Creation/Upload/Deletion",
    "slug": "file-manager",
    "type": "plugin",
    "affected_version": "* - 5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0403",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Complianz - GDPR/CCPA Cookie Consent \u003c= 6.4.4 - Cross-Site Request Forgery via ajax_create_pages",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33333",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Navigation menu as Dropdown Widget \u003c= 1.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "navigation-menu-as-dropdown-widget",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32126",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HYDRO \u003c= 2.8 - Reflected Cross-Site Scripting",
    "slug": "hydro",
    "type": "theme",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31428",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "News Ticker \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "newsticker",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51830",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fabrica Synced Pattern Instances \u003c= 1.0.8 - Reflected Cross-Site Scripting",
    "slug": "fabrica-reusable-block-instances",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51695",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Game Users Share Buttons \u003c= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter",
    "slug": "game-users-share-buttons",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6755",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Timeline Widget For Elementor (Elementor Timeline, Vertical \u0026 Horizontal Timeline) \u003c= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "timeline-widget-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0977",
    "auth_type": "Auth",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextGEN Gallery \u003c= 2.2.44 - Cross-Site Scripting via image alt and title text",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 2.2.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-1000172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000172",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager \u003c= 4.25 - Reflected Cross-Site Scripting",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38315",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Five Minute Webshop \u003c= 1.3.2 - Authenticated (Admin+) SQL Injection via id",
    "slug": "five-minute-webshop",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1686",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Republish Old Posts \u003c= 1.21 - Cross-Site Request Forgery via rop_options_page",
    "slug": "republish-old-posts",
    "type": "plugin",
    "affected_version": "* - 1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52145",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio \u003c= 3.6.4 - Missing Authorization",
    "slug": "play-ht",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0828",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Betheme \u003c= 27.1.1 - Missing Authorization",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 27.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "27.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47770",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Spell Check \u003c= 7.1.9 - Cross-Site Request Forgery",
    "slug": "wp-spell-check",
    "type": "plugin",
    "affected_version": "* - 7.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-6027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6027",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Statistics \u003c= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via browser",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 13.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-25306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25306",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quform - WordPress Form Builder \u003c= 2.20.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "quform",
    "type": "plugin",
    "affected_version": "* - 2.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8756",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JS Help Desk – Best Help Desk \u0026 Support Plugin \u003c= 2.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51670",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 2.6.8 - Authenticated Stored Cross-Site Scripting",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.6.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10112",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tumult Hype Animations \u003c= 1.9.14 - Missing Authorization",
    "slug": "tumult-hype-animations",
    "type": "plugin",
    "affected_version": "* - 1.9.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10543",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MW WP Form \u003c= 4.4.2 - Directory Traversal via _file_upload",
    "slug": "mw-wp-form",
    "type": "plugin",
    "affected_version": "[*, 4.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-28409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28409",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Project Manager \u003c= 2.6.7 - Missing Authorization",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40003",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slideshow Gallery \u003c 1.4.7 - Arbitrary File Upload",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.4.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-5460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5460",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OnePress \u003c= 2.3.8 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "onepress",
    "type": "theme",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38739",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Element Bucket Addons for Elementor \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cs-element-bucket",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54210",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RK Responsive Contact Form \u003c= 1.0.0 - SQL Injection",
    "slug": "rk-responsive-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-1002027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002027",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks \u003c= 2.2.78 - Unauthenticated Sensitive Information Exposure",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.78",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.78",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32816",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Maspik – Spam blacklist \u003c= 0.7.8 - Cross-Site Request Forgery",
    "slug": "contact-forms-anti-spam",
    "type": "plugin",
    "affected_version": "* - 0.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24008",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multimedia Playlist Slider Addon for WPBakery Page Builder \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "lbg_vp_youtube_vimeo_addon_visual_composer",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48154",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pop Up \u003c= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "popup-seo-optimized",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25105",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode \u003c= 6.18.9 - Cross-Site Request Forgery",
    "slug": "coming-soon",
    "type": "plugin",
    "affected_version": "* - 6.18.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.18.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24540",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Double the Donation \u003c= 2.0.0 - Cross-Site Request Forgery",
    "slug": "double-the-donation",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57930",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.6.6 - Unauthenticated SQL Injection",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "[*, 2.6.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-25114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25114",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Analytics \u003c= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "social-analytics",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23743",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via member_id parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6575",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LSD Google Maps Embedder \u003c= 1.1 - Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "lsd-google-maps-embedder",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23871",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "有赏 You Shang \u003c= 1.0.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "you-shang",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24597",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 AWeber Extension \u003c= 0.1.38 - Missing Authorization",
    "slug": "integrate-contact-form-7-and-aweber",
    "type": "plugin",
    "affected_version": "* - 0.1.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49988",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Fast Total Search \u003c= 1.69.234 - Cross-Site Request Forgery",
    "slug": "fulltext-search",
    "type": "plugin",
    "affected_version": "* - 1.69.234",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.69.234",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38778",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Google+ Comments \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "google-plus-comments",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60186",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60186",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Woo Search \u003c= 2.00 - Information Disclosure",
    "slug": "advanced-woo-search",
    "type": "plugin",
    "affected_version": "* - 1.99",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.99",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-12070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12070",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AI ChatBot with ChatGPT and Content Generator by AYS \u003c= 2.0.9 - Unauthenticated OpenAI Key Exposure",
    "slug": "ays-chatgpt-assistant",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7713",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "User Login Log \u003c= 2.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "user-login-log",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-20056",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20056",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Content Forms for User Submissions (UGC) \u003c= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12037",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "140+ Widgets | Xpro Addons For Elementor – FREE \u003c= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget",
    "slug": "xpro-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.4.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7791",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SlideDeck 1 Lite Content Slider \u003c= 1.4.8 - Reflected Cross-Site Scripting",
    "slug": "slidedeck-lite-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13224",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Form Integration \u003c= 1.75.0 - Authenticated(Administrator+) SQL Injection",
    "slug": "advanced-form-integration",
    "type": "plugin",
    "affected_version": "[*, 1.76.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.76.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50853",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LearnPress \u003c= 4.1.7.3.2 - Unauthenticated SQL Injection",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.1.7.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.7.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-45808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45808",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.976",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.976",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4488",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crony Cronjob Manager \u003c 0.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "crony",
    "type": "plugin",
    "affected_version": "[*, 0.4.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-14530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14530",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "URL Shortener | Conversion Tracking | AB Testing | WooCommerce \u003c= 9.0.2 - Reflected Cross-Site Scripting",
    "slug": "easy-broken-link-checker",
    "type": "plugin",
    "affected_version": "* - 9.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13868",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print Barcode Labels for your WooCommerce products/orders \u003c= 3.4.10 - Missing Authorization",
    "slug": "a4-barcode-generator",
    "type": "plugin",
    "affected_version": "* - 3.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24603",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Store Toolkit for WooCommerce \u003c= 1.5.6 - Missing Authorization",
    "slug": "woocommerce-store-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10922",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy CountDowner \u003c= 1.0.8 - Cross-Site Request Forgery",
    "slug": "easy-countdowner",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32538",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto Affiliate Links \u003c= 6.3.0.2 - Cross-Site Request Forgery via aalChangeOptions function",
    "slug": "wp-auto-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 6.3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25973",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe Notes",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0384",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 1.1.35 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "easy-notify-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.35",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-46230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46230",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UpdraftPlus WordPress Backup Plugin \u003c= 1.16.68 - Reflected Cross-Site Scripting via updraft_restore",
    "slug": "updraftplus",
    "type": "plugin",
    "affected_version": "0.7.4 - 1.16.68",
    "from_version": "0.7.4",
    "from_inclusive": true,
    "to_version": "1.16.68",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25089",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Service Finder Bookings \u003c= 6.0 - Unauthenticated Privilege Escalation via claim_business",
    "slug": "sf-booking",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5948",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fullscreen Galleria \u003c= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fullscreen-galleria",
    "type": "plugin",
    "affected_version": "* - 1.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29801",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \u003c= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data Reset",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.6.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1760",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP eStore \u003c= 8.5.5 - Reflected Cross-Site Scripting via Product Editing",
    "slug": "wp-cart-for-digital-products",
    "type": "plugin",
    "affected_version": "* - 8.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6134",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg'",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-40000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40000",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Links: WordPress Plugin for Link Cloaking and Link Management \u003c= 3.0.1 - Missing Authorization to Unauthenticated Import/Export and PHP Object Injection",
    "slug": "affiliate-links",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13556",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Block Editor Bootstrap Blocks \u003c= 6.6.1 - Reflected Cross-Site Scripting via tab",
    "slug": "block-editor-bootstrap-blocks",
    "type": "plugin",
    "affected_version": "* - 6.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11402",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.46 - Contributor+ Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2101",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Omnipress \u003c= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "omnipress",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53276",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Page Builder \u003c= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widget",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "* - 5.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5344",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Hero with Animation, Video Background \u0026 Intro Maker \u003c= 8.2.6 - SQL Injection",
    "slug": "slider-hero",
    "type": "plugin",
    "affected_version": "[*, 8.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24506",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "XLTab – Accordions and Tabs for Elementor Page Builder \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "xl-tab",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47375",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress \u003c= 4.7.3 - Authenticated (Administrator+) PHP Object Injection",
    "slug": "gallery-plugin",
    "type": "plugin",
    "affected_version": "* - 4.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13906",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slingblocks",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38684",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyCryptoCheckout \u003c= 2.123 - Reflected Cross-Site Scripting via url",
    "slug": "mycryptocheckout",
    "type": "plugin",
    "affected_version": "* - 2.123",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.123",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1546",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Make Paths Relative \u003c= 1.3.0 - Cross-Site Request Forgery via 'admin/class-make-paths-relative-admin.php'",
    "slug": "make-paths-relative",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27433",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Slider \u003c= 1.1.125 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "image-slider-widget",
    "type": "plugin",
    "affected_version": "* - 1.1.125",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.125",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32707",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "About Me \u003c= 1.0.12 - Missing Authorization",
    "slug": "about-me",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36387",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.8.28 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8670",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Watu Quiz \u003c= 3.3.9.2 - Reflected Cross-Site Scripting via 'question'",
    "slug": "watu",
    "type": "plugin",
    "affected_version": "* - 3.3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30483",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Websand Subscription Form \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "websand-subscription-form",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51923",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ND Booking \u003c= 2.4 - Unauthenticated Arbitrary Options Update",
    "slug": "nd-booking",
    "type": "plugin",
    "affected_version": "[*, 2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-15774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15774",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function",
    "slug": "http-https-remover",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function",
    "slug": "copy-delete-posts",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function",
    "slug": "ultimate-social-media-plus",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function",
    "slug": "ultimate-posts-widget",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function",
    "slug": "pop-up-pop-up",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function",
    "slug": "redirect-redirection",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function",
    "slug": "wp-clone-by-wp-academy",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function",
    "slug": "ultimate-social-media-icons",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function",
    "slug": "feedburner-alternative-and-rss-redirect",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function",
    "slug": "enhanced-text-widget",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Post Duplicator \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "easy-post-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32538",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gift Cards for WooCommerce \u003c= 1.5.8 - Missing Authorization",
    "slug": "woo-giftcards",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31781",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Soledad \u003c= 8.2.5 - Authenticated (Subscriber+) Cross-Site Scripting",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41788",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GPT3 AI Content Writer \u003c= 1.8.66 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gpt3-ai-content-generator",
    "type": "plugin",
    "affected_version": "* - 1.8.66",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.66",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37465",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "amCharts: Charts and Maps \u003c= 1.4.4 - Reflected Cross-Site Scripting via Cross-Site Request Forgery",
    "slug": "amcharts-charts-and-maps",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8622",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Useinfluence \u003c= 1.0.8 - Cross-Site Request Forgery",
    "slug": "useinfluence",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31625",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPLMS \u003c 1.9.9.5.2 - Authenticated (Student+) Arbitrary File Upload",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "[*, 1.9.9.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-56052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56052",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Crowdfunding for WooCommerce \u003c= 3.1.12 - Reflected Cross-Site Scripting",
    "slug": "crowdfunding-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32628",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Index Now \u003c= 2.6.3 - Cross-Site Request Forgery via reset_form",
    "slug": "mihdan-index-now",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0428",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"
  },
  {
    "title": "GiveWP \u003c= 2.3.0 - Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "[*, 2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-9909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9909",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Countdown Widget \u003c= 3.1.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wordpress-countdown-widget",
    "type": "plugin",
    "affected_version": "* - 3.1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2944",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Conferencing with Zoom \u003c= 3.8.16 - E-mail Address Disclosure",
    "slug": "video-conferencing-with-zoom-api",
    "type": "plugin",
    "affected_version": "[*, 3.8.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0384",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Login Alert \u003c= 0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "login-alert",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31459",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Leyka \u003c= 3.30.1 - Reflected Cross-Site Scripting",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "* - 3.30.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.30.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33325",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smooth Scroll Links \u003c= 1.1.0 - Cross-Site Request Forgery",
    "slug": "smooth-scrolling-links-ssl",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46095",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HMS Testimonials \u003c 2.0.11 - Cross-Site Scripting",
    "slug": "hms-testimonials",
    "type": "plugin",
    "affected_version": "[*, 2.0.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-4241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4241",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 2.7.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2716",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Wilmer Core \u003c= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wilmer-core",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0693",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Awin – Advertiser Tracking for WooCommerce \u003c= 2.0.0 - Cross-Site Request Forgery",
    "slug": "awin-advertiser-tracking",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47633",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hydra Booking \u003c= 1.1.10 - Authenticated (Contributor+) SQL Injection",
    "slug": "hydra-booking",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49323",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via  Advanced Accordion Title Tags",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.971",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.971",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3889",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Googlebot Visit \u003c= 1.2.4 - Missing Authorization to Settings Update",
    "slug": "simple-googlebot-visit",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38479",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Morning Coffee \u003c 3.6 - Cross-Site Scripting",
    "slug": "morning-coffee",
    "type": "theme",
    "affected_version": "[*, 3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-3862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3862",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Emailing Subscription \u003c= 1.4.1 - Unauthenticated SQL Injection",
    "slug": "email-suscripcion",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22540",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "VN Calendar \u003c= 1.0 - Cross-Site Scripting",
    "slug": "vn-calendar",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4571",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Interactive Contact Form and Multi Step Form Builder with Drag \u0026 Drop Editor – Funnelforms Free \u003c= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Deletion",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.7.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5857",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Advanced Data Table For Elementor \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-data-table-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel Engine \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wte-elementor-widgets",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59574",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP All Export Pro \u003c= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields",
    "slug": "wp-all-export-pro",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7419",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "CBX Accounting \u0026 Bookkeeping \u003c= 1.3.14 - Reflected Cross-Site Scripting",
    "slug": "cbxwpsimpleaccounting",
    "type": "plugin",
    "affected_version": "* - 1.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23622",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Implied Cookie Consent \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "implied-cookie-consent",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25113",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Directory Kit \u003c= 1.2.9 - Reflected Cross-Site Scripting",
    "slug": "wpdirectorykit",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29774",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiParcels Shipping For WooCommerce \u003c 1.16.9 - Cross-Site Request Forgery",
    "slug": "multiparcels-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.16.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-32095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32095",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Vayu Blocks – Gutenberg Blocks for WordPress \u0026 WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update",
    "slug": "vayu-blocks",
    "type": "plugin",
    "affected_version": "1.0.4 - 1.2.1",
    "from_version": "1.0.4",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2568",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blocksy Companion \u003c= 2.0.28 - Cross-Site Request Forgery",
    "slug": "blocksy-companion",
    "type": "plugin",
    "affected_version": "* - 2.0.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31932",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Support Plus Responsive Ticket System \u003c= 4.1 - Improper Authentication",
    "slug": "wp-support-plus-responsive-ticket-system",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-10389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10389",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Classify \u003c= 1.0.0 - Unauthenticated Arbitrary File Upload",
    "slug": "image-classify",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-51789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51789",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Companion Portfolio – Responsive Portfolio Plugin \u003c= 2.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "companion-portfolio",
    "type": "plugin",
    "affected_version": "* - 2.4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11867",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Widgets \u003c= 1.5.10 - Refletced Cross-Site Scripting",
    "slug": "dynamic-widgets",
    "type": "plugin",
    "affected_version": "[*, 1.5.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9437",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments \u003c 3.1.2 - SQL Injection",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "[*, 3.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-15659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15659",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kanpress \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kanpress",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48356",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "is-human \u003c= 1.4.2 - Unauthenticated Remote Code Execution",
    "slug": "is-human",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2011-10033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-10033",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Olive One Click Demo Import \u003c= 1.1.2 - Unauthenticated Information Exposure",
    "slug": "olive-one-click-demo-import",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38749",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress \u003c= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation",
    "slug": "youtube-showcase",
    "type": "plugin",
    "affected_version": "* - 3.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3268",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking Calendar - Clockwork SMS \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "booking-sms",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18555",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donations Made Easy – Smart Donations \u003c= 4.0.12 - Authenticated (Administrator+) SQL Injection",
    "slug": "smart-donations",
    "type": "plugin",
    "affected_version": "* - 4.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-40207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40207",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BookX \u003c= 1.7 - Path Traversal",
    "slug": "bookx",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4937",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Create with Code \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "create-with-code",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24638",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.7, 3.7.37)",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.37",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.0, 4.0.34)",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.34",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.4, 4.4.26)",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.26",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.7, 4.7.22)",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.22",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.9, 4.9.19)",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.0, 5.0.15)",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.6, 5.6.7)",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.7, 5.7.5)",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.3, 4.3.27)",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.27",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.6, 4.6.22)",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.22",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.2, 5.2.14)",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.3, 5.3.11)",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.4, 5.4.9)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.8, 5.8.3)",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.8, 3.8.37)",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.37",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.9, 3.9.35)",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.35",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.1, 4.1.34)",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.34",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.5, 4.5.25)",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.25",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.8, 4.8.18)",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.2, 4.2.31)",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.31",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.1, 5.1.12)",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - Super Admin Multi-Site Installation Object Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.5, 5.5.8)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-21663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21663",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Testimonial Slider \u003c= 2.0.13 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "testimonial",
    "type": "plugin",
    "affected_version": "* - 2.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30889",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zooom \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zooom",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11451",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPJobBoard \u003c= 5.9.0 - Unauthenticated SQL Injection",
    "slug": "wpjobboard",
    "type": "plugin",
    "affected_version": "* - 5.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-36525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36525",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Structured Content \u003c= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "structured-content",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49820",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVG Support \u003c= 2.5.8 - Stored Cross-Site Scripting via Vulnerability Dependency",
    "slug": "svg-support",
    "type": "plugin",
    "affected_version": "* - 2.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-23638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23638",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schema App Structured Data \u003c= 2.2.0 - Missing Authorization",
    "slug": "schema-app-structured-data-for-schemaorg",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0893",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Social Feed Gallery \u003c= 4.3.9 - Missing Authorization",
    "slug": "insta-gallery",
    "type": "plugin",
    "affected_version": "* - 4.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39640",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Field Template \u003c= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "custom-field-template",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44062",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Migrate Pro \u003c= 2.6.10 - Unauthenticated PHP Object Injection",
    "slug": "wp-migrate-db-pro",
    "type": "plugin",
    "affected_version": "* - 2.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30225",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Live.php \u003c= 1.2.1 - Cross-Site Scripting",
    "slug": "wp-livephp",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-5346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5346",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IMGspider \u003c= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'",
    "slug": "imgspider",
    "type": "plugin",
    "affected_version": "* - 2.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6319",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6319",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPAdverts \u003c= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpadverts",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49878",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Abandoned Cart Lite for WooCommerce \u003c= 5.16.1 - Missing Authorization via multiple AJAX functions",
    "slug": "woocommerce-abandoned-cart",
    "type": "plugin",
    "affected_version": "* - 5.16.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.16.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41671",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "SurveyAnyplace Plugin \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "surveyanyplace",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10196",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4367",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution \u003c= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2789",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Yoast SEO \u003c= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "* - 22.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "22.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4984",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flatsome \u003c= 3.16.8 - Reflected Cross-Site Scripting in UX Builder",
    "slug": "flatsome",
    "type": "theme",
    "affected_version": "* - 3.16.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28994",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IE CSS3 Support \u003c= 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "ie-css3-support",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26589",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FAQ Builder AYS \u003c= 1.3.5 - Blind SQL Injection",
    "slug": "faq-builder-ays",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24461",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Business Intelligence Lite \u003c= 1.6.2 - SQL Injection",
    "slug": "wp-business-intelligence-lite",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9326",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Custom Fields Pro \u003c= 6.3.1 - Missing Authorization",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "* - 6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37250",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP SMS \u003c= 5.4.12 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-sms",
    "type": "plugin",
    "affected_version": "[*, 5.4.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24561",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rio Video Gallery \u003c= 2.3.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "rio-video-gallery",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31566",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Homey \u003c= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile",
    "slug": "homey",
    "type": "theme",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12281",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12281",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Social Feed \u003c= 6.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 6.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4474",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventer - WordPress Event \u0026 Booking Manager Plugin \u003c= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id",
    "slug": "eventer",
    "type": "plugin",
    "affected_version": "* - 3.9.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0959",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.9.5 - Contributor+ Arbitrary Thumbnail Removal",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "[*, 3.9.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24698",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Discy - Social Questions and Answers WordPress Theme \u003c= 4.9 - Missing Authorization",
    "slug": "discy",
    "type": "theme",
    "affected_version": "* - 4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1323",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Puzzles | WP Magazine / Review with Store WordPress Theme + RTL \u003c= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "puzzles",
    "type": "theme",
    "affected_version": "* - 4.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13769",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.1.15 - Authenticated (Admin+) Remote Code Execution",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52393",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Black Widgets For Elementor \u003c= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "black-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39662",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.17 - Authenticated(Contributor+) Stored Cross-Site Scripting via Link Wrapper",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0326",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Lesson Booking \u003c= 0.8.6 - Cross-Site Request Forgery",
    "slug": "online-lesson-booking-system",
    "type": "plugin",
    "affected_version": "* - 0.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-5973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5973",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MStore API \u003c= 3.9.2 - Authentication Bypass",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2732",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ReDi Restaurant Reservation \u003c= 24.0902 - Reflected Cross-Site Scripting",
    "slug": "redi-restaurant-reservation",
    "type": "plugin",
    "affected_version": "* - 24.0902",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.0902",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9240",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sina Extension for Elementor \u003c= 3.5.91 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Sina Image Differ",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.5.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12624",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed and Integrate Etsy Shop \u003c= 1.0.4 - Missing Authorization",
    "slug": "embed-and-integrate-etsy-shop",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48346",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Comment Form WP \u0026#8211; Customize Default Comment Form \u003c= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "comment-form-wp",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58825",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "W3 Total Cache \u003c= 2.1.4 - Reflected Cross-Site Scripting via extension",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "0.5 - 2.1.4",
    "from_version": "0.5",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24452",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Go Pricing - WordPress Responsive Pricing Tables \u003c= 3.3.19 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "go_pricing",
    "type": "plugin",
    "affected_version": "* - 3.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2500",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GMAPS for WPBakery Page Builder Free \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gmaps-for-visual-composer-free",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23775",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Envato Affiliater \u003c= 1.2.4 - Reflected Cross-Site Scripting",
    "slug": "envato-affiliater",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23431",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Table Plugin  - \u003c 2.3 - Cross-Site Request Forgery",
    "slug": "arprice-responsive-pricing-table",
    "type": "plugin",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-14679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14679",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Epeken All Kurir \u003c= 2.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "epeken-all-kurir",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57906",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TextBuilder 1.0.0 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation via Account Takeover",
    "slug": "textbuilder",
    "type": "plugin",
    "affected_version": "1.0.0 - 1.1.1",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9213",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Molongui \u003c= 4.7.7 - Authenticated (Author+) Insecure Direct Object Reference",
    "slug": "molongui-authorship",
    "type": "plugin",
    "affected_version": "* - 4.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30507",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "White Label Branding for Elementor Page Builder \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "white-label-branding-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23683",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress \u003c= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quillforms",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11826",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Delivery Date Pro for WooCommerce \u003c 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure",
    "slug": "order-delivery-date",
    "type": "plugin",
    "affected_version": "[2.0, 12.6.0)",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "12.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-2942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2942",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Modal Window \u003c= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode",
    "slug": "modal-window",
    "type": "plugin",
    "affected_version": "* - 6.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0897",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Streamit \u003c= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover",
    "slug": "streamit",
    "type": "theme",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2526",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Maps Anywhere \u003c= 1.2.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "google-maps-anywhere",
    "type": "plugin",
    "affected_version": "* - 1.2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2424",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "re.place \u003c= 0.2.1 - Cross-Site Request Forgery",
    "slug": "replace",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53338",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3638",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gravity Forms  \u003c= 2.7.3 - Unauthenticated PHP Object Injection",
    "slug": "gravityforms",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-28782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28782",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery (Pro) \u003c= 19.1.5 - SQL Injection via option_id",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4150",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery (Pro) \u003c= 19.1.5 - SQL Injection via option_id",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4150",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "miniOrange's Google Authenticator \u003c= 5.4.52 - Unauthenticated Arbitrary Options Deletion",
    "slug": "miniorange-2-factor-authentication",
    "type": "plugin",
    "affected_version": "* - 5.4.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.52",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0229",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "License Manager for WooCommerce \u003c= 2.2.10 - Authenticated (Administrator+) SQL Injection",
    "slug": "license-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48742",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mermaid \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-mermaid",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53748",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FTP Sync \u003c= 1.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ftp-sync",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28892",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DigitalOcean Spaces Sync \u003c= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "do-spaces-sync",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49047",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliate Reviews \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via numColumns Parameter",
    "slug": "affiliate-reviews",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5845",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Albo Pretorio Online \u003c= 4.6.3 - Reflected Cross-Site Scripting",
    "slug": "albo-pretorio-on-line",
    "type": "plugin",
    "affected_version": "* - 4.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32109",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Convert Pro \u003c= 1.7.5 - Missing Authorization",
    "slug": "convertpro",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36684",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "ElementInvader Addons for Elementor \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementinvader-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38705",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "External Video For Everybody \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "external-video-for-everybody",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25097",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sky Addons for Elementor \u003c= 2.5.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sky-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.5.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50433",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Community Yard Sale \u003c= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "community-yard-sale",
    "type": "plugin",
    "affected_version": "* - 1.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51846",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Email Marketing Plugin – WP Email Capture \u003c= 3.9.3 - Cross Site Request Forgery",
    "slug": "wp-email-capture",
    "type": "plugin",
    "affected_version": "* - 3.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23724",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AdMail – Multilingual Back in-Stock Notifier for WooCommerce \u003c= 1.7.0 - Missing Authorization",
    "slug": "admail",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32234",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "M-vSlider \u003c= 2.1.3 - Authenticated (Admin+) SQL Injection",
    "slug": "m-vslider",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24557",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13554",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MP3 Audio Player – Music Player, Podcast Player \u0026 Radio by Sonaar \u003c= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed",
    "slug": "mp3-music-player-by-sonaar",
    "type": "plugin",
    "affected_version": "* - 5.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13157",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hide Text Shortcode \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hide-text-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49051",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plugin Permalink \u003c= 2.4.3.1 - Missing Authorization via get_uri_editor",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2543",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 2.4.3 - Reflected Cross-Site Scripting",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-125110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-125110",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Bannerize Pro \u003c= 1.10.0 - Authenticated (Editor+) Server-Side Request Forgery",
    "slug": "wp-bannerize-pro",
    "type": "plugin",
    "affected_version": "* - 1.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58615",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "oik \u003c= 4.15.2 - Cross-Site Request Forgery",
    "slug": "oik",
    "type": "plugin",
    "affected_version": "* - 4.15.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54671",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPS Hide Login \u003c= 1.5.4.2 - Hidden Login Page Location Disclosure",
    "slug": "wps-hide-login",
    "type": "plugin",
    "affected_version": "* - 1.5.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36710",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Download Monitor \u003c 1.7.1 - Reflected Cross-Site Scripting",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "[*, 1.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9296",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Winning Portfolio \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "winning-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23865",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flexi - Guest Submit  \u003c 4.20 - Reflected Cross-Site Scripting",
    "slug": "flexi",
    "type": "plugin",
    "affected_version": "[*, 4.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.20",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0449",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Philantro – Donations and Donor Management \u003c= 5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via donate Shortcode",
    "slug": "philantro",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13527",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Mobile-BankID-Integration \u003c= 1.0.0 - PHP Object Injection",
    "slug": "WP-Mobile-BankID-Integration",
    "type": "plugin",
    "affected_version": "[*, 1.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-51700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51700",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BannerMan \u003c= 0.2.4 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "bannerman",
    "type": "plugin",
    "affected_version": "* - 0.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4845",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation",
    "slug": "newspaper-x",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36721",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation",
    "slug": "brilliance",
    "type": "theme",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36721",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation",
    "slug": "activello",
    "type": "theme",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36721",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Newsletter Manager \u003c 1.4 - Cross-Site Request Forgery",
    "slug": "newsletter-manager",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-6629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6629",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Access Code Feeder \u003c= 1.0.3 - Missing Authorization",
    "slug": "access-code-feeder",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38059",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Beds24 Online Booking \u003c= 2.0.29 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beds24-online-booking",
    "type": "plugin",
    "affected_version": "* - 2.0.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47489",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Countdown Timer for Elementor \u003c= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'",
    "slug": "countdown-timer-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shopping Cart \u0026 eCommerce Store \u003c= 5.6.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-easycart",
    "type": "plugin",
    "affected_version": "* - 5.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3211",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CM Answers \u003c= 3.3.3 - Cross-Site Request Forgery",
    "slug": "cm-answers",
    "type": "plugin",
    "affected_version": "* - 3.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46246",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "reSmush.it Image Optimizer \u003c= 0.4.5 - Authenticated (Administrator+) Cross-Site Scripting",
    "slug": "resmushit-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 0.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2448",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hustle – Email Marketing, Lead Generation, Optins, Popups \u003c= 7.8.5 - Missing Authorization to Unauthorized Form Submission",
    "slug": "wordpress-popup",
    "type": "plugin",
    "affected_version": "* - 7.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10580",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "First Order Discount Woocommerce \u003c= 1.21 - Cross-Site Request Forgery",
    "slug": "first-order-discount-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49843",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive Lightbox \u003c= 2.4.7 - Missing Authorization",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43924",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BeeTeam368 Extensions \u003c= 2.3.5 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "beeteam368-extensions",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6423",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Management \u003c= 1.2 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "user-management",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22736",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pagelayer \u003c= 1.7.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via Header/Footer code",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "[*, 1.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5124",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.16.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9634",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Helper Premium \u003c= 4.5.1 - Cross-Site Request Forgery via whp_fields",
    "slug": "wp-helper-lite",
    "type": "plugin",
    "affected_version": "* - 4.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46614",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Customily Product Personalizer \u003c= 1.23.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "customily-v2",
    "type": "plugin",
    "affected_version": "* - 1.23.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1774",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Automator – Easy Automation, Integration, Webhooks \u0026 Workflow Builder Plugin \u003c= 6.2 - Authenticated (Admin+) Server-Side Request Forgery via Webhook",
    "slug": "uncanny-automator",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13838",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.5.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2661",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hero Slider - WordPress Slider Plugin \u003c= 1.3.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "hslide",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13809",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WS Facebook Like Box Widget \u003c= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ws-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4963",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Banner \u003c= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-banner",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12769",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Syncee – Global Dropshipping \u003c= 1.0.9 - Missing Authorization.",
    "slug": "syncee-global-dropshipping",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3694",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Toolbar Plugin \u003c= 2.2.6 - Open Redirect via wptbto",
    "slug": "wordpress-toolbar",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6389",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Payment QR WooCommerce \u003c= 1.1.6 - Missing Authorization",
    "slug": "payment-qr-woo",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31000",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MailChimp Forms by MailMunch \u003c= 3.1.7 - Cross-Site Request Forgery via Multiple AJAX actions",
    "slug": "mailchimp-forms-by-mailmunch",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45748",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Restaurant Menu and Food Ordering \u003c= 2.4.16 - Missing Authorization to Menu Creation",
    "slug": "food-and-drink-menu",
    "type": "plugin",
    "affected_version": "* - 2.4.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5459",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "StoreKeeper for WooCommerce \u003c= 14.4.4 - Unauthenticated Arbitrary File Upload",
    "slug": "storekeeper-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 14.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48148",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.61.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.61.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10614",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cyrlitera \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "cyrlitera",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53254",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 2.8.28 - Cross-Site Request Forgery Bypass",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 2.8.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4415",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive Contact Form Builder \u0026 Lead Generation Plugin \u003c= 1.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "lead-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3637",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N"
  },
  {
    "title": "Booking Activities \u003c= 1.15.19 - Reflected Cross-Site Scripting",
    "slug": "booking-activities",
    "type": "plugin",
    "affected_version": "* - 1.15.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30449",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Credova_Financial \u003c= 2.4.8 - Reflected Cross-Site Scripting",
    "slug": "credova-financial",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32588",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Invitation Based Registrations \u003c= 2.2.84 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "invitation-based-registrations",
    "type": "plugin",
    "affected_version": "* - 2.2.84",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.84",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2325",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Propovoice \u003c= 1.7.6.7 - Unauthenticated Arbitrary File Read",
    "slug": "propovoice",
    "type": "plugin",
    "affected_version": "* - 1.7.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8422",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Stray Random Quotes \u003c= 1.9.9 - Reflected Cross-Site Scripting",
    "slug": "stray-quotes",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23883",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.44",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3242",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bulk Watermark \u003c= 1.6.10 - Cross-Site Request Forgery",
    "slug": "bulk-watermark",
    "type": "plugin",
    "affected_version": "* - 1.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58845",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Travelers' Map \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "travelers-map",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29909",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Molongui \u003c= 4.7.3 - Missing Authorization",
    "slug": "molongui-authorship",
    "type": "plugin",
    "affected_version": "* - 4.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50876",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Sunshine Photo Cart: Free Client Galleries for Photographers \u003c= 3.0.24 - Unauthenticated Sensitive Information Exposure via Invoice",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 3.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1294",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Category Post Slider \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "category-post-slider",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11878",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPForms – Easy Form Builder for WordPress \u003c= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion",
    "slug": "wpforms-lite",
    "type": "plugin",
    "affected_version": "* - 1.9.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10593",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Companion Auto Update \u003c= 3.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via update_delay_days parameter",
    "slug": "companion-auto-update",
    "type": "plugin",
    "affected_version": "* - 3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4369",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.24.12 - Unuathenticated Remote Code Execution",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.24.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11635",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stylish Google Sheet Reader \u003c= 4.0 - Reflected Cross-Site Scripting",
    "slug": "stylish-google-sheet-reader",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13863",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ThemeREX Addons \u003c= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "* - 2.35.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.35.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6997",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Socializer \u003c= 7.13.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "super-socializer",
    "type": "plugin",
    "affected_version": "* - 7.13.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.13.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4484",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "de:branding \u003c= 1.0.2 - Privilege Escalation",
    "slug": "debranding",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52438",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tours \u003c= 1.0.0 - Missing Authorization",
    "slug": "tours",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51666",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sitekit \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sitekit",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58229",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSprite \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "csprite",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49763",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GamiPress \u003c= 6.8.8 - Broken Access Control",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 6.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2505",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pushe Web Push Notification \u003c= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pushe-webpush",
    "type": "plugin",
    "affected_version": "* - 0.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58873",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP FEvents Book \u003c= 0.46 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wp-fevents-book",
    "type": "plugin",
    "affected_version": "* - 0.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1126",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Templatera \u003c= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "templatera",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login by Auth0 \u003c= 3.11.3 - Cross-Site Request Forgery",
    "slug": "auth0",
    "type": "plugin",
    "affected_version": "* - 3.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-5391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5391",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Go Maps \u003c= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "* - 9.0.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4839",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Error Log Viewer \u003c= 1.1.1 - Arbitrary File Deletion",
    "slug": "error-log-viewer",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24966",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Contact Form to Any API \u003c= 1.1.2 - Authenticated (Administrator+) SQL Injection via 'form_id'",
    "slug": "contact-form-to-any-api",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32741",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI ChatBot \u003c= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5534",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "4.9.2",
    "from_version": "4.9.2",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5534",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Google Map \u003c= 1.8.3 - Arbitrary Post Deletion and Plugin Settings Update via Cross-Site Request Forgery",
    "slug": "gmap-embed",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25081",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Auto Affiliate Links \u003c= 6.4.6 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-auto-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 6.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9838",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Stock Ticker \u003c= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scritping",
    "slug": "stock-ticker",
    "type": "plugin",
    "affected_version": "* - 3.23.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.23.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51541",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Tickets \u003c= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure",
    "slug": "event-tickets",
    "type": "plugin",
    "affected_version": "* - 5.18.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.18.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13457",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Sign-up Sheets \u003c= 1.0.13 - Authenticated CSV Injection",
    "slug": "sign-up-sheets",
    "type": "plugin",
    "affected_version": "[*, 1.0.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24441",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Laybuy Payment Extension for WooCommerce \u003c= 5.3.9 - Missing Authorization",
    "slug": "laybuy-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37203",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9562",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Doliconnect \u003c= 9.5.7 - Cross-Site Request Forgery",
    "slug": "doliconnect",
    "type": "plugin",
    "affected_version": "* - 9.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58690",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Authors List \u003c= 2.0.4 - Unauthenticated Arbitrary Shortcode Execution via update_authors_list_ajax",
    "slug": "authors-list",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10952",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Mitfahrgelegenheit \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter",
    "slug": "mitfahrgelegenheit",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8392",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tiny Carousel Horizontal Slider \u003c= 8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tiny-carousel-horizontal-slider",
    "type": "plugin",
    "affected_version": "* - 8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44229",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slimstat Analytics \u003c= 5.0.4 - Reflected Cross-Site Scripting",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45366",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Best Restaurant Menu by PriceListo \u003c= 1.4.2 - Missing Authorization",
    "slug": "best-restaurant-menu-by-pricelisto",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49698",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WpF Ultimate Carousel \u003c= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpf-ultimate-carousel",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23933",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy Page Builder \u003c= 2.4.1 - Authenticated Stored Cross-Site Scripting via Element Content",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2041",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Advertising System \u003c= 1.3.1 - Open Redirect",
    "slug": "advanced-advertising-system",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3433",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kognetiks Chatbot for WordPress \u003c= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Addition",
    "slug": "chatbot-chatgpt",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10530",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Connections Business Directory \u003c= 10.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "connections",
    "type": "plugin",
    "affected_version": "* - 10.4.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.4.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29437",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Formidable Form Builder \u003c= 4.09.04 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "formidable",
    "type": "plugin",
    "affected_version": "[*, 4.09.05)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.09.05",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24884",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "DL Robots.txt \u003c= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "dl-robotstxt",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6797",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Access Manager \u003c= 5.9.8.1 - Unauthenticated Arbitrary File Read",
    "slug": "advanced-access-manager",
    "type": "plugin",
    "affected_version": "[*, 5.9.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-25213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25213",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "XTRA Settings \u003c= 2.1.8 - Reflected Cross-Site Scripting",
    "slug": "xtra-settings",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23729",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InstaWP Connect \u003c= 0.1.0.9 - Missing Authorization to Sensitive Information Dislcosure",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23506",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Pre-Publish Post Checklist \u003c= 3.1 - Missing Authorization",
    "slug": "pre-publish-post-checklist",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53323",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bit.ly linker \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "bitly-linker",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23674",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quicksand Post Filter jQuery Plugin \u003c= 3.1.1 - Cross-Site Request Forgery via renderAdmin",
    "slug": "quicksand-jquery-post-filter",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24849",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Master Slider \u003c= 3.10.0 - Reflected Cross-Site Scripting",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37222",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elegant Themes Monarch \u003c 1.2.7 - Privilege Escalation",
    "slug": "bloom",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-11004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11004",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elegant Themes Monarch \u003c 1.2.7 - Privilege Escalation",
    "slug": "divi-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-11004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11004",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elegant Themes Monarch \u003c 1.2.7 - Privilege Escalation",
    "slug": "monarch",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-11004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11004",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Expert Invoice \u003c= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "expert-invoice",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5172",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder Pro \u003c= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.20.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1521",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.12.2 - Directory Traversal to Remote Code Execution",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.12.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.12.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-10564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10564",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sunshine Photo Cart \u003c= 2.9.14 - Reflected Cross-Site Scripting",
    "slug": "sunshine-photo-cart",
    "type": "plugin",
    "affected_version": "* - 2.9.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4301",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Top 10 – Popular posts plugin for WordPress \u003c= 3.2.3 - Missing Authorization on tptn_ajax_clearcache",
    "slug": "top-10",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25993",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cooked \u003c= 1.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cooked",
    "type": "plugin",
    "affected_version": "* - 1.7.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44477",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fast WP Speed \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "fast-wp-speed",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45770",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress Groups Extras \u003c= 3.6.10 - Cross-Site Request Forgery",
    "slug": "buddypress-groups-extras",
    "type": "plugin",
    "affected_version": "* - 3.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24538",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Media \u0026 Share Icons \u003c= 2.8.3 - Reflected Cross-Site Scripting",
    "slug": "ultimate-social-media-icons",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41238",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GPT3 AI Content Writer \u003c= 1.8.12 - Cross-Site Request Forgery",
    "slug": "gpt3-ai-content-generator",
    "type": "plugin",
    "affected_version": "* - 1.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51528",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7092",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.5.2 -  Missing Authorization Checks",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2200",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Zendesk Support for WordPress \u003c= 1.8.4 - Cross-Site Request Forgery",
    "slug": "zendesk",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23716",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pretty Links – Link Management, Branding, Tracking \u0026 Sharing Plugin \u003c= 1.6.7 - SQL Injection",
    "slug": "pretty-link",
    "type": "plugin",
    "affected_version": "[*, 1.6.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9457",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Static Page eXtended \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "jp-staticpagex",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1763",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Podlove Subscribe button \u003c= 1.3.7 - Cross-Site Request Forgery via save function",
    "slug": "podlove-subscribe-button",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25481",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Widgets for Tiktok Feed \u003c= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "widgets-for-tiktok-video-feed",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8906",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post By Email \u003c= 1.0.4b - Reflected Cross-Site Scripting",
    "slug": "post-by-email",
    "type": "plugin",
    "affected_version": "* - 1.0.4b",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4b",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52463",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Sync ActiveCampaign \u003c= 1.3.2 - Missing Authorization",
    "slug": "registered-user-sync-activecampaign",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23778",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1017",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1017",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39361",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.13",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.11",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.8",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.21",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.20",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.12",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.3",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.23",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.23",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.20",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1- Stored Cross-Site Scripting via Language",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.17",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-17093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Meta SEO \u003c= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer header",
    "slug": "wp-meta-seo",
    "type": "plugin",
    "affected_version": "* - 4.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6961",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile App Canvas \u003c= 3.8.2 - Missing Authorization",
    "slug": "mobile-app",
    "type": "plugin",
    "affected_version": "* - 3.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31816",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "article2pdf \u003c= 0.27 - Denial of Service",
    "slug": "article2pdf",
    "type": "plugin",
    "affected_version": "0.25",
    "from_version": "0.25",
    "from_inclusive": true,
    "to_version": "0.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-1000031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1000031",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "article2pdf \u003c= 0.27 - Denial of Service",
    "slug": "article2pdf",
    "type": "plugin",
    "affected_version": "0.26",
    "from_version": "0.26",
    "from_inclusive": true,
    "to_version": "0.26",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-1000031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1000031",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "article2pdf \u003c= 0.27 - Denial of Service",
    "slug": "article2pdf",
    "type": "plugin",
    "affected_version": "0.27",
    "from_version": "0.27",
    "from_inclusive": true,
    "to_version": "0.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-1000031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1000031",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "article2pdf \u003c= 0.27 - Denial of Service",
    "slug": "article2pdf",
    "type": "plugin",
    "affected_version": "0.24",
    "from_version": "0.24",
    "from_inclusive": true,
    "to_version": "0.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-1000031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-1000031",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Contact Form 7 – PayPal \u0026 Stripe Add-on \u003c= 2.3 - Reflected Cross-Site Scripting",
    "slug": "contact-form-7-paypal-add-on",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48021",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "W3 Total Cache \u003c= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation",
    "slug": "w3-total-cache",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12006",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.16.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10484",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Avatar – Reloaded \u003c= 1.2.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "user-avatar-reloaded",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4798",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Breadcrumb \u003c= 1.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "breadcrumb",
    "type": "plugin",
    "affected_version": "* - 1.5.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4836",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hospital Management System \u003c= 47.0(20-11-2023) - Unauthenticated SQL Injection",
    "slug": "hospital-management",
    "type": "plugin",
    "affected_version": "[*, 47.0(20-11-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "47.0(20-11-2023)",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39386",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Woocommerce Product Design \u003c= 1.0.0 - Unauthenticated Arbitrary File Upload",
    "slug": "woo-product-design",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50482",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-CORS \u003c= 0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-cors",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47606",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPZOOM Addons for Elementor (Templates, Widgets) \u003c= 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget",
    "slug": "wpzoom-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.1.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5686",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fluent Support \u003c= 1.8.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "fluent-support",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47304",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.1.0 - Reflected Cross-Site Scripting via Referer",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6970",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPB Show Core \u003c= 2.5 - Reflected Cross-Site Scripting",
    "slug": "wpb-show-core",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1292",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Secure File Manager \u003c 2.8.2 - Remote Code Execution",
    "slug": "secure-file-manager",
    "type": "plugin",
    "affected_version": "[*, 2.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-35235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35235",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Board \u003c= 1.1(Beta) - Authenticated (Admin+) SQL Injection",
    "slug": "wp-board",
    "type": "plugin",
    "affected_version": "* - 1.1(Beta)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1(Beta)",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24404",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Events Manager \u003c= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "7.0.1 - 7.0.3",
    "from_version": "7.0.1",
    "from_inclusive": true,
    "to_version": "7.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6970",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Events Manager \u003c= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6970",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Sticky Side Buttons \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "wp-sticky-side-buttons",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39421",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Envira Gallery Lite \u003c= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images",
    "slug": "envira-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 1.8.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6742",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slimstat Analytics \u003c= 5.0.5.1 - Missing Authorization via delete_pageview",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "* - 5.0.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33994",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce Support Ticket System \u003c= 17.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Information Exposure",
    "slug": "woocommerce-support-ticket-system",
    "type": "plugin",
    "affected_version": "* - 17.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "17.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13775",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Secure Admin IP \u003c= 2.0 - Missing Authorization via 'saveSettings'",
    "slug": "secure-admin-ip",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41133",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Animated Number Counters \u003c= 2.1 - Authenticated (Editor+) Local File Inclusion",
    "slug": "animated-number-counters",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43957",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Link Library \u003c= 7.7.2 - Reflected Cross-Site Scripting",
    "slug": "link-library",
    "type": "plugin",
    "affected_version": "* - 7.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13404",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chic Lite \u003c= 1.1.3 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "chic-lite",
    "type": "theme",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37104",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CiviCRM \u003c 5.28.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "civicrm",
    "type": "plugin",
    "affected_version": "* - 5.28.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.28.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36389",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nexter \u003c= 2.0.3 - Authenticated (Subscriber+) SQL Injection via 'to' and 'from'",
    "slug": "nexter",
    "type": "theme",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-45657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45657",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Addons for Beaver Builder – Lite \u003c= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget",
    "slug": "ultimate-addons-for-beaver-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2144",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blocksy \u003c= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via About Me block",
    "slug": "blocksy",
    "type": "theme",
    "affected_version": "* - 2.0.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aeropage Sync for Airtable \u003c= 3.2.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "aeropage-sync-for-airtable",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3914",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Giveaways \u003c= 2.45.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Form, Prize, and Sharing Method Fields",
    "slug": "giveasap",
    "type": "plugin",
    "affected_version": "* - 2.45.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.45.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1122",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.13 - Cross-Site Request Forgery to Settings Update in stopOptimizeAll",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1338",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woocommerce Product Design \u003c= 1.0.0 - Unauthenticated Arbitrary File Deletion",
    "slug": "woo-product-design",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50509",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Add to Header \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "add-to-header",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39423",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.3 - Sensitive Information Exposure",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27863",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MicroPayments \u003c= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "paid-membership",
    "type": "plugin",
    "affected_version": "* - 2.9.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31075",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31075",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Meta and Date Remover \u003c 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via settings",
    "slug": "wp-meta-and-date-remover",
    "type": "plugin",
    "affected_version": "[*, 2.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4823",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Tickets \u003c= 2.0.9 - Missing Authorization",
    "slug": "my-tickets",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22717",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "KB Support \u003c= 1.6.7 - Unauthenticated Open Redirect",
    "slug": "kb-support",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24741",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ViperBar \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "viperbar",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26557",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JupiterX Core  3.0.0 - 3.3.0 - Missing Authorization",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.3.0",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-38385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38385",
    "auth_type": "Auth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
  },
  {
    "title": "Piotnet Forms Plugin \u003c= 1.0.28 - Unauthenticated Arbitrary File Upload",
    "slug": "piotnetforms",
    "type": "plugin",
    "affected_version": "* - 1.0.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.28",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51412",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Participants Database \u003c= 1.9.5.5 - SQL Injection",
    "slug": "participants-database",
    "type": "plugin",
    "affected_version": "[*, 1.9.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-8596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8596",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE \u003c= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "IceStats \u003c= 1.3 - Cross-Site Request Forgery",
    "slug": "icestats",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53724",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Everest Forms \u003c= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "* - 3.0.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1128",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woobox \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woobox",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47662",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jigoshop – Store Exporter \u003c= 1.5.8 - Reflected Cross-Site Scripting",
    "slug": "jigoshop-exporter",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50519",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "affiliate-toolkit \u003c= 3.4.4 - Unauthenticated Sensitive Information Exposure via Logs",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37205",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Pollin \u003c= 1.01.1 - Reflected Cross-Site Scripting",
    "slug": "pollin",
    "type": "plugin",
    "affected_version": "* - 1.01.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13711",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Feed \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ht-instagram",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60147",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stripe for WooCommerce 3.0.0 - 3.3.9 - Missing Authorization Controls to Financial Account Hijacking",
    "slug": "stripe-for-woocommerce",
    "type": "plugin",
    "affected_version": "3.0.0 - 3.3.9",
    "from_version": "3.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39347",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Import CSV Files \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "import-csv-files",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2146",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Editorialmag \u003c= 1.2.0 - Missing Authorization to Authenticated Plugin Activation",
    "slug": "editorialmag",
    "type": "theme",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32129",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Simplified \u003c= 1.0.9 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "simplified",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53241",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6 - Cross-Site Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2016-6897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-6897",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MyTweetLinks \u003c= 1.1.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "mytweetlinks",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49618",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Push Notifications \u003c= 1.1.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "ultimate-push-notifications",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31561",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Grill and Chow \u003c= 1.6 - Unauthenticated Local File Inclusion",
    "slug": "grillandchow",
    "type": "theme",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49297",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Tickets \u003c= 4.10.7.1 - CSV Injection",
    "slug": "event-tickets",
    "type": "plugin",
    "affected_version": "* - 4.10.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-16120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16120",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP REST API FNS \u003c= 1.0.0 - Unauthenticated Arbitrary File Upload",
    "slug": "rest-api-fns",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49329",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Duplicate – WordPress Migration Plugin \u003c= 1.1.6 - Missing Authorization",
    "slug": "local-sync",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24652",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Google Maps \u003c= 1.9.31 - Reflected Cross-Site Scripting",
    "slug": "google-maps-easy",
    "type": "plugin",
    "affected_version": "* - 1.9.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-46780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-46780",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sliding Door \u003c= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sliding-door",
    "type": "theme",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43987",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextMove Lite \u003c= 2.18.1 - Cross-Site Request Forgery",
    "slug": "woo-thank-you-page-nextmove-lite",
    "type": "plugin",
    "affected_version": "* - 2.18.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32104",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Htaccess File Editor \u003c= 1.0.19 - Unauthenticated Information Exposure",
    "slug": "htaccess-file-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22773",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Maya Business \u003c= 1.2.0 - Unauthenticated Insecure Direct Object Reference",
    "slug": "paymaya-checkout-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53208",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Image Manipulator \u003c= 1.0 - Remote File Download",
    "slug": "simple-image-manipulator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-1000010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000010",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Eonet Manual User Approve \u003c= 2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "eonet-manual-user-approve",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32738",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime – Events Calendar, Bookings and Tickets \u003c= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 4.0.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13526",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ninja Forms Contact Form \u003c= 3.7.1 - Unauthenticated Second Order SQL Injection",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0685",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Social Media Feather \u003c= 2.1.3 - Missing Authorization",
    "slug": "social-media-feather",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49861",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Arena.IM – Live Blogging for real-time events \u003c= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via arena_embed_amp Shortcode",
    "slug": "arena-liveblog-and-chat-tool",
    "type": "plugin",
    "affected_version": "* - 0.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12463",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AutomatorWP \u003c= 2.5.0 - Cross Site Request Forgery",
    "slug": "automatorwp",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23992",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Table Block by RioVizual \u003c= 2.3.1 - Cross-Site Request Forgery",
    "slug": "riovizual",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32278",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lifetime free Drag \u0026 Drop Contact Form Builder for WordPress VForm \u003c= 2.1.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "v-form",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6770",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.18",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.11",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.9",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.5",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.1",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.21",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.21",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.19",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.18",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.15",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.8.2 - Directory Traversal during unzip",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.10",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-14719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14719",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Prime Slider – Addons For Elementor \u003c= 3.13.2 - Missing Authorization",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-32681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32681",
    "auth_type": "Auth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Newsletter Plugin – Noptin \u003c 1.6.5 - Open Redirect",
    "slug": "newsletter-optin-box",
    "type": "plugin",
    "affected_version": "[*, 1.6.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25033",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "s2Member Pro \u003c= 241216 - Reflected Cross-Site Scripting",
    "slug": "s2member",
    "type": "plugin",
    "affected_version": "* - 241216",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "241216",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26879",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Post Type Date Archives \u003c= 2.7.1 - Missing Authorization to Unauthenticated Arbitrary Shortcode Execution",
    "slug": "custom-post-type-date-archives",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1510",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Media Library Assistant \u003c= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2871",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Snapshot Backup \u003c= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "snapshot-backup",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7689",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chat by Chatwee \u003c= 2.1.3 - Cross-Site Request Forgery to Settings Update",
    "slug": "chatwee",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9948",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All-In-One Security (AIOS) \u003c= 5.1.4 - Authenticated(Admin+) Directory Traversal",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "* - 5.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0156",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Base64 Encoder/Decoder \u003c= 0.9.2 - Reflected Cross-Site Scripting",
    "slug": "base64-encoderdecoder",
    "type": "plugin",
    "affected_version": "* - 0.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3822",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Optimizer, Resizer and CDN – Sirv \u003c= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "* - 7.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8480",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Neon Product Designer \u003c= 2.1.1 - Unauthenticated SQL Injection",
    "slug": "neon-product-designer-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32565",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ACF Better Search \u003c= 3.3.0 - Cross-Site Request Forgery",
    "slug": "acf-better-search",
    "type": "plugin",
    "affected_version": "[*, 3.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-14682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14682",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pearl \u003c= 1.3.4 - Cross-Site Request Forgery via stm_save_hb_settings",
    "slug": "pearl-header-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38356",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Affiliate Pro \u003c= 1.24.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "postaffiliatepro",
    "type": "plugin",
    "affected_version": "* - 1.24.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38482",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPSOLR – Elasticsearch and Solr search \u003c= 8.6 - Reflected Cross-Site Scripting",
    "slug": "wpsolr-search-engine",
    "type": "plugin",
    "affected_version": "* - 8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000155",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Revolution \u003c 3.0.96 \u0026 Showbiz Pro \u003c 1.7.1 - Missing Authorization to Arbitrary File Upload",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "[*, 3.0.96)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.96",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-9735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9735",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slider Revolution \u003c 3.0.96 \u0026 Showbiz Pro \u003c 1.7.1 - Missing Authorization to Arbitrary File Upload",
    "slug": "showbizpro",
    "type": "plugin",
    "affected_version": "[*, 1.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-9735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9735",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPQA - Builder forms Addon For WordPress  \u003c= 5.3 - Reflected Cross-Site Scripting",
    "slug": "wpqa",
    "type": "plugin",
    "affected_version": "[*, 5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1597",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML Forms \u003c= 1.5.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "html-forms",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31080",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31080",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "B2BKing \u003c= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification",
    "slug": "b2bking-wholesale-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.6.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3125",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Product Feed PRO for WooCommerce \u003c= 11.0.6 - Settings Update to Stored Cross-Site Scripting",
    "slug": "woo-product-feed-pro",
    "type": "plugin",
    "affected_version": "[*, 11.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24974",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulk Fields Editor \u003c= 1.8.0 - Missing Authorization",
    "slug": "bulk-user-editor",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31752",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BJ Lazy Load \u003c 1.0 - Remote File Inclusion via TimThumb",
    "slug": "bj-lazy-load",
    "type": "plugin",
    "affected_version": "0.7.5",
    "from_version": "0.7.5",
    "from_inclusive": true,
    "to_version": "0.7.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9415",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Language Translator \u003c= 6.0.19 - Missing Authorization via admin notifications",
    "slug": "google-language-translator",
    "type": "plugin",
    "affected_version": "* - 6.0.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50375",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page Builder: Live Composer \u003c= 1.5.47 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "live-composer-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.5.47",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.47",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35768",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Customers Order History \u003c= 5.2.2 - Missing Authorization",
    "slug": "woo-customers-order-history",
    "type": "plugin",
    "affected_version": "* - 5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37201",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Watermark \u003c= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Watermark Modification",
    "slug": "image-watermark",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1994",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Actueel Financieel Nieuws – Denk Internet Solutions \u003c= 5.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "denk-internet-solutions",
    "type": "plugin",
    "affected_version": "* - 5.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47554",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Flamingo \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "advanced-flamingo",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52226",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Cowidgets – Elementor Addons \u003c= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "cowidgets-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8960",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vernissage \u003c= 1.2.9 - Arbitrary Options Update",
    "slug": "vernissage",
    "type": "theme",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9477",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JobWP \u003c= 2.4.3 - Cross-Site Request Forgery",
    "slug": "jobwp",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57895",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Access Areas \u003c= 1.5.19 - Reflected Cross-Site Scripting",
    "slug": "wp-access-areas",
    "type": "plugin",
    "affected_version": "* - 1.5.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30913",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes by United Themes  \u003c= 5.1.6 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "ut-shortcodes",
    "type": "plugin",
    "affected_version": "* - 5.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13557",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register \u003c= 3.7.1.4 - Authentication Bypass",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "* - 3.7.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-34077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-34077",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Beaver Builder Plugin (Lite Version) \u003c= 2.9.2.1 - Reflected Cross-Site Scripting",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.9.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8897",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IdeaPush \u003c= 8.65 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "ideapush",
    "type": "plugin",
    "affected_version": "* - 8.65",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.65",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37461",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Twitter Button \u003c= 1.4.1 - Cross-Site Request Forgery",
    "slug": "wp-twitter-button",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39420",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mail Subscribe List \u003c= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via smlsubform shortcode",
    "slug": "mail-subscribe-list",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23657",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Code \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "quick-code",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7822",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profitori 2.0.6.0 - 2.1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpoint",
    "slug": "profitori",
    "type": "plugin",
    "affected_version": "2.0.6.0 - 2.1.1.3",
    "from_version": "2.0.6.0",
    "from_inclusive": true,
    "to_version": "2.1.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4631",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARMember Premium \u003c= 5.5.1 - Privilege Escalation",
    "slug": "armember",
    "type": "plugin",
    "affected_version": "* - 5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-42888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42888",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JCH Optimize \u003c= 4.2.0 - Authenticated (Subscriber+) Directory Traversal",
    "slug": "jch-optimize",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34808",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Events Manager \u003c 5.3.5 \u0026 Events Manager Pro \u003c 2.2.9 - Cross-Site Scripting",
    "slug": "events-manager-pro",
    "type": "plugin",
    "affected_version": "[*, 2.2.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-1407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1407",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c 5.3.5 \u0026 Events Manager Pro \u003c 2.2.9 - Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "[*, 5.3.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-1407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1407",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.6.6 - Reflected Cross-Site Scripting",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54265",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Doofinder for WooCommerce \u003c= 2.0.33 - Missing Authorization via multiple AJAX actions",
    "slug": "doofinder-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51678",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Novo-Map : your WP posts on custom google maps \u003c= 1.1.2 - Cross-Site Request Forgery",
    "slug": "novo-map",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46190",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner \u0026 Floating Notification Top Bar \u003c= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "notificationx",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11727",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NPS computy \u003c= 2.7.5 - Cross-Site Request Forgery to Results Deletion",
    "slug": "nps-computy",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1755",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1755",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Job Board Manager \u003c= 2.1.60 - Missing Authorization",
    "slug": "job-board-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-55993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55993",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pootle Pagebuilder – WordPress Page builder \u003c= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pootle-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34573",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Gallery \u003c= 1.3.12 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "yotuwp-easy-youtube-embed",
    "type": "plugin",
    "affected_version": "* - 1.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25477",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CB (legacy) \u003c= 0.9.4.18 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "commons-booking",
    "type": "plugin",
    "affected_version": "* - 0.9.4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4381",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.5 - Authenticated (Author+) SQL Injection via upload[]",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4153",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.5 - Authenticated (Author+) SQL Injection via upload[]",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4153",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Google Map Locations \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "google-map-locations",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49606",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Any Extension to Pages \u003c= 1.4 - Cross-Site Request Forgery via aaetp_options_page",
    "slug": "add-any-extension-to-pages",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50873",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CM Download Manager \u003c= 2.9.6 - Unauthenticated Arbitrary File Deletion",
    "slug": "cm-download-manager",
    "type": "plugin",
    "affected_version": "* - 2.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30910",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "List category posts \u003c= 0.89.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "list-category-posts",
    "type": "plugin",
    "affected_version": "* - 0.89.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.89.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6994",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SeedProd Pro \u003c= 6.18.13 - Authenticated (Editor+) Remote Code Execution",
    "slug": "seedprod-coming-soon-pro-5",
    "type": "plugin",
    "affected_version": "* - 6.18.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.18.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54285",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rank Math SEO \u003c= 1.0.218 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.218",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.218",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4627",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Very Simple Breadcrumb \u003c= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "very-simple-breadcrumb",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2149",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unique \u003c= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "unique",
    "type": "theme",
    "affected_version": "* - 0.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33952",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unicamp \u003c= 2.6.3 - Unauthenticated Local File Inclusion",
    "slug": "unicamp",
    "type": "theme",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54701",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Catalog – Catalog for WordPress \u003c= 1.0.4 - Unauthenticated SQL Injection",
    "slug": "displayproduct",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30524",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Cart66 Lite - WordPress Ecommerce \u003c 1.5.4 - Directory Traversal to Arbitrary File Disclosure",
    "slug": "cart66-lite",
    "type": "plugin",
    "affected_version": "[*, 1.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9461",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.44",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1937",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Social Media Share Buttons \u003c= 3.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mashsharer",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36849",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Meta Data and Taxonomies Filter (MDTF) \u003c= 1.3.3.1 - Cross-Site Request Forgery",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30457",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hueman \u003c= 3.7.24 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "hueman",
    "type": "theme",
    "affected_version": "* - 3.7.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35772",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Web Testimonials \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "web-testimonials",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23560",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Job Manager \u0026 Career \u003c= 1.4.3 - Sensitive Information Exposure",
    "slug": "job-manager-career",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-5906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5906",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Charity Addon for Elementor \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "charity-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Smooth Scroll Links \u003c= 2.23.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "scrolling-anchors",
    "type": "plugin",
    "affected_version": "* - 2.23.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.23.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0728",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Shop Page Builder \u003c= 2.27.7 - Reflected Cross-Site Scripting",
    "slug": "dzs-wootable",
    "type": "plugin",
    "affected_version": "* - 2.27.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.27.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Discy \u003c= 5.1 - Cross-Site Request Forgery to Settings Reset",
    "slug": "discy",
    "type": "theme",
    "affected_version": "[*, 5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1422",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Five Star Restaurant Menu \u003c= 2.2.0 - Unauthenticated Arbitrary Object Deserialization leading to Remote Code Execution",
    "slug": "food-and-drink-menu",
    "type": "plugin",
    "affected_version": "[*, 2.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-29045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-29045",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Contact Form Builder \u0026 Lead Generation Plugin \u003c= 1.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "lead-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10475",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSS3 Vertical Web Pricing Tables \u003c= 1.9 - Reflected Cross-Site Scripting",
    "slug": "css3_vertical_web_pricing_tables",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52727",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bricks \u003c= 1.8.1 - Cross-Site Request Forgery via reset_settings",
    "slug": "bricks",
    "type": "theme",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3409",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Wireless Butler \u003c= 1.0.11 - Reflected Cross-Site Scripting",
    "slug": "wireless-butler",
    "type": "theme",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26997",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shariff Wrapper \u003c= 4.6.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "shariff",
    "type": "plugin",
    "affected_version": "* - 4.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visualmodo Elements \u003c= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "visualmodo-elements",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11095",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plugins Last Updated Column \u003c= 0.1.3 - Cross-Site Request Forgery",
    "slug": "plugins-last-updated-column",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28887",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Banners \u003c= 1.4 - Cross-Site Scripting",
    "slug": "easy-banners",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4723",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Fami WooCommerce Compare \u003c= 1.0.5 - Unauthenticated Local File Inclusion",
    "slug": "fami-woocommerce-compare",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31405",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ninja Tables – Easy Data Table \u003c= 5.0.16 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ninja-tables",
    "type": "plugin",
    "affected_version": "* - 5.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12772",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jeeng Push Notifications \u003c= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "jeeng-push-notifications",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3610",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Staff Directory Plugin: Company Directory \u003c= 4.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "staff-directory-pro",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-25165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25165",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Video \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-video",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7629",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social proof testimonials and reviews by Repuso \u003c= 5.21 - Missing Authorization",
    "slug": "social-testimonials-and-reviews-widget",
    "type": "plugin",
    "affected_version": "* - 5.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31886",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Registration Forms \u003c= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "easy-registration-forms",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39353",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Comment Guestbook \u003c= 0.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "comment-guestbook",
    "type": "plugin",
    "affected_version": "* - 0.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36830",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tennis Court Bookings \u003c= 1.2.7 - Reflected Cross-Site Scripting",
    "slug": "tennis-court-bookings",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52787",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download ZIP Attachments \u003c= 1.0 - Directory Traversal",
    "slug": "download-zip-attachments",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-4704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4704",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress \u003c= 1.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "url-shortify",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-3129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3129",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rank Math SEO \u003c= 1.0.27 - Authenticated Settings Reset via reset-cmb Parameter",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "[*, 1.0.27.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.27.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-14786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14786",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Load Gallery \u003c= 2.1.6 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "wp-load-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23942",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Prime Slider – Addons For Elementor \u003c= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Mercury Widget",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1508",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hot Linked Image Cacher \u003c= 1.16 - Cross-Site Request Forgery",
    "slug": "hot-linked-image-cacher",
    "type": "plugin",
    "affected_version": "* - 1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1765",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1765",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Click To Tweet \u003c= 2.0.14 - Reflected Cross-Site Scripting",
    "slug": "click-to-tweet",
    "type": "plugin",
    "affected_version": "* - 2.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41856",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.0.5 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2007-0107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-0107",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Shipping And Billing Address For Woocommerce \u003c= 1.3 - Unauthenticated SQL Injection",
    "slug": "different-shipping-and-billing-address-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26875",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Justified Gallery \u003c= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "justified-gallery",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4651",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML5 Audio Player- Best WordPress Audio Player Plugin \u003c= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "html5-audio-player",
    "type": "plugin",
    "affected_version": "* - 2.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4398",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print Button Shortcode \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "print-button-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11810",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced WordPress Backgrounds \u003c= 1.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via imageTag Parameter",
    "slug": "advanced-backgrounds",
    "type": "plugin",
    "affected_version": "* - 1.12.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8045",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FancyTabs \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter",
    "slug": "fancytabs",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8560",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tooltipy \u003c= 5.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bluet-keywords-tooltip-generator",
    "type": "plugin",
    "affected_version": "* - 5.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58614",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 5.1.9.2 - Missing Authorization to Unauthenticated Content Injection",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23989",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Trust.Reviews \u003c= 2.3 - Missing Authorization",
    "slug": "fb-reviews-widget",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30883",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventPrime \u003c= 2.8.6 - Reflected Cross-Site Scripting",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33326",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Horizontal scrolling announcements \u003c= 2.4 -  Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "horizontal-scrolling-announcements",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5000",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Thumbnail \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-thumbnail",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11819",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirect wordpress to welcome or landing page \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "redirect-to-welcome-or-landing-page",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39417",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiVendorX Marketplace \u003c= 4.0.25 - Missing Authorization",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.0.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-24703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24703",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"
  },
  {
    "title": "Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce \u003c= 3.4.6 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Templates",
    "slug": "a4-barcode-generator",
    "type": "plugin",
    "affected_version": "* - 3.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1679",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5953",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Block Controller \u003c= 1.4.3 - Reflected Cross-Site Scripting",
    "slug": "block-controller",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54208",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classified Listing \u003c= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1315",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sticky Buttons – floating buttons builder \u003c= 3.2.3 - Cross-Site Request Forgery",
    "slug": "sticky-buttons",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3475",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "payOS \u003c= 1.0.61 - Cross-Site Request Forgery",
    "slug": "payos",
    "type": "plugin",
    "affected_version": "* - 1.0.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57946",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WidgetShortcode \u003c= 0.3.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "widgetshortcode",
    "type": "plugin",
    "affected_version": "* - 0.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4473",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetBlog \u003c= 2.4.3 - Missing Authorization",
    "slug": "jet-blog",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26958",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Send to a Friend Addon \u003c= 1.4.1 - Reflected Cross-Site Scripting",
    "slug": "send-booking-invites-to-friends",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23600",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Invelity MyGLS connect \u003c= 1.1.1 - Cross-Site Request Forgery",
    "slug": "invelity-mygls-connect",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58833",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.84 - Missing Authorization",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.84",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.84",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6785",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Blocksy \u003c= 2.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blocksy",
    "type": "theme",
    "affected_version": "* - 2.0.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4943",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EAN for WooCommerce \u003c= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode",
    "slug": "ean-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6897",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Portfolio Gallery \u003c= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-portfolio-gallery",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26016",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Sync – Remote User Sync \u003c= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation",
    "slug": "user-sync",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9891",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Attendance Manager \u003c= 0.5.6 - Stored Cross-Site Scripting",
    "slug": "attendance-manager",
    "type": "plugin",
    "affected_version": "* - 0.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-5970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5970",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qode Essential Addons  \u003c= 1.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation",
    "slug": "qode-essential-addons",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47840",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz and Survey Master \u003c= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 8.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4032",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Meta Data and Taxonomies Filter (MDTF) \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29932",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Post Page Clone \u003c= 1.1 - Missing Authorization to Post Disclosure",
    "slug": "wp-post-page-clone",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24733",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "User Feedback \u003c= 1.0.9 - Unauthenticated Cross-Site Scripting",
    "slug": "userfeedback-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46153",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uix Page Builder \u003c= 1.7.4 - Reflected Cross-Site Scripting",
    "slug": "uix-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24616",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Cross-Site Request Forgery via 'wpfc_start_cdn_integration_ajax_request_callback'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1921",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "File Manager \u003c= 6.3 - Authenticated (Admin+) Arbitrary OS File Access via Path Traversal",
    "slug": "file-manager",
    "type": "plugin",
    "affected_version": "* - 6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-5907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5907",
    "auth_type": "Privileged",
    "cvss_score": 2.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "News \u003c= 0.1 - Cross-Site Scripting",
    "slug": "news",
    "type": "theme",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3851",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LH Add Media From Url \u003c= 1.22 - Reflected Cross-Site Scripting",
    "slug": "lh-add-media-from-url",
    "type": "plugin",
    "affected_version": "* - 1.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32533",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SpiderFAQ \u003c= 1.3.2 - Reflected Cross-Site Scripting",
    "slug": "spider-faq",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31123",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.9.4 - Contributor+ Arbitrary File Download",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "[*, 3.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24692",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Members page only for logged in users \u003c= 1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "members-page-only-for-logged-in-users",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28901",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fitrush \u003c= 1.3.4 - Unauthenticated Local File Inclusion",
    "slug": "bw-fitrush",
    "type": "theme",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-26005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26005",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "StatCounter \u003c= 2.0.6 - Admin+ Stored Cross-Site Scripting",
    "slug": "official-statcounter-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 2.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24920",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.39 - Cross-Site Request Forgery",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.0.40)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.40",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-10673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-10673",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FooEvents for WooCommerce \u003c= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload",
    "slug": "fooevents",
    "type": "plugin",
    "affected_version": "* - 1.19.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6000",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Clean Login \u003c= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "clean-login",
    "type": "plugin",
    "affected_version": "* - 1.13.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4838",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.6, 4.6.22)",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.22",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.9, 4.9.19)",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.19",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.7, 3.7.37)",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.37",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.9, 3.9.35)",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.35",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.2, 4.2.31)",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.31",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.7, 4.7.22)",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.22",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.8, 4.8.18)",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.18",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.0, 5.0.15)",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.15",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.5, 5.5.8)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.6, 5.6.7)",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.3, 5.3.11)",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.11",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.4, 5.4.9)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.7, 5.7.5)",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.0, 4.0.34)",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.34",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.1, 4.1.34)",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.34",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.1, 5.1.12)",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.12",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.2, 5.2.14)",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.14",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[5.8, 5.8.3)",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[3.8, 3.8.37)",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.37",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.3, 4.3.27)",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.27",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.4, 4.4.26)",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.26",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.8.3 - SQL Injection via WP_Query",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[4.5, 4.5.25)",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.25",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-21661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-21661",
    "auth_type": "Privileged",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Article Directory Redux \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "article-directory-redux",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30751",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shared Files \u003c= 1.7.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "shared-files",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4819",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4819",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13470",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Banner System \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "banner-system",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51816",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "pTypeConverter \u003c= 0.2.8.1 - Authenticated (Editor+) SQL Injection",
    "slug": "ptypeconverter",
    "type": "plugin",
    "affected_version": "* - 0.2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-52201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52201",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Type Builder \u003c= 2.0.8 - Missing Authorization to Arbitrary Post/Page Creation",
    "slug": "themify-ptb",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31366",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks \u003c= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.80",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1988",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate \u003c= 7.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3188",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Most And Least Read Posts Widget \u003c= 2.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "most-and-least-read-posts-widget",
    "type": "plugin",
    "affected_version": "* - 2.5.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39549",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BoldGrid Easy SEO – Simple and Effective SEO \u003c= 1.6.14 - Information Exposure",
    "slug": "boldgrid-easy-seo",
    "type": "plugin",
    "affected_version": "* - 1.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2950",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2950",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MinimogWP – The High Converting eCommerce WordPress Theme \u003c= 3.7.0 - Unauthenticated Local PHP File Inclusion",
    "slug": "minimog",
    "type": "theme",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13790",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "File Download \u003c= 1.4 - Open Proxy",
    "slug": "filedownload",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-1000002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1000002",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N"
  },
  {
    "title": "Woodmart \u003c= 8.2.3 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 8.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6744",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Optinly \u003c= 1.0.18 - Missing Authorization",
    "slug": "optinly",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37220",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.9.9.2 - Authenticated Privilege Escalation",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.9.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8247",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NinjaTeam Chat for Telegram \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter",
    "slug": "ninjateam-telegram",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5236",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Composer Website Builder \u003c= 45.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "visualcomposer",
    "type": "plugin",
    "affected_version": "* - 45.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "45.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35653",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Almera Responsive Portfolio Site Template \u003c 2015-05-15 - Sensitive Information Disclosure",
    "slug": "almera",
    "type": "theme",
    "affected_version": "[*, 1.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9488",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Maintenance Mode \u003c= 2.0.6 - Remote Code Execution",
    "slug": "wp-maintenance-mode",
    "type": "plugin",
    "affected_version": "[*, 2.0.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2018-20156",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20156",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Creative Addons for Elementor \u003c= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "creative-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2924",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goodlayers Hostel \u003c= 3.1.2 - Unauthenticated SQL Injection",
    "slug": "gdlr-hostel",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39501",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Crelly Slider \u003c= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "crelly-slider",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13116",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Web Player \u003c= 5.7.3 - Missing Authorization to Unauthenticated Information Exposure",
    "slug": "podlove-web-player",
    "type": "plugin",
    "affected_version": "* - 5.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35710",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "This Day In History \u003c= 3.10.1 - Reflected Cross-Site Scripting",
    "slug": "this-day-in-history",
    "type": "plugin",
    "affected_version": "* - 3.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34026",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Slider \u003c= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "logo-slider-wp",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4664",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All in One Time Clok Lite \u003c= 1.3.320 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "aio-time-clock-lite",
    "type": "plugin",
    "affected_version": "* - 1.3.320",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.320",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44594",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator \u003c= 1.15.2 - Admin+ Stored Cross-Site Scripting",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "[*, 1.15.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24700",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gravity Forms Google Sheet Connector \u003c= 1.3.4 - Cross-Site Request Forgery via verify_code_integation_new",
    "slug": "gsheetconnector-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2326",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "MSync \u003c= 1.0.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "msync",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-49166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49166",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shipping for Nova Poshta plugin for WordPress \u003c= 1.19.6 - Unauthenticated SQL Injection",
    "slug": "nova-poshta-ttn",
    "type": "plugin",
    "affected_version": "* - 1.19.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24612",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Owl Carousel \u003c= 0.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "owl-carousel",
    "type": "plugin",
    "affected_version": "* - 0.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23829",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Menus Plus+ \u003c= 1.9.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "menus-plus",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23910",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News \u0026 YouTube Video Feeds Aggregator \u003c= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message",
    "slug": "feedzy-rss-feeds",
    "type": "plugin",
    "affected_version": "* - 4.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6877",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pretty Link Lite \u003c 1.5.4 - Cross-Site Scripting",
    "slug": "pretty-link-lite",
    "type": "plugin",
    "affected_version": "[*, 1.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-5191",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5191",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Members \u003c= 3.4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode",
    "slug": "wp-members",
    "type": "plugin",
    "affected_version": "* - 3.4.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10374",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aiomatic - AI Content Writer, Editor, ChatBot \u0026 AI Toolkit \u003c= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions",
    "slug": "aiomatic-automatic-ai-content-writer",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13816",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "cformsII \u003c= 10.4 - Cross-Site Scripting",
    "slug": "cforms",
    "type": "plugin",
    "affected_version": "[*, 10.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-10393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10393",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Classified Listings \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "ultimate-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6529",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Table Builder \u003c= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-table-builder",
    "type": "plugin",
    "affected_version": "* - 2.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-55711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-55711",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Multilingual \u0026 Multicurrency \u003c= 5.3.6 - Missing Authorization",
    "slug": "woocommerce-multilingual",
    "type": "plugin",
    "affected_version": "* - 5.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44006",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Secure Copy Content Protection and Content Locking \u003c= 4.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "secure-copy-content-protection",
    "type": "plugin",
    "affected_version": "* - 4.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6138",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery \u003c= 1.8.15 - Missing Authorization",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.8.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-33995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33995",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Flexible Cookies \u003c= 1.1.8 - Cross-Site Request Forgery",
    "slug": "flexible-cookies",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30805",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP ViewSTL \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-viewstl",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22742",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Manager \u003c= 2.1.5 - Authenticated(Contributor+) SQL Injection via Shortcode",
    "slug": "booking-manager",
    "type": "plugin",
    "affected_version": "[*, 2.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-50840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50840",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Formality \u003c= 1.5.7 - Unauthenticated Local File Inclusion",
    "slug": "formality",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-24690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24690",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Auto Featured Image from Title \u003c= 2.3 - Reflected Cross-Site Scripting",
    "slug": "auto-featured-image-from-title",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8786",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Registrations for the Events Calendar – Event Registration Plugin \u003c= 2.12.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "registrations-for-the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 2.12.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7982",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eleblog – Elementor Blog And Magazine Addons \u003c= 1.8 - Missing Authorization to Authenticated (Subscriber+) Deactivation Submission",
    "slug": "ele-blog",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10663",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Tag Warrior Importer \u003c= 0.2 - Cross-Site Request Forgery",
    "slug": "utw-importer",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9374",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Quiz Maker \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "n-media-wp-simple-quiz",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13456",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "12 Step Meeting List \u003c= 3.14.28 - Missing Authorization",
    "slug": "12-step-meeting-list",
    "type": "plugin",
    "affected_version": "* - 3.14.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22296",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form Submissions \u003c= 1.7 - Authenticated SQL Injection",
    "slug": "contact-form-submissions",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24125",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OceanWP \u003c= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation",
    "slug": "oceanwp",
    "type": "theme",
    "affected_version": "4.0.9 - 4.1.1",
    "from_version": "4.0.9",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8891",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Display custom fields in the frontend – Post and User Profile Fields \u003c= 1.2.1 - Authenticated (Contributor+) Code Injection",
    "slug": "shortcode-to-display-post-and-user-data",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6996",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPC Frequently Bought Together for WooCommerce \u003c= 7.1.9 - Missing Authorization",
    "slug": "woo-bought-together",
    "type": "plugin",
    "affected_version": "* - 7.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43312",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.16.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9130",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kraken.io Image Optimizer \u003c= 2.6.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update",
    "slug": "kraken-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0619",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Noo JobMonster \u003c= 4.6.6 - Sensitive Information Disclosure via Directory Listing",
    "slug": "noo-jobmonster",
    "type": "theme",
    "affected_version": "* - 4.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1166",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Scripts Organizer \u003c 3.0 - Unauthenticated Arbitrary File Upload",
    "slug": "scripts-organizer",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24890",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "QS Dark Mode Plugin \u003c= 2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "qs-dark-mode",
    "type": "plugin",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9118",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DK PDF \u003c= 1.9.6 - Reflected Cross-Site Scripting",
    "slug": "dk-pdf",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8727",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crowdsignal Dashboard – Polls, Surveys \u0026 more \u003c= 3.0.11 - Cross-Site Request Forgery via update_rating",
    "slug": "polldaddy",
    "type": "plugin",
    "affected_version": "* - 3.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51489",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GutenKit \u003c= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutenkit-blocks-addon",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57900",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Pro \u003c= 4.8.6 - Missing Authorization via AJAX actions",
    "slug": "sliderpro",
    "type": "plugin",
    "affected_version": "* - 4.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41865",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery \u003c= 3.4.7 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35943",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Display Users \u003c= 2.0.0 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-display-users",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24400",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form \u0026 Custom Contact Form builder \u003c=  2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.17.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12190",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c= 3.7.3 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31939",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Cross-Site Request Forgery via ajax_save_state",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0722",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Buy Me a Coffee – Button and Widget Plugin \u003c= 3.7 - Missing Authorization",
    "slug": "buymeacoffee",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2078",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP BrowserUpdate \u003c= 4.4.1 - Cross-Site Request Forgery via wpbu_administration",
    "slug": "wp-browser-update",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31078",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "YouTube Embed \u003c= 3.3.2 - Cross-Site Scripting",
    "slug": "youtube-embed",
    "type": "plugin",
    "affected_version": "[*, 3.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-6535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6535",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Manager for Icomoon \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "manager-for-icomoon",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29387",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Genoo \u003c= 6.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "genoo",
    "type": "plugin",
    "affected_version": "* - 6.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51605",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dyslexiefont Free \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "dyslexiefont",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32589",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Buddyboss Platform \u003c= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Comment on Private Post",
    "slug": "buddyboss-platform",
    "type": "plugin",
    "affected_version": "* - 2.5.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.91",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4886",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikRentCar Car Rental Management System \u003c= 1.3.1 - Cross-Site Request Forgery",
    "slug": "vikrentcar",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1845",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5553",
    "auth_type": "Auth",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iFolders \u003c= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ifolders",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41949",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DL Yandex Metrika \u003c= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "dl-yandex-metrika",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6462",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARMember \u003c= 4.0.10 - Authenticated(Subscriber+) Privilege Escalation",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51356",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WebinarPress \u003c= 1.33.9 - Reflected Cross-Site Scripting",
    "slug": "wp-webinarsystem",
    "type": "plugin",
    "affected_version": "* - 1.33.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31256",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor \u0026 FSE \u003c= 2.6.8 - Authenticated (Author+) Limited File Upload to Stored Cross-Site Scripting",
    "slug": "otter-blocks",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3344",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c= 3.2.3 \u0026 PRO \u003c 4.1.1 - Missing Authorization Checks",
    "slug": "wp-all-import-pro",
    "type": "plugin",
    "affected_version": "[*, 4.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9331",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Import any XML or CSV File to WordPress \u003c= 3.2.3 \u0026 PRO \u003c 4.1.1 - Missing Authorization Checks",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "[*, 3.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9331",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "League of Legends Shortcodes \u003c= 1.0.1 - Authenticated (Contributor+) SQL Injection via Shortcode",
    "slug": "league-of-legends-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10341",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.1.23 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13729",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Email Marketing Plugin – WP Email Capture \u003c= 3.10 - Information Exposure via wp_email_capture_options_process",
    "slug": "wp-email-capture",
    "type": "plugin",
    "affected_version": "* - 3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28421",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Missing Authorization to Product Manipulation",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4941",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4941",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Conditional cart fee / Extra charge rule for WooCommerce extra fees \u003c= 1.0.96 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "conditional-extra-fees-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.96",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29093",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kiamo - Responsive Business Service WordPress Theme \u003c= 1.3.3 - Unauthenticated Local File Inclusion",
    "slug": "kiamo",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31633",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sala \u003c= 1.1.6 - Unauthenticated Local File Inclusion",
    "slug": "sala",
    "type": "theme",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54709",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Enable SVG \u003c= 1.3.1 - Cross-Site Scripting via SVG",
    "slug": "enable-svg",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1562",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amber \u003c= 1.4.4  - Reflected Cross-Site Scripting",
    "slug": "amberlink",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22754",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Convertful – Your Ultimate On-Site Conversion Tool \u003c= 2.5 - Missing Authorization via add_woo_coupon",
    "slug": "convertful",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46605",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CookieCode \u003c= 2.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cookiecode",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47668",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CLP – Custom Login Page by NiteoThemes \u003c= 1.5.5 - Cross-Site Request Forgery",
    "slug": "clp-custom-login-page",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31769",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.1.30 - Reflected Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.1.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.30",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2014-6315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6315",
    "auth_type": "Unauth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Glamer \u003c= 1.0.2 - Unauthenticated Local File Inclusion",
    "slug": "glamer",
    "type": "theme",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53216",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Forum \u003c= 1.7.4 - Remote SQL Injection",
    "slug": "wp-forum",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-0388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0388",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MapPress Maps for WordPress \u003c= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.88.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.88.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4840",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Distance Rate Shipping For WooCommerce \u003c= 1.3.4 - Authenticated (Subscriber+) SQL Injection",
    "slug": "distance-rate-shipping-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22639",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Cecabank WooCommerce Plugin \u003c= 0.3.4 - Missing Authorization",
    "slug": "cecabank-woocommerce",
    "type": "plugin",
    "affected_version": "* - 0.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58685",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "SVG Support \u003c= 2.5.7 - Authenticated (Author+) Cross-Site Scripting via SVG",
    "slug": "svg-support",
    "type": "plugin",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6708",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter Manager \u003c= 1.5.1 - Insecure Deserialization",
    "slug": "newsletter-manager",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36727",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Autoptimize \u003c= 2.7.6 - Authenticated Arbitrary File Upload",
    "slug": "autoptimize",
    "type": "plugin",
    "affected_version": "* - 2.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-24948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24948",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Job Manager \u003c= 1.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "simple-job-manager",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51602",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Chamber Dashboard Business Directory \u003c= 3.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "chamber-dashboard-business-directory",
    "type": "plugin",
    "affected_version": "* - 3.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32162",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5332",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Contact Form Pro \u003c 1.1.1.9 - Authenticated Stored Cross-Site Scripting",
    "slug": "easy-contact-form-pro",
    "type": "plugin",
    "affected_version": "[*, 1.1.1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24168",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Create by Mediavine \u003c= 1.9.8 - Unauthenticated Sensitive Information Exposure",
    "slug": "mediavine-create",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43264",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Migration Backup Restore \u003c= 3.4.3 - Authenticated (Administrator+) Server-Side Request Forgery",
    "slug": "wp-staging",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4469",
    "auth_type": "Privileged",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "NextGen Gallery \u003c= 2.1.56 - Remote File Inclusion",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.56",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-6565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-6565",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slideshow Gallery \u003c= 1.6.8 - Cross-Site Scripting",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-18017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-18017",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Categorized Gallery Plugin \u003c= 2.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "categorized-gallery",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13676",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Business Card \u003c= 1.0.0 - Cross-Site Request Forgery to Card Edit",
    "slug": "business-card-by-esterox-100",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4531",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpDataTables – WordPress Data Table, Dynamic Tables \u0026 Table Charts Plugin \u003c= 3.4.2.12 - Unauthenticated Stored Cross-Site Scripting via CSV Import",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "* - 3.4.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4895",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Astra Bulk Edit \u003c= 1.2.7 - Missing Authorization",
    "slug": "astra-bulk-edit",
    "type": "plugin",
    "affected_version": "[*, 1.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44148",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Google XML News Sitemap plugin \u003c= 0.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "gn-xml-sitemap",
    "type": "plugin",
    "affected_version": "* - 0.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48304",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Parallax Slider Block \u003c= 1.2.5 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "parallax-slider-block",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49184",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49184",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Vimeo Shortcode \u003c= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "the-very-simple-vimeo-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Player \u0026 FullScreen Video Background \u003c= 2.4.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "universal-video-player-and-bg",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47567",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Booster for WooCommerce \u003c= 3.7.0 - Cross-Site Scripting",
    "slug": "woocommerce-jetpack",
    "type": "plugin",
    "affected_version": "[*, 3.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20966",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EKC Tournament Manager \u003c= 2.2.1 - Cross-Site Request Forgery to Tournament Deletion",
    "slug": "ekc-tournament-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9711",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ebook Store \u003c= 5.8001 - Reflected Cross-Site Scripting via 'step'",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.8001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8001",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12262",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paypal Donation \u003c= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "easy-paypal-donation",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24570",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 2.7.4 - Arbitrary File Upload",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "[*, 2.7.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-7055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-7055",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Hover Effects Ultimate \u003c= 9.7.3 - Authenticated Stored Cross-Site Scripting via Title \u0026 Description",
    "slug": "image-hover-effects-ultimate",
    "type": "plugin",
    "affected_version": "* - 9.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2937",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Course Booking Platform \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "course-booking-platform",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58887",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c= 2.1.7 - Cross-Site Scripting",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "[*, 2.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5672",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX \u003c= 4.0.4 - Authenticated (Contributor+) Stored Cross=Site Scripting",
    "slug": "ultimate-post",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4305",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "* - 4.9.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45457",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restrict Content \u003c= 3.2.2 - Reflected Cross-Site Scripting",
    "slug": "restrict-content",
    "type": "plugin",
    "affected_version": "[*, 3.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-3182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3182",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Background animation blocks \u003c= 2.1.5 - Unauthenticated Local File Inclusion",
    "slug": "background-animation-blocks",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-23948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23948",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Posts Search \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "posts-search",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51884",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.3.06 - Unauthenticated Information Disclosure via Unprotected Directory",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.06",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.06",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13126",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Groups and Communities \u003c= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.9.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0724",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content  – ProfilePress \u003c= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8878",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.5 - Authenticated (Author+) SQL Injection via cg_id",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 19.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4159",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 19.1.5 - Authenticated (Author+) SQL Injection via cg_id",
    "slug": "contest-gallery-pro",
    "type": "plugin",
    "affected_version": "* - 19.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4159",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SEO Plugin by Squirrly SEO \u003c= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter",
    "slug": "squirrly-seo",
    "type": "plugin",
    "affected_version": "* - 12.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.3.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6497",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zoho Flow \u003c= 2.13.3 - Missing Authorization",
    "slug": "zoho-flow",
    "type": "plugin",
    "affected_version": "* - 2.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31408",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31408",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Slider Revolution \u003c= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via esrcpt_slider_allow_iframes_filter",
    "slug": "easy-slider-revolution",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grow by Tradedoubler \u003c= 2.0.21 - Unauthenticated Local File Inclusion",
    "slug": "tradedoubler-affiliate-tracker",
    "type": "plugin",
    "affected_version": "* - 2.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.21",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6460",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Opal Estate \u003c= 1.6.11 - Cross-Site Request Forgery Bypass",
    "slug": "opal-estate",
    "type": "plugin",
    "affected_version": "* - 1.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4387",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Profile Builder \u003c= 3.13.8 - Unauthenticated Content Spoofing",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.13.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.13.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49292",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better WishList API \u003c= 1.1.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "better-wlm-api",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24641",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscribe To Comments Reloaded \u003c= 140129 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "subscribe-to-comments-reloaded",
    "type": "plugin",
    "affected_version": "* - 140129",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "140129",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-2274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2274",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Addons for Beaver Builder - Lite \u003c= 1.5.5 - Authenticated (Subscriber+) Settings Change",
    "slug": "ultimate-addons-for-beaver-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23882",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Finance Consultant \u003c= 2.8 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "finance",
    "type": "theme",
    "affected_version": "* - 2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32293",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Uncanny Automator Pro \u003c= 5.3 - Reflected Cross-Site Scripting",
    "slug": "uncanny-automator-pro",
    "type": "plugin",
    "affected_version": "* - 5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37117",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCode \u003c= 2.0.13 - Unauthenticated Reflected Cross-Site Scripting via Tag Filter Links",
    "slug": "insert-headers-and-footers",
    "type": "plugin",
    "affected_version": "* - 2.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3524",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Post Duplicator \u003c= 2.0 - Authenticated (Contributor+) SQL Injection via post_id",
    "slug": "rduplicator",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2229",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spectra \u003c= 2.13.7 - Missing Authorization via generate_ai_content",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.13.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37517",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Hotel Booking \u003c= 2.1.5 - Missing Authorization",
    "slug": "wp-hotel-booking",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12370",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "myCred – Points, Rewards, Gamification, Ranks, Badges \u0026 Loyalty Plugin \u003c= 2.3.2 - Reflected Cross-Site Scripting",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25015",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AccessPress Anonymous Post Pro \u003c= 3.1.9 - Unauthenticated Arbitrary File Upload",
    "slug": "accesspress-anonymous-post-pro",
    "type": "plugin",
    "affected_version": "[*, 3.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-16949",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16949",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Chilexpress woo oficial \u003c= 1.2.9 - Reflected Cross-Site Scripting",
    "slug": "chilexpress-oficial",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34176",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.20.4 - Authenticated (Subscriber+) CSV Injection",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.20.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3558",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "PowerPress Podcasting plugin by Blubrry \u003c= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 11.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6588",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ntp-header-images \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "header-images-rotator",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23437",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.6.1 - Cross-Site Request Forgery in multiple functions in admin/controller.php",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32501",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Login Lockdown – Protect Login Form \u003c= 2.08 - Missing Authorization",
    "slug": "login-lockdown",
    "type": "plugin",
    "affected_version": "* - 2.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1340",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.971",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.971",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2799",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Atarim \u003c= 3.12 - Unauthenticated Cross-Site Scripting",
    "slug": "atarim-visual-collaboration",
    "type": "plugin",
    "affected_version": "* - 3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47544",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cost Estimation \u0026 Payment Forms Builder \u003c= 10.1.76 - Missing Authorization",
    "slug": "wp-estimation-form",
    "type": "plugin",
    "affected_version": "* - 10.1.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.1.76",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32509",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "2.2.87 - 2.2.90",
    "from_version": "2.2.87",
    "from_inclusive": true,
    "to_version": "2.2.90",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8253",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ReviewX – Multi-criteria Rating \u0026 Reviews for WooCommerce \u003c= 1.6.27 - Missing Authorization",
    "slug": "reviewx",
    "type": "plugin",
    "affected_version": "* - 1.6.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3609",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Adminimize \u003c 1.7.22 - Cross-Site Scripting",
    "slug": "adminimize",
    "type": "plugin",
    "affected_version": "[*, 1.7.22)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.22",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-5128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5128",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Keep Backup Daily \u003c= 2.1.0 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "keep-backup-daily",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26779",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Icon List Block \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "icon-list-block",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26937",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Locator \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-locator",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12501",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wholesale Market for WooCommerce \u003c 2.0.0 - Authenticated (Administrator+) Arbitrary Log File Download",
    "slug": "wholesale-market-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-4109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4109",
    "auth_type": "Privileged",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor \u003c= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.148",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.148",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8603",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c= 13.7 \u0026 Jetpack Boost \u003c= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "* - 13.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10076",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c= 13.7 \u0026 Jetpack Boost \u003c= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jetpack-boost",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10076",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant Menu – Food Ordering System – Table Reservation \u003c= 2.3.5 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "menu-ordering-reservations",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4657",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eduma \u003c= 5.6.4 - Missing Authorization",
    "slug": "eduma",
    "type": "theme",
    "affected_version": "* - 5.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39460",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ReadMe Creator \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "readme-creator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23643",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit Assist \u003c= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bit-assist",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3667",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.7.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6312",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "On Page SEO + Whatsapp Chat Button \u003c= 1.0.1 Reflected Cross-Site Scripting",
    "slug": "ops-robots-txt",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38332",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sketchfab Embed \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sketchfab-oembed",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37216",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sign-up Sheets \u003c= 2.2.12 - Missing Authorization",
    "slug": "sign-up-sheets",
    "type": "plugin",
    "affected_version": "* - 2.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39654",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RRAddons for Elementor \u003c= 1.1.0 - Authenticated (Contributor+) Post Disclosure",
    "slug": "rrdevs-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11915",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "kathmag",
    "type": "theme",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "online-estore",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "spidermag",
    "type": "theme",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "medical-heed",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "appzend",
    "type": "theme",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "buzzstore",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "craft-blog",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "fitness-park",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "kingcabs",
    "type": "theme",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "metrostore",
    "type": "theme",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation",
    "slug": "sparklestore",
    "type": "theme",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32959",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lightweight Accordion \u003c= 1.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "lightweight-accordion",
    "type": "plugin",
    "affected_version": "* - 1.5.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0373",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive CSS EDITOR \u003c= 1.0 - Authenticated(Administrator+) SQL Injection",
    "slug": "responsive-css-editor",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2482",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Accessibility Suite by Online ADA \u003c= 4.18 - Authenticated (Subscriber+) SQL Injection",
    "slug": "online-accessibility",
    "type": "plugin",
    "affected_version": "* - 4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32650",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Wp-Insert \u003c= 2.5.0 Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "wp-insert",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25461",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xews Lite \u003c= 1.0.9 - Unauthenticated Local File Inclusion",
    "slug": "xews-lite",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39383",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Starter Templates by FancyWP \u003c= 2.0.0 - Unauthenticated Blind Server-Side Request Forgery",
    "slug": "starter-templates",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13924",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Sitemap \u003c= 1.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-sitemap",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27312",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Backup, Restore and Migrate WordPress Sites With the XCloner Plugin \u003c= 3.1.2 - Remote Command Execution",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-4336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4336",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Member \u003c= 2.1.11 - Unauthenticated Privilege Escalation via User Meta",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 2.1.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.12",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-36155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36155",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Form Maker by 10Web – Mobile-Friendly Drag \u0026 Drop Contact Form Builder  \u003c= 1.15.25 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6130",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DefendWP Firewall \u003c= 1.1.0 - Missing Authorization",
    "slug": "defend-wp-firewall",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22280",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Coru LFMember \u003c= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "coru-lfmember",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1618",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Header \u0026 Footer Builder \u003c= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10050",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPRadio – WordPress Radio Streaming Plugin \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpradio",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13397",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enable SVG Uploads \u003c= 2.1.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "enable-svg-uploads",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2529",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Local Avatars \u003c= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration",
    "slug": "simple-local-avatars",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8482",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Countdown \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via clientId Parameter",
    "slug": "the-countdown",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5929",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SecuPress Free \u003c= 2.2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "secupress",
    "type": "plugin",
    "affected_version": "* - 2.2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30907",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OwnerRez \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ownerrez",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28957",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Appointment Booking \u0026 Scheduling \u003c 1.1.10 - Reflected Cross-Site Scripting",
    "slug": "ultimate-appointment-scheduling",
    "type": "plugin",
    "affected_version": "[*, 1.1.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-24313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24313",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shipment Tracker for Woocommerce \u003c= 1.4.23 - Reflected Cross-Site Scripting",
    "slug": "shipment-tracker-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.4.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24586",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24586",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icegram \u003c= 1.10.28.2 - Cross-Site Scripting",
    "slug": "icegram",
    "type": "plugin",
    "affected_version": "* - 1.10.28.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.28.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15830",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PopupAlly \u003c= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "popupally",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34796",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions) - Unauthenticated SQL Injection via id",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "20.0.0 - 21.8.0",
    "from_version": "20.0.0",
    "from_inclusive": true,
    "to_version": "21.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10628",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions) - Unauthenticated SQL Injection via id",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "7.0.0 - 8.8.0",
    "from_version": "7.0.0",
    "from_inclusive": true,
    "to_version": "8.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10628",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quiz Maker Business, Developer, and Agency \u003c= (Multiple Versions) - Unauthenticated SQL Injection via id",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "30.0.0 - 31.8.0",
    "from_version": "30.0.0",
    "from_inclusive": true,
    "to_version": "31.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10628",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Themify Builder \u003c= 7.6.3 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "themify-builder",
    "type": "plugin",
    "affected_version": "* - 7.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56216",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.0.3 - Remote Code Execution",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2006-2667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-2667",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Cirrus \u003c= 0.6.11 - Cross-Site Request Forgery",
    "slug": "wp-cirrus",
    "type": "plugin",
    "affected_version": "* - 0.6.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34181",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GDPR CCPA Compliance Support \u003c= 2.7.1 - Missing Authorization",
    "slug": "ninja-gdpr-compliance",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24591",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Google Map \u003c= 1.7.6 - Admin+ Stored Cross-Site Scripting",
    "slug": "gmap-embed",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24502",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SuperBackup \u003c= 2.3.3 - Missing Authorization to Unauthenticated Back-Up File Download",
    "slug": "indeed-wp-superbackup",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56067",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Meta slider and carousel with lightbox \u003c= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "meta-slider-and-carousel-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5932",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Essential Blocks – Page Builder Gutenberg Blocks, Patterns \u0026 Templates \u003c= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12045",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Breeze – WordPress Cache Plugin \u003c= 2.0.2 - Unprotected AJAX Actions",
    "slug": "breeze",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29444",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "RSSImport \u003c= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "rss-import",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4658",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.11.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9367",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GigPress \u003c= 2.3.8 - SQL Injection",
    "slug": "gigpress",
    "type": "plugin",
    "affected_version": "[*, 2.3.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-4066",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4066",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Redirection \u003c 2.2.12 - Reflected Cross-Site Scripting",
    "slug": "redirection",
    "type": "plugin",
    "affected_version": "[*, 2.2.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6717",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Light Poll \u003c= 1.0.0 - Cross-Site Request Forgery to Poll Deletion",
    "slug": "light-poll",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6496",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor  \u003c= 5.0.4 - Local File Inclusion",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "1.0.0 - 5.0.4",
    "from_version": "1.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0320",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Medicare \u003c= 2.1.0 - Unauthenticated PHP Object Injection",
    "slug": "medicare",
    "type": "theme",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39499",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BetterDocs \u003c= 2.5.2 - Missing Authorization via AJAX actions",
    "slug": "betterdocs",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47762",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Betheme | Responsive Multipurpose WordPress \u0026 WooCommerce Theme \u003c= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 27.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "27.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Account Manager for WooCommerce \u003c= 2.1.1 - Missing Authorization",
    "slug": "account-manager-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41656",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Pondol Form to Mail \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "pondol-formmail",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000146",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager – Calendar, Bookings, Tickets, and more! \u003c= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11260",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Kata Plus – Addons for Elementor – Widgets, Extensions and Templates \u003c= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "kata-plus",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9376",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.9.4 - Unauthenticated PHP Object Injection",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5952",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TinyChat Room Spy \u003c= 1.2.8 - Reflected Cross-Site Scripting",
    "slug": "tinychat-roomspy",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10110",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elements kit Elementor addons \u003c= 3.1.4 - Missing Authorization",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37255",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "amr shortcode any widget \u003c= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "amr-shortcode-any-widget",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Timthumb Vulnerability Scanner \u003c= 1.54 - Cross-Site Request Forgery",
    "slug": "timthumb-vulnerability-scanner",
    "type": "plugin",
    "affected_version": "* - 1.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.54",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44240",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CTHthemes CityBook \u003c 2.3.4, TownHub \u003c 1.0.6, EasyBook \u003c 1.2.2 Themes - Authenticated Post Deleition via IDOR",
    "slug": "easybook",
    "type": "theme",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-20209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20209",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "CTHthemes CityBook \u003c 2.3.4, TownHub \u003c 1.0.6, EasyBook \u003c 1.2.2 Themes - Authenticated Post Deleition via IDOR",
    "slug": "townhub",
    "type": "theme",
    "affected_version": "[*, 1.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-20209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20209",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "CTHthemes CityBook \u003c 2.3.4, TownHub \u003c 1.0.6, EasyBook \u003c 1.2.2 Themes - Authenticated Post Deleition via IDOR",
    "slug": "citybook",
    "type": "theme",
    "affected_version": "[*, 2.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-20209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20209",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Easy Poll \u003c= 2.2.9 - Reflected Cross-Site Scripting",
    "slug": "wp-easy-poll-afo",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32562",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chatbox Manager \u003c= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wa-chatbox-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58211",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Templata \u003c= 1.0.7 - Reflected Cross-Site Scripting",
    "slug": "wptemplata",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26917",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.1.0 - Reflected Cross-Site Scripting",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1724",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IP2Location Country Blocker \u003c= 2.33.3 - Unauthenticated Sensitive Information Exposure via Debug Log File",
    "slug": "ip2location-country-blocker",
    "type": "plugin",
    "affected_version": "* - 2.33.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.33.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22294",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form 7 \u003c= 5.0.3 - Authorization Bypass",
    "slug": "contact-form-7",
    "type": "plugin",
    "affected_version": "[*, 5.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20979",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10960",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "SEOPress \u003c= 8.1.1 - Missing Authorization",
    "slug": "wp-seopress",
    "type": "plugin",
    "affected_version": "* - 8.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50455",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hana Flv Player \u003c= 3.1.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "hana-flv-player",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24302",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom API for WP \u003c= 4.2.2 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "custom-api-for-wp",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54049",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CSV Product Import Export for WooCommerce \u003c= 1.0.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "csv-wc-product-import-export",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49244",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Snippet Shortcodes \u003c= 4.1.4 - Cross-Site Request Forgery",
    "slug": "shortcode-variables",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4543",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooEvents \u003c= 4.1.2 - Unauthenticated Arbitrary File Overwrite",
    "slug": "woo-events",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8671",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Calendarista Basic Edition \u003c= 3.0.2 - Cross-Site Request Forgery",
    "slug": "calendarista-basic-edition",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31942",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Related YouTube Videos \u003c= 1.9.8 - Cross-site Request Forgery",
    "slug": "related-youtube-videos",
    "type": "plugin",
    "affected_version": "[*, 1.9.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-5980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5980",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Auction Feed \u003c= 1.1.3 - Cross-Site Request Forgery",
    "slug": "auction-feed",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58671",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Profile Builder - User Profile \u0026 User Registration Forms \u003c= 3.6.1 - Cross-Site Scripting via site_url Parameter",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0653",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCafe \u003c= 2.2.22 - Missing Authorization",
    "slug": "wp-cafe",
    "type": "plugin",
    "affected_version": "* - 2.2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47805",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PopupAlly \u003c= 2.1.0 - Cross-Site Request Forgery via optin_submit_callback",
    "slug": "popupally",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23520",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NIX Anti-Spam Light \u003c= 0.0.4 - Cross-Site Request Forgery",
    "slug": "nix-anti-spam-light",
    "type": "plugin",
    "affected_version": "* - 0.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58270",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Word Replacer Pro \u003c= 1.0 - Missing Authorization",
    "slug": "word-replacer-ultra",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52229",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Simple Job Board \u003c= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "* - 2.12.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7761",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integration for Contact Form 7 and Zoho CRM, Bigin \u003c= 1.3.0 - Unauthenticated PHP Object Injection",
    "slug": "cf7-zoho",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49330",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.986",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.986",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7417",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JupiterX Theme \u003c= 3.0.0  - Authenticated Local File Inclusion via print_pane",
    "slug": "jupiterx",
    "type": "theme",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32110",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Custom Bulk/Quick Edit \u003c= 1.6.10 - Cross-Site Request Forgery",
    "slug": "custom-bulkquick-edit",
    "type": "plugin",
    "affected_version": "* - 1.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30946",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Podlove Subscribe button \u003c= 1.3.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "podlove-subscribe-button",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25479",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Push notification for Mobile and Web app \u003c= 2.0.3 - Missing Authorization",
    "slug": "push-notification-mobile-and-web-app",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48127",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Registration \u003c 6.00.03 - SQL Injection",
    "slug": "event-registration",
    "type": "plugin",
    "affected_version": "[*, 6.00.03)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.00.03",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2010-4839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2010-4839",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-3438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3438",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.5",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3438",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.5",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3438",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.3",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3438",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.1",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3438",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.1.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.1",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3438",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WIP WooCarousel Lite \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wip-woocarousel-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11779",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Addons for Elementor \u003c= 1.8.1 - Reflected Cross-Site Scripting",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "[*, 1.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0327",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Acme Fix Images \u003c= 1.0.0 - Missing Authorization via acme_fix_images_ajax_callback",
    "slug": "acme-fix-images",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47793",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Raychat \u003c= 2.1.0 - Missing Authorization",
    "slug": "raychat",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49236",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 4.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3175",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Thumbnail Generator \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "pdf-thumbnail-generator",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8737",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c= 10.18 - Missing Authorization",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 10.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32220",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Statistics \u003c= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via platform",
    "slug": "wp-statistics",
    "type": "plugin",
    "affected_version": "* - 13.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-25307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25307",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-in-One WP Migration and Backup \u003c= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection",
    "slug": "all-in-one-wp-migration",
    "type": "plugin",
    "affected_version": "* - 7.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.86",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9162",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9162",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Login With Ajax \u003c= 4.1 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "login-with-ajax",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30546",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ActiveCampaign for WooCommerce \u003c= 1.9.7 - Cross-Site Request Forgery",
    "slug": "activecampaign-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3923",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "amr users \u003c= 4.59.3 - Admin+ Stored Cross-Site Scripting",
    "slug": "amr-users",
    "type": "plugin",
    "affected_version": "[*, 4.59.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.59.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1094",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "yContributors \u003c= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ycontributors",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6041",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authorization Bypass to Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5715",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authorization Bypass to Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5715",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authorization Bypass to Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.10",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5715",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authorization Bypass to Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.10",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5715",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authorization Bypass to Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.8",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5715",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authorization Bypass to Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.7",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5715",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authorization Bypass to Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.7",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5715",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.3.1 - Authorization Bypass to Information Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.4",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5715",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Multi Step Form \u003c= 1.7.21 - Missing Authorization via fw_delete_files",
    "slug": "multi-step-form",
    "type": "plugin",
    "affected_version": "* - 1.7.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50428",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woocommerce Tip/Donation \u003c= 1.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting via plugin settings",
    "slug": "woo-tipdonation",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28783",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Startklar Elementor Addons \u003c= 1.7.13 - Unauthenticated Arbitrary File Upload",
    "slug": "startklar-elmentor-forms-extwidgets",
    "type": "plugin",
    "affected_version": "* - 1.7.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-4345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4345",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Block Logic \u003c= 1.0.8 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "block-logic",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2303",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Insert Pages \u003c= 3.6.1 - Contributor+ Stored Cross-Site Scripting",
    "slug": "insert-pages",
    "type": "plugin",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24850",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebARX \u003c= 1.3.0 - Firewall Bypass",
    "slug": "webarx",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17214",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Legal Pages \u003c= 1.3.8 - Cross-Site Request Forgery via moveToTrash and fetch_and_insert_template_data",
    "slug": "legal-pages",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47824",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP User Frontend \u003c= 3.5.25 - SQL Injection \u0026 Reflected Cross-Site Scripting",
    "slug": "wp-user-frontend",
    "type": "plugin",
    "affected_version": "* - 3.5.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25076",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slider Carousel – Responsive Image Slider \u003c= 1.5.0 - Missing Authorization",
    "slug": "slider-images",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25457",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "affiliate-toolkit \u003c= 3.5.5 - Unauthenticated Full Path Dislcosure",
    "slug": "affiliate-toolkit-starter",
    "type": "plugin",
    "affected_version": "* - 3.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6562",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ajax Search Lite \u003c= 4.13.1 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handler",
    "slug": "ajax-search-lite",
    "type": "plugin",
    "affected_version": "* - 4.13.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.13.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7956",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SUMO Affiliates Pro \u003c= 10.7.0 - Unauthenticated Arbitrary File Upload",
    "slug": "affs",
    "type": "plugin",
    "affected_version": "* - 10.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32291",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Barcode Scanner with Inventory \u0026 Order Manager \u003c= 1.5.3 - Reflected Cross-Site Scripting",
    "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27998",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Profitshare \u003c= 1.4.9 - Authenticated (Editor+) SQL Injection",
    "slug": "wp-profitshare",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30525",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "TheGem \u003c= 5.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Options Update",
    "slug": "thegem",
    "type": "theme",
    "affected_version": "* - 5.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4339",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EELV Newsletter \u003c= 4.8.2 - Cross-Site Request Forgery",
    "slug": "eelv-newsletter",
    "type": "plugin",
    "affected_version": "* - 4.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54430",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Online Order for Clover \u003c= 1.5.4 - Cross-Site Request Forgery",
    "slug": "clover-online-orders",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31238",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WeForms \u003c= 1.4.7 - CSV injection via form entry",
    "slug": "weforms",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-22276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-22276",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Bard \u003c= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter",
    "slug": "bard",
    "type": "theme",
    "affected_version": "* - 2.216",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.216",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9830",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SULly \u003c= 4.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "sully",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5033",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inline Related Posts \u003c= 3.5.0 - Information Exposure",
    "slug": "intelly-related-posts",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6257",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "CITS Support svg, webp Media and TTF,OTF File Upload \u003c= 2.1.0 - Authenticated(Author+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "cits-support-svg-webp-media-upload",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor ImageBox \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fd-elementor-imagebox",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3074",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZoloBlocks \u003c= 2.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zoloblocks",
    "type": "plugin",
    "affected_version": "* - 2.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58230",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Forms for Mailchimp \u003c= 6.9.0 - Missing Authorization",
    "slug": "yikes-inc-easy-mailchimp-extender",
    "type": "plugin",
    "affected_version": "* - 6.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35742",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "IMPress for IDX Broker \u003c= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "idx-broker-platinum",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44047",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traveler \u003c= 3.2.0 - Unauthenticated SQL Injection",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26898",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Planaday API \u003c= 11.4 - Reflected Cross-Site Scripting",
    "slug": "planaday-api",
    "type": "plugin",
    "affected_version": "* - 11.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11804",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds \u003c= 1.0.13 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "userfeedback-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0903",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Builder for WooCommerce reviews shortcodes – ReviewShort \u003c= 1.01.5 - Missing Authorization",
    "slug": "woo-product-reviews-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.01.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34763",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Maps Plugin using Google Maps for WordPress – WP Google Map \u003c= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gmap-embed",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13306",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arkhe Blocks \u003c= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "arkhe-blocks",
    "type": "plugin",
    "affected_version": "* - 2.23.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.23.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49261",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Epic Church by Organized Themes \u003c= 3.6 - Arbitrary File Download",
    "slug": "epic-church",
    "type": "theme",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-10396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-10396",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Ultimate CSV Importer \u003c= 6.4.2 - Admin+ Stored Cross-Site Scripting",
    "slug": "wp-ultimate-csv-importer",
    "type": "plugin",
    "affected_version": "[*, 6.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0360",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0 - Denial of Service",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-6389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6389",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Secure Downloads \u003c= 1.2.2 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "secure-downloads",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8031",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Prayer \u003c= 2.0.9 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-prayer",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3405",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Social Feed \u003c= 6.5.4 - Cross-Site Request Forgery",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 6.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1214",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Clearout Email Validator \u003c= 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "clearout-email-validator",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30789",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sirv \u003c= 7.2.2 - Missing Authorization to Arbitrary Options Update",
    "slug": "sirv",
    "type": "plugin",
    "affected_version": "* - 7.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32959",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UserPlus \u003c= 2.0 - Privilege Escalation",
    "slug": "userplus",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52442",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MemberPress \u003c= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode",
    "slug": "memberpress",
    "type": "plugin",
    "affected_version": "* - 1.11.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.29",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5031",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "WP Child Theme Generator \u003c= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "wp-child-theme-generator",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-47873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47873",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Multi Step Form \u003c= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "multi-step-form",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4196",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.17",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.16",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.11",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.25",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.15",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.8",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.12",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.7",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.27",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.24",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.27",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.24",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.21",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20153",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traffic Analyzer \u003c 3.4.2 - Cross-Site Scripting",
    "slug": "trafficanalyzer",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-3526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3526",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paytium: Mollie payment forms \u0026 donations \u003c= 4.3.7 - Missing Authorization in 'pt_cancel_subscription'",
    "slug": "paytium",
    "type": "plugin",
    "affected_version": "* - 4.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7287",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Buy Me a Coffee – Button and Widget Plugin \u003c= 3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "buymeacoffee",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2082",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enter Addons – Ultimate Template Builder for Elementor \u003c= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Events Card Widget",
    "slug": "enteraddons",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7611",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ticket Customer Service Software \u0026 Support Ticket System \u003c= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-ticket",
    "type": "plugin",
    "affected_version": "* - 6.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60157",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Caching Compatible Cookie Opt-In and JavaScript \u003c= 0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "caching-compatible-cookie-optin-and-javascript",
    "type": "plugin",
    "affected_version": "* - 0.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24547",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Website Article Monetization By MageNet \u003c= 1.0.11 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "website-article-monetization-by-magenet",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1379",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fuse Social Floating Sidebar \u003c= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload",
    "slug": "fuse-social-floating-sidebar",
    "type": "plugin",
    "affected_version": "* - 5.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5226",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SafetyForms \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "safetymails-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49615",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JetElements For Elementor \u003c= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53982",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Membership Simplified \u003c= 1.58 - Arbitrary File Download",
    "slug": "membership-simplified-for-oap-members-only",
    "type": "plugin",
    "affected_version": "* - 1.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.58",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-1002008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1002008",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Clockwork SMS Notfications \u003c 2.4.2 - Cross-Site Scripting",
    "slug": "mediaburst-email-to-sms",
    "type": "plugin",
    "affected_version": "[*, 2.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18495",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GeoDigs \u003c= 3.4.1 - Reflected Cross-Site Scripting",
    "slug": "geodigs",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23628",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yet Another Countdown \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yacp",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Duplicator – WordPress Migration Plugin \u003c= 1.4.7 - Unauthenticated Backup Download",
    "slug": "duplicator",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-2551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2551",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI Tools \u003c= 4.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "artificial-intelligence-auto-content-generator",
    "type": "plugin",
    "affected_version": "* - 4.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50029",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Download \u003c= 1.2 - SQL Injection",
    "slug": "wp-download",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-1646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-1646",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Connector for Gravity Forms and Google Sheets \u003c= 1.2.4 - Cross-Site Request Forgery",
    "slug": "wp-gravity-forms-spreadsheets",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54682",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Accordions – Multiple Accordions or FAQs Builder \u003c= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'license' parameter",
    "slug": "accordions-or-faqs",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45082",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mediumish \u003c= 1.0.60 - Reflected Cross-Site Scripting",
    "slug": "mediumishh",
    "type": "theme",
    "affected_version": "* - 1.0.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.60",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24316",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8522",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Podcast Importer SecondLine \u003c 1.3.8 - SQL Injection",
    "slug": "podcast-importer-secondline",
    "type": "plugin",
    "affected_version": "[*, 1.3.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1023",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Form Builder \u003c= 1.9.9.0 - Unauthenticated CSV Injection",
    "slug": "contact-form-add",
    "type": "plugin",
    "affected_version": "* - 1.9.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23796",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Twispay Credit Card Payments \u003c= 2.1.2 - Reflected Cross-Site Scripting",
    "slug": "twispay",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32601",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ali2Woo Lite \u003c= 3.4.4 - Cross-Site Request Forgery to PHP Object Injection",
    "slug": "ali2woo-lite",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37212",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Verge3D \u003c= 4.5.2 - Authenticated(Subscriber+) Arbitrary File Upload",
    "slug": "verge3d",
    "type": "plugin",
    "affected_version": "* - 4.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51421",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Login As Users \u003c= 1.4.2 - Authentication Bypass",
    "slug": "login-as-users",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43311",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8529",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "BeeTeam368 Extensions Pro \u003c= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion",
    "slug": "beeteam368-extensions-pro",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6379",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Builder: KingComposer \u003c 2.9.4 - Arbitrary File Upload",
    "slug": "kingcomposer",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36701",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Th Shop Mania \u003c= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation",
    "slug": "th-shop-mania",
    "type": "theme",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10674",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Notes Widget \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-notes-widget",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48121",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mobile Menu \u003c= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification",
    "slug": "mobile-menu",
    "type": "plugin",
    "affected_version": "* - 2.8.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2508",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Alloggio Membership \u003c= 1.1 - Authentication Bypass via Social Login Account Takeover",
    "slug": "alloggio-membership",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-1638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1638",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Database Reset \u003c= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation",
    "slug": "wordpress-database-reset",
    "type": "plugin",
    "affected_version": "* - 3.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1501",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "VKontakte Cross-Post \u003c=  0.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "vkontakte-cross-post",
    "type": "plugin",
    "affected_version": "* - 0.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32498",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit Assist \u003c= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter",
    "slug": "bit-assist",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0822",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce Multi Currency \u003c= 2.1.17 - Missing Authorization",
    "slug": "woocommerce-multi-currency",
    "type": "plugin",
    "affected_version": "* - 2.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4379",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Post Grid, Slider \u0026 Carousel Ultimate – with Shortcode, Gutenberg Block \u0026 Elementor Widget \u003c= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup",
    "slug": "post-grid-carousel-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2006",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads – Simple eCommerce for Selling Digital Files \u003c= 2.3.6 - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "[2.3, 2.3.7)",
    "from_version": "2.3",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Simple eCommerce for Selling Digital Files \u003c= 2.3.6 - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "[*, 1.8.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Simple eCommerce for Selling Digital Files \u003c= 2.3.6 - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "[1.9, 1.9.10)",
    "from_version": "1.9",
    "from_inclusive": true,
    "to_version": "1.9.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Simple eCommerce for Selling Digital Files \u003c= 2.3.6 - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "[2.0, 2.0.5)",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Simple eCommerce for Selling Digital Files \u003c= 2.3.6 - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "[2.1, 2.1.11)",
    "from_version": "2.1",
    "from_inclusive": true,
    "to_version": "2.1.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Simple eCommerce for Selling Digital Files \u003c= 2.3.6 - Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "[2.2, 2.2.9)",
    "from_version": "2.2",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9505",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event List \u003c= 1.9.2 - Unauthenticated Local File Inclusion",
    "slug": "eventlist",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53204",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0694",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "LTL Freight Quotes – SEFL Edition \u003c= 3.2.4 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-sefl-edition",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13479",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Poll, Survey, Questionnaire and Voting system \u003c= 1.7.4 - Authenticated (Administrator+) Cross-Site Scripting",
    "slug": "polls-widget",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-34656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34656",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Order Export For WooCommerce \u003c= 1.5.4 - CSV Injection",
    "slug": "woo-order-export-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-11525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11525",
    "auth_type": "Unauth",
    "cvss_score": 7.8,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP File Download \u003c= 6.2.5 - Reflected Cross-Site Scripting",
    "slug": "wp-file-download",
    "type": "plugin",
    "affected_version": "* - 6.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zajax – Ajax Navigation \u003c= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "zajax-ajax-navigation",
    "type": "plugin",
    "affected_version": "* - 0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53719",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13599",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blogpoet \u003c= 1.0.2 - Missing Authorization via blogpoet_install_and_activate_plugins()",
    "slug": "blogpoet",
    "type": "theme",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43998",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hand Talk \u003c= 6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "handtalk",
    "type": "plugin",
    "affected_version": "* - 6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50015",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swatchly – WooCommerce Variation Swatches for Products \u003c= 1.2.0 - Cross-Site Request Forgery via plugin_activation",
    "slug": "swatchly",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23792",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Find and Replace All \u003c= 1.3 - Cross-Site Request Forgery to Arbitrary Content Replacement",
    "slug": "find-and-replace-all",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3850",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gestpay for WooCommerce \u003c= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_delete_card",
    "slug": "gestpay-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 20221130",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20221130",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0432",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Twitter Cards Meta – Best Twitter Card Plugin for WordPress \u003c 2.5.0 - Cross-Site Scripting",
    "slug": "twitter-cards-meta",
    "type": "plugin",
    "affected_version": "[*, 2.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18503",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive iframe GoogleMap \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "responsive-iframe-googlemap",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11813",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11813",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Request Forgery to Post Lockage",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.9",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-5731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5731",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Request Forgery to Post Lockage",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.9",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-5731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5731",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Request Forgery to Post Lockage",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.7",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-5731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5731",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Request Forgery to Post Lockage",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.6",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-5731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5731",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Request Forgery to Post Lockage",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.6",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-5731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5731",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Request Forgery to Post Lockage",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.3",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-5731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5731",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Cross-Site Request Forgery to Post Lockage",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-5731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5731",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Custom Thank You Page Customize For WooCommerce by Binary Carpenter \u003c= 1.4.13 - Missing Authorization",
    "slug": "bc-woo-custom-thank-you-pages",
    "type": "plugin",
    "affected_version": "* - 1.4.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32517",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Seed Fonts 2.3.1 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "seed-fonts",
    "type": "plugin",
    "affected_version": "2.3.1",
    "from_version": "2.3.1",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35779",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Property Listings \u003c= 3.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "easy-property-listings",
    "type": "plugin",
    "affected_version": "* - 3.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2869",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "aBitGone CommentSafe \u003c= 1.0.0 - Cross-Site Request Forgery to Settings Update and Cross-Site Request Forgery",
    "slug": "abitgone-commentsafe",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7174",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mollie Forms \u003c= 2.6.3 - Missing Authorization",
    "slug": "mollie-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1645",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Downloads Manager \u003c= 0.2 - Arbitrary File Upload",
    "slug": "downloads-manager",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-3362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-3362",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Charity Addon for Elementor \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "charity-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51938",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yoast SEO \u003c= 1.7.3.3 - Blind SQL Injection",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2292",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yoast SEO \u003c= 1.7.3.3 - Blind SQL Injection",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "1.6 - 1.6.3",
    "from_version": "1.6",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2292",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yoast SEO \u003c= 1.7.3.3 - Blind SQL Injection",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "1.7 - 1.7.3",
    "from_version": "1.7",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2292",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.0.8 - Missing Authorization to Course Category Creation",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35093",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 5.0.1.7 - Authentication Bypass",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.0.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-4073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4073",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Autolinks Manager \u003c= 1.10.04 - Cross-Site Request Forgery",
    "slug": "daext-autolinks-manager",
    "type": "plugin",
    "affected_version": "* - 1.10.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46625",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Download Manager \u003c= 2.9.51 - Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 2.9.51",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.51",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18032",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1001",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9668",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMSify \u003c= 6.0.4 - Reflected Cross-Site Scripting",
    "slug": "smsify",
    "type": "plugin",
    "affected_version": "* - 6.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54324",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CP Image Store with Slideshow \u003c= 1.0.67 - Unauthenticated SQL Injection",
    "slug": "cp-image-store",
    "type": "plugin",
    "affected_version": "[*, 1.0.68)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.68",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-1692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1692",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Taskbuilder – WordPress Project \u0026 Task Management plugin \u003c= 3.0.4 - Authenticated (Admin+) SQL injection",
    "slug": "taskbuilder",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9828",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ultimate Addons for Contact Form 7 \u003c= 3.2.10 - Missing Authorization",
    "slug": "ultimate-addons-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 3.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47693",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "EPROLO Dropshipping \u003c= 1.7.1 - Missing Authorization",
    "slug": "eprolo-dropshipping",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33573",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PS PHPCaptcha \u003c= 1.1.0 - Authenticated Denial of Service",
    "slug": "ps-phpcaptcha",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-7412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-7412",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Advanced Classifieds \u0026 Directory Pro \u003c= 3.0.0 - Missing Authorization to Arbitrary Attachment Deletion",
    "slug": "advanced-classifieds-and-directory-pro",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2222",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.6.5 - Unauthenticated Bypass to User Registration",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4444",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Customer Area \u003c= 8.2.0 - Insecure Direct Object Reference to Account Address Disclosure",
    "slug": "customer-area",
    "type": "plugin",
    "affected_version": "* - 8.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6824",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP DSGVO Tools (GDPR) \u003c= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "shapepress-dsgvo",
    "type": "plugin",
    "affected_version": "* - 3.1.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3201",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classified Listing – Classified ads \u0026 Business Directory Plugin \u003c= 3.0.4 - Missing Authorization",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1352",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "FoodBakery | Delivery Restaurant Directory WordPress Theme \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "wp-foodbakery",
    "type": "theme",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24389",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Currency Switcher \u003c= 2.11.1 - Authorization Bypass",
    "slug": "currency-switcher-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.11.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-18668",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-18668",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Easy Social Icons \u003c= 3.1.3 - Admin+ SQL Injection",
    "slug": "easy-social-icons",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0887",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "Listeo - Directory \u0026 Listings With Booking - WordPress Theme \u003c 1.6.11 - Cross-Site Scripting",
    "slug": "listeo",
    "type": "theme",
    "affected_version": "[*, 1.6.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24317",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress GDPR \u003c= 2.0.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wordpress-gdpr",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10388",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10388",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kadence Blocks \u003c= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12581",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Customify Site Library \u003c= 0.0.9 - Unauthenticated Remote Code Execution",
    "slug": "customify-sites",
    "type": "plugin",
    "affected_version": "* - 0.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33644",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP Funnel Manager \u003c= 1.4.0 - Unauthenticated PHP Object Injection",
    "slug": "wp-funnel-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52761",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PowerPack Pro for Elementor \u003c= 2.10.14 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "powerpack-elements",
    "type": "plugin",
    "affected_version": "* - 2.10.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-39634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39634",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Medical Addon for Elementor \u003c= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode",
    "slug": "medical-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12046",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ACF City Selector \u003c= 1.14.0 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "acf-city-selector",
    "type": "plugin",
    "affected_version": "* - 1.14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56264",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56264",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "teachPress \u003c= 9.0.11 - Authenticated (Contributor+) SQL Injection",
    "slug": "teachpress",
    "type": "plugin",
    "affected_version": "* - 9.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32149",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Mine CloudVod \u003c= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio Parameter",
    "slug": "mine-cloudvod",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8071",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salient Shortcodes \u003c= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "salient-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3811",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPAMS \u003c= 44.0 (17-08-2023) - Authenticated (Subscriber+) SQL Injection",
    "slug": "apartment-management",
    "type": "plugin",
    "affected_version": "[*, 44.0 (17-08-2023)]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "44.0 (17-08-2023)",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39403",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MPL-Publisher \u003c= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mpl-publisher",
    "type": "plugin",
    "affected_version": "* - 2.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46226",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Foodbakery \u003c= 4.8 - Authentication Bypass in foodbakery_parse_request",
    "slug": "wp-foodbakery",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-0181",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0181",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Business Manager \u003c= 4.6.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-business-manager",
    "type": "plugin",
    "affected_version": "* - 4.6.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51599",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Content Copy Protection \u0026 No Right Click (PRO) \u003c= 15.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wccp-pro",
    "type": "plugin",
    "affected_version": "* - 15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6693",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Activity Log Pro \u003c= 2.3.4 - Missing Authorization",
    "slug": "user-activity-log-pro",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37929",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "More Mime Type Filters \u003c= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "more-mime-type-filters",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31394",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RAYS Grid \u003c= 1.2.2 - Cross-Site Request Forgery Bypass",
    "slug": "rays-grid",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4423",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SEO Plugin by Squirrly SEO \u003c= 12.1.20 - Missing Authorization",
    "slug": "squirrly-seo",
    "type": "plugin",
    "affected_version": "* - 12.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44626",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WooCommerce \u003c= 8.9.2 - Authenticated (Shop Manager+) Content Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "* - 8.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.9.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-35777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35777",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Visual Link Preview \u003c= 2.2.2 - Unauthorised AJAX Calls",
    "slug": "visual-link-preview",
    "type": "plugin",
    "affected_version": "[*, 2.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24635",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Uncanny Toolkit for LearnDash \u003c= 3.7.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "uncanny-learndash-toolkit",
    "type": "plugin",
    "affected_version": "* - 3.7.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22268",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirects \u003c= 1.2.1 - Missing Authorization",
    "slug": "redirects",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49845",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OneClick Chat to Order \u003c= 1.0.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "oneclick-whatsapp-order",
    "type": "plugin",
    "affected_version": "* - 1.0.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47546",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print-O-Matic \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "print-o-matic",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4753",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple JWT Login \u003c= 3.2.0 - Cross-Site Request Forgery",
    "slug": "simple-jwt-login",
    "type": "plugin",
    "affected_version": "[*, 3.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24804",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ebook Store \u003c= 5.8012 - Authenticated (Administrator+) Stored Cross-Site Scripting via Order Details",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.8012",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8012",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7486",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7486",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LH Login Page \u003c= 2.14 - Reflected Cross-Site Scripting",
    "slug": "lh-login-page",
    "type": "plugin",
    "affected_version": "* - 2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tainacan \u003c= 0.21.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "tainacan",
    "type": "plugin",
    "affected_version": "* - 0.21.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.21.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48040",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Portfolio – WordPress Portfolio Plugin \u003c= 2.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "tlp-portfolio",
    "type": "plugin",
    "affected_version": "* - 2.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23685",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 4.5.0 - Missing Authorization to Donation Update",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7221",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Icons Widget \u0026 Block \u003c= 4.2.17 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "social-icons-widget-by-wpzoom",
    "type": "plugin",
    "affected_version": "* - 4.2.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2189",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comment Edit Core – Simple Comment Editing \u003c= 3.0.33 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "simple-comment-editing",
    "type": "plugin",
    "affected_version": "* - 3.0.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24703",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Memberpress \u003c= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "memberpress",
    "type": "plugin",
    "affected_version": "* - 1.11.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11299",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Liquido \u003c= 1.0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "liquido",
    "type": "theme",
    "affected_version": "* - 1.0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43993",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamics 365 Integration \u003c= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection",
    "slug": "integration-dynamics",
    "type": "plugin",
    "affected_version": "* - 1.3.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.23",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12583",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Affiliates Manager \u003c= 2.8.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "affiliates-manager",
    "type": "plugin",
    "affected_version": "* - 2.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-25078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25078",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Brute Force Protection – Stop Brute Force Attacks \u003c= 2.2.5 - Authenticated (Administrator+) SQL Injection via orderby",
    "slug": "guardgiant",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48764",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stop Registration Spam \u003c= 1.23 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "stop-registration-spam",
    "type": "plugin",
    "affected_version": "* - 1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12219",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Etsy Shop \u003c= 3.0.6 - Reflected Cross-Site Scripting",
    "slug": "etsy-shop",
    "type": "plugin",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9115",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plausible Analytics \u003c= 1.2.2 - Stored Cross-Site Scripting",
    "slug": "plausible-analytics",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27845",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Author Bio Shortcode \u003c= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "author-bio-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31731",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiquidPoll – Advanced Polls for Creators and Brands \u003c= 3.3.68 - Missing Authorization via activate_addon",
    "slug": "wp-poll",
    "type": "plugin",
    "affected_version": "* - 3.3.68",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.68",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36531",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "s2Member \u003c= 250419 - Authenticated (Administrator+) Local File Inclusion",
    "slug": "s2member",
    "type": "plugin",
    "affected_version": "* - 250419",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "250419",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32137",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections \u0026 Template Library\t \u003c= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blockart-blocks",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35704",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapPress \u003c= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.88.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.88.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7225",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Academy LMS \u003c= 2.0.4 - Missing Authorization",
    "slug": "academy",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-38701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38701",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.11.13 - Authenticated (Editor+) Arbitrary File Deletion",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.11.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47511",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Couponis Demo \u003c 2.2 - Unauthenticated SQL Injection",
    "slug": "couponis-demo",
    "type": "theme",
    "affected_version": "[*, 2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2023-49750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49750",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Moloni \u003c= 4.7.4 - Reflected Cross-Site Scripting",
    "slug": "moloni",
    "type": "plugin",
    "affected_version": "* - 4.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38694",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photospace Responsive \u003c= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "photospace-responsive",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4271",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons PRO \u003c= 2.8.24 - Reflected Cross-Site Scripting",
    "slug": "premium-addons-pro",
    "type": "plugin",
    "affected_version": "* - 2.8.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34012",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Greenshift – animation and page builder blocks \u003c= 4.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "greenshift-animation-and-page-builder-blocks",
    "type": "plugin",
    "affected_version": "* - 4.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0378",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Panorama – WordPress Project Management Plugin \u003c= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "project-panorama-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11843",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Child Theme Creator \u003c= 1.3.1 - Cross-Site Request Forgery",
    "slug": "easy-child-theme-creator",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39375",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Soledad \u003c= 8.4.1 - Unauthenticated PHP Object Injection",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-49826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49826",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Team Member \u003c= 4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via new_style_name",
    "slug": "team-showcase-supreme",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rapyd Payment Extension for WooCommerce \u003c= 1.1.9 - Unauthenticated PHP Object Injection",
    "slug": "rapyd-payments",
    "type": "theme",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30618",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Addons for Elementor \u003c= 1.36.31 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "ultimate-elementor",
    "type": "plugin",
    "affected_version": "* - 1.36.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.36.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37455",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Support Genix \u003c= 1.4.11 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "support-genix-lite",
    "type": "plugin",
    "affected_version": "* - 1.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30777",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages \u003c= 3.4.19 - Missing Authorization",
    "slug": "wc4bp",
    "type": "plugin",
    "affected_version": "* - 3.4.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35726",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSS Feed Widget \u003c= 3.0.0 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']",
    "slug": "rss-feed-widget",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9835",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscriptions \u0026 Memberships for PayPal \u003c= 1.1.6 - Cross-Site Request Forgery to Arbitrary Post Deletion",
    "slug": "subscriptions-memberships-for-paypal",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13560",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CRM and Lead Management by vcita \u003c= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter",
    "slug": "crm-customer-relationship-management-by-vcita",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5240",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import Export WordPress Users and WooCommerce Customers \u003c= 1.3.1 - CSV Injection",
    "slug": "users-customers-import-export-for-wp-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15092",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15092",
    "auth_type": "Auth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Duplicate Page and Post \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "duplicate-post-and-page",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31471",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "No Spam At All \u003c= 1.3 - Missing Authorization",
    "slug": "no-spam-at-all",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24778",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tracking Code Manager \u003c= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tracking-code-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6335",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pre* Party Resource Hints \u003c 1.8.19 - Authenticated(Administrator+) SQL Injection",
    "slug": "pre-party-browser-hints",
    "type": "plugin",
    "affected_version": "[*, 1.8.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50855",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ad Manager \u003c= 1.1.2 - Open Redirection",
    "slug": "wordpress-admanager",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-8754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8754",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber \u003c= 7.3.14 - Authenticated (Admin+) SQL Injection",
    "slug": "aweber-web-form-widget",
    "type": "plugin",
    "affected_version": "* - 7.3.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1793",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Kinds \u003c 1.3.1.1 - Cross-Site Scripting",
    "slug": "indieweb-post-kinds",
    "type": "plugin",
    "affected_version": "[*, 1.3.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9494",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "codoc \u003c= 0.9.51.12 - Reflected Cross-Site Scripting",
    "slug": "codoc",
    "type": "plugin",
    "affected_version": "* - 0.9.51.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.51.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37961",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c 1.2.2 - Cross-Site Request Forgery",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "[*, 1.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-5178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5178",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Countdown and CountUp, WooCommerce Sales Timer \u003c= 1.8.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "countdown-wpdevart-extended",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47533",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Guide \u003c= 1.0.0 - Unauthenticated SQL Injection",
    "slug": "wp-easy-guide",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-46460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46460",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "My Custom Widgets \u003c= 2.0.5 - Reflected Cross-Site Scripting",
    "slug": "mycustomwidget",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46526",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newspaper Lite \u003c 11.0 - Reflected Cross-Site Scripting",
    "slug": "newspaper-lite",
    "type": "theme",
    "affected_version": "* - 10.3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-3135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-3135",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nested Pages \u003c= 3.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "wp-nested-pages",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8759",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Browse As \u003c= 0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie",
    "slug": "browse-as",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5190",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Amilia Store \u003c= 2.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "amilia-store",
    "type": "plugin",
    "affected_version": "* - 2.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50472",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library",
    "slug": "auto-thickbox",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2537",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library",
    "slug": "youtube-video-player",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2537",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Plugins \u003c= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.59.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.59.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2537",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zendrop – Global Dropshipping \u003c= 1.0.0 - Arbitrary File Upload",
    "slug": "zendrop-dropshipping-and-fulfillment",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-25970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25970",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.39 - Authenticated (Contributor+) Directory Traversal",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1165",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media Library Assistant \u003c= 3.00 - Information Disclosure",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.00",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.00",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41618",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Relevanssi \u003c= 4.22.2 (Free) and \u003c= 2.25.1 (Premium) - Unauthenticated Information Exposure",
    "slug": "relevanssi-premium",
    "type": "plugin",
    "affected_version": "* - 2.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7630",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Relevanssi \u003c= 4.22.2 (Free) and \u003c= 2.25.1 (Premium) - Unauthenticated Information Exposure",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "* - 4.22.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.22.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7630",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetWidgets For Elementor \u003c= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters",
    "slug": "jetwidgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4626",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My auctions allegro \u003c= 3.6.17 - Reflected Cross-Site Scripting",
    "slug": "my-auctions-allegro-free-edition",
    "type": "plugin",
    "affected_version": "* - 3.6.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11707",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47632",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Latest Posts \u003c= 3.7.4 - Reflected Cross-Site Scripting",
    "slug": "wp-latest-posts",
    "type": "plugin",
    "affected_version": "* - 3.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10913",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Custom Profile Picture \u003c= 1.0 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "woo-custom-profile-picture",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49658",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP OAuth Server (OAuth Authentication) \u003c= 4.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "oauth2-provider",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3892",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tainacan \u003c= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read",
    "slug": "tainacan",
    "type": "plugin",
    "affected_version": "* - 0.21.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.21.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7135",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SEO Redirection \u003c= 4.2 - Stored Cross-Site Scripting",
    "slug": "seo-redirection",
    "type": "plugin",
    "affected_version": "[*, 4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10896",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Tag, Category, and Taxonomy Manager – AI Autotagger \u003c= 3.32.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-tags",
    "type": "plugin",
    "affected_version": "* - 3.32.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.32.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0627",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wsify Widget \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wsify-widget",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48048",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Content Type Manager \u003c= 0.9.8.5 - Authenticated (Admin+) Remote Code Execution",
    "slug": "custom-content-type-manager",
    "type": "plugin",
    "affected_version": "* - 0.9.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-3173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3173",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Drop Shadow Boxes \u003c= 1.7.14 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "drop-shadow-boxes",
    "type": "plugin",
    "affected_version": "* - 1.7.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10262",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "HUSKY – Products Filter for WooCommerce Professional \u003c= 1.3.5.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1795",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Luzuk Slider \u003c= 0.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "luzuk-slider",
    "type": "plugin",
    "affected_version": "* - 0.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51834",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tourfic \u003c= 2.11.7 - Reflected Cross-Site Scripting",
    "slug": "tourfic",
    "type": "plugin",
    "affected_version": "* - 2.11.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29137",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI ChatBot \u003c= 4.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2811",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.5.1 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-0235",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-0235",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web - Mobile-Friendly Image Gallery \u003c= 1.8.19 - Directory Traversal to Arbitrary File Rename",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.19",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-0221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0221",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Multiplayer Games \u003c= 3.7 - Reflected Cross-Site Scripting",
    "slug": "multiplayer-plugin",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34644",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce Blocker Lite \u003c= 2.1.5 - Cross-Site Request Forgery",
    "slug": "woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39159",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Testimonials \u003c= 3.0.8 - Reflected Cross-Site Scripting",
    "slug": "super-testimonial",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43959",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ML Responsive Audio player with playlist Shortcode \u003c= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mlr-audio",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51573",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Download Manager \u003c= 2.7.2 - Authenticated Arbitrary Options Update",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "[*, 2.7.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9260",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Mercado Pago payments for WooCommerce \u003c= 6.3.1 - Cross-Site Request Forgery",
    "slug": "woocommerce-mercadopago",
    "type": "plugin",
    "affected_version": "* - 6.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45068",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Anant Addons for Elementor \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "anant-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50038",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Absolutely Glamorous Custom Admin \u003c= 7.2.3 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "ag-custom-admin",
    "type": "plugin",
    "affected_version": "* - 7.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33627",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Text Selection Color \u003c= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "text-selection-color",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31464",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Silverlight Media Player \u003c= 0.8 - Cross-Site Scripting",
    "slug": "wp-media-player",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4589",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directorist \u003c= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2224",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Cookie Law Info \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-cookie-law-info",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37557",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Membership For WooCommerce \u003c= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "membership-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39579",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPress \u003c= 8.3.7 - Arbitrary File Upload",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 8.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24123",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wp Custom CMS Block \u003c= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-custom-cms-block",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46457",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDReseller \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gdreseller",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50536",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Getnet Argentina para Woocommerce 0.0.1 - 0.0.4 - Authorization Bypass via webhook",
    "slug": "integrar-getnet-con-woo",
    "type": "plugin",
    "affected_version": "0.0.1 - 0.0.4",
    "from_version": "0.0.1",
    "from_inclusive": true,
    "to_version": "0.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3525",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WPComplete \u003c= 2.9.4 - Reflected Cross-Site Scripting",
    "slug": "wpcomplete",
    "type": "plugin",
    "affected_version": "[*, 2.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-45825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45825",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Breadcrumbs \u003c= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "essential-breadcrumbs",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53778",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBITS Addons For Elementor Page Builder \u003c= 1.5.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wpbits-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22316",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Members \u003c= 5.0.3 - Authenticated Cross-Site Scripting",
    "slug": "tc-team-members",
    "type": "plugin",
    "affected_version": "[*, 5.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24128",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24128",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chatroll Live Chat \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "chatroll-live-chat",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12464",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Categorify \u003c= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxClearCategory",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "* - 1.0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1910",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Opal Membership \u003c= 1.2.4 - Authenticated (Subscriber+) Information Disclosure",
    "slug": "opal-membership",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7648",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Conditional Payments for WooCommerce \u003c= 3.3.0 - Cross-Site Request Forgery",
    "slug": "conditional-payments-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39563",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Visitors Tracker \u003c= 2.3 - Reflected Cross-Site Scripting",
    "slug": "wp_visitorstracker",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35737",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Post Expiration \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-post-expiration",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31734",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Ultra \u003c= 7.3.5 - Missing Authorization",
    "slug": "themify-ultra",
    "type": "theme",
    "affected_version": "* - 7.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46146",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Ultimate Classified Listings \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "ultimate-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5883",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Animate It \u003c= 2.3.5 - Cross-Site Scripting",
    "slug": "animate-it",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17384",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Share Buttons Adder \u003c= 8.4.6 - Cross-Site Request Forgery",
    "slug": "simple-share-buttons-adder",
    "type": "plugin",
    "affected_version": "* - 8.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47178",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Real WP Shop Lite Ajax eCommerce Shopping Cart \u003c= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "real-wp-shop-lite",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11140",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fast Total Search \u003c= 1.78.258 - Missing Authorization",
    "slug": "fulltext-search",
    "type": "plugin",
    "affected_version": "* - 1.78.258",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.78.258",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24571",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AutomatorWP \u003c= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditions",
    "slug": "automatorwp",
    "type": "plugin",
    "affected_version": "* - 5.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-5487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5487",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "List Subpages \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter",
    "slug": "list-sub-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8290",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.5.28 - Missing Authorization",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.5.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32237",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Webriti SMTP Mail \u003c= 1.0 - Cross-Site Request Forgery to options update",
    "slug": "webriti-smtp-mail",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1612",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Arkhe Blocks \u003c= 2.27.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "arkhe-blocks",
    "type": "plugin",
    "affected_version": "* - 2.27.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.27.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32161",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "3DPrint Lite \u003c 1.9.1.5 - Arbitrary File Upload",
    "slug": "3dprint-lite",
    "type": "plugin",
    "affected_version": "[*, 1.9.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4436",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Job Manager \u003c= 0.7.18 - Cross-Site Scripting",
    "slug": "job-manager",
    "type": "plugin",
    "affected_version": "* - 0.7.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-6713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6713",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPeMatico RSS Feed Fetcher \u003c= 2.6.11 - Admin+ Stored Cross-Site Scripting",
    "slug": "wpematico",
    "type": "plugin",
    "affected_version": "[*, 2.6.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24793",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom CSS, JS \u0026 PHP \u003c= 2.0.7 - Cross-Site Request Forgery Bypass",
    "slug": "custom-css-js-php",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4418",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Predict When \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "predict-when",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23484",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radio Buttons and Swatches for WooCommerce \u003c= 1.1.20 - Reflected Cross-Site Scripting",
    "slug": "variations-radio-buttons-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24551",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Risk Warning Bar \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "risk-warning-bar",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49638",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GistPress \u003c 3.0.2 - Cross-Site Scripting",
    "slug": "gistpress",
    "type": "plugin",
    "affected_version": "[*, 3.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-8498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8498",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Get Custom Field Values \u003c= 4.0.0 - Contributor+ Stored Cross-Site Scripting",
    "slug": "get-custom-field-values",
    "type": "plugin",
    "affected_version": "[*, 4.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24871",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Oleggo LiveStream \u003c= 0.2.6 - Cross-Site Scripting",
    "slug": "oleggo-livestream",
    "type": "plugin",
    "affected_version": "* - 0.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-4540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4540",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Hueman \u003c= 3.6.3 - Cross-Site Request Forgery Bypass",
    "slug": "hueman",
    "type": "theme",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36753",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Timeline \u003c= 2.2.5 - Reflected Cross-Site Scripting",
    "slug": "post-timeline",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4284",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Debug Log – Manger Tool \u003c= 1.4.5 - Unauthenticated Information Exposure via Logs",
    "slug": "debug-log-config-tool",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34798",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Boat Rental Plugin for WordPress \u003c= 1.0.1 - Unauthenticated Arbitrary File Upload",
    "slug": "boat-rental-system",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52376",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ContentStudio \u003c= 1.3.5 - Missing Authorization",
    "slug": "contentstudio",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47692",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Lightbox \u0026 Modal Popup WordPress Plugin – FooBox (Free and Premium) \u003c= 2.7.27 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "foobox-image-lightbox-premium",
    "type": "plugin",
    "affected_version": "* - 2.7.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3276",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lightbox \u0026 Modal Popup WordPress Plugin – FooBox (Free and Premium) \u003c= 2.7.27 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "foobox-image-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.7.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3276",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import Legacy Media \u003c= 0.1 - Cross-Site Scripting",
    "slug": "import-legacy-media",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4535",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP资源下载管理 \u003c= 1.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "download-info-page",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25787",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Disable User Login \u003c= 1.3.8 - Cross-Site Request Forgery",
    "slug": "disable-user-login",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47806",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slack Notifications by dorzki \u003c= 2.0.7 - Missing Authorization",
    "slug": "dorzki-notifications-to-slack",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30978",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Mailster \u003c= 1.8.15.0 - Reflected Cross-Site Scripting",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "* - 1.8.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.15.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24559",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meks Smart Social Widget \u003c= 1.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "meks-smart-social-widget",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33693",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Surbma | Recent Comments Shortcode \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "surbma-recent-comments-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7649",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blue Memories \u003c= 1.5 - Cross-Site Scripting",
    "slug": "blue-memories",
    "type": "theme",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4165",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \u003c= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.6.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1119",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery \u003c= 3.38 - Authenticated (Admin+) Local File Inclusion",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3279",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation \u0026 Modification",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.5.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1078",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1078",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stylish Price List \u003c= 7.1.11 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "stylish-price-list",
    "type": "plugin",
    "affected_version": "* - 7.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10472",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8500",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TrueBooker \u003c= 1.0.7 - Cross-Site Request Forgery",
    "slug": "truebooker-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47543",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "mTouch Quiz \u003c= 3.1.2 - Stored Cross-Site Scripting",
    "slug": "mtouch-quiz",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9389",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Pre-Orders \u003c= 2.0.2 - Cross-Site Request Forgery",
    "slug": "woocommerce-pre-orders",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3508",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Brutal AI \u003c 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "wpbrutalai",
    "type": "plugin",
    "affected_version": "[*, 2.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2605",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Everest Forms \u003c= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3422",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Trustpilot Reviews \u003c= 2.5.925 - Missing Authorization",
    "slug": "trustpilot-reviews",
    "type": "plugin",
    "affected_version": "* - 2.5.925",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.925",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57997",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Savyour Affiliate Partner \u003c= 2.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "savyour-affiliate-partner",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48306",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InLocation \u003c= 1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "inlocation",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25166",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify – WooCommerce Product Filter \u003c= 1.4.3 - Reflected Cross-Site Scripting",
    "slug": "themify-wc-product-filter",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2263",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Content Views – Post Grid \u0026 Filter, Recent Posts, Category Posts, \u0026 More (Gutenberg Blocks and Shortcode) \u003c= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagingType Parameter",
    "slug": "content-views-query-and-display-post-page",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4446",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder by SiteOrigin \u003c= 2.10.15 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "siteorigin-panels",
    "type": "plugin",
    "affected_version": "* - 2.10.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-13642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13642",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TinyPNG \u003c= 3.4.3 - Cross-Site Request Forgery",
    "slug": "tiny-compress-images",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47635",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dashi \u003c= 3.1.8 - Missing Authorization",
    "slug": "dashi",
    "type": "plugin",
    "affected_version": "* - 3.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39580",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Freesia Empire \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "freesia-empire",
    "type": "theme",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33955",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Header Footer Composer for Elementor \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "header-footer-composer",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51629",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Repost \u003c= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scritping",
    "slug": "wp-repost",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26534",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26534",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Organizer \u003c= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "quiz-organizer",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6810",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Best Restaurant Menu by PriceListo \u003c= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "best-restaurant-menu-by-pricelisto",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58812",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flamix: Bitrix24 and Contact Form 7 integrations \u003c= 3.1.0 - Unauthenticated Full Path Disclosure",
    "slug": "flamix-bitrix24-and-contact-forms-7-integrations",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6568",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "UpdraftPlus \u003c= 1.9.63 and UpdraftPlus (paid) \u003c= 2.9.63 - Cross-Site Scripting",
    "slug": "updraftplus",
    "type": "plugin",
    "affected_version": "[*, 1.9.64)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.64",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9360",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UpdraftPlus \u003c= 1.9.63 and UpdraftPlus (paid) \u003c= 2.9.63 - Cross-Site Scripting",
    "slug": "updraftplus-pro",
    "type": "plugin",
    "affected_version": "[*, 2.9.64)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.64",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9360",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Front End PM \u003c 11.4.3  - Sensitive Information Exposure via Directory Listing",
    "slug": "front-end-pm",
    "type": "plugin",
    "affected_version": "[*, 11.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4930",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Termageddon: Cookie Consent \u0026 Privacy Compliance \u003c= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "termageddon-usercentrics",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58026",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wp tell a friend popup form \u003c= 7.1 - Cross-Site Request Forgery via 'TellAFriend_admin'",
    "slug": "wp-tell-a-friend-popup-form",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25463",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Travel Engine \u003c= 5.7.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 5.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30504",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Shortcodes for Elementor \u003c= 1.0.4 - Authenticated (Contributor+) Post Disclosure",
    "slug": "shortcode-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10690",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Quill Forms \u003c= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quillforms",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47393",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radio Player \u003c= 2.0.73 - Missing Authorization to Player Update",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "* - 2.0.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4025",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Maps – Display Google Maps Perfectly with Ease \u003c= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3503",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant \u0026 Cafe Addon for Elementor \u003c= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "restaurant-cafe-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51581",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Page Generator Plugin – MPG \u003c= 4.0.1 - Missing Authorization",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7424",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "PostLists \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "postlists",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10815",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CatFolders – Tame Your WordPress Media Library by Category \u003c= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import",
    "slug": "catfolders",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9776",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Droit Elementor Addons \u003c= 3.1.5 - Cross-Site Request Forgery",
    "slug": "droit-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22136",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JupiterX Theme \u003c= 2.0.6 and Jupiter Theme \u003c= 6.10.1 - Authenticated Path Traversal and Local File Inclusion",
    "slug": "jupiter",
    "type": "theme",
    "affected_version": "* - 6.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.10.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1657",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "JupiterX Theme \u003c= 2.0.6 and Jupiter Theme \u003c= 6.10.1 - Authenticated Path Traversal and Local File Inclusion",
    "slug": "jupiterx",
    "type": "theme",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1657",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Borderless – Widgets, Elements, Templates and Toolkit for Elementor \u0026 Gutenberg \u003c= 1.5.9 - Missing Authorization to Icon Font Deletion",
    "slug": "borderless",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11583",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "UniConsent Cookie Consent CMP for GDPR / CCPA \u003c= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "uniconsent-cmp",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41800",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AMP+ Plus \u003c= 3.0 - Reflected Cross Site Scripting",
    "slug": "amp-plus",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5210",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hostiko - Hosting WordPress \u0026 WHMCS Theme \u003c 30.1 - Reflected Cross-Site Scripting",
    "slug": "hostiko",
    "type": "theme",
    "affected_version": "[*, 30.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "30.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-27014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27014",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SMu Manual DoFollow \u003c= 1.8.1 - Reflected Cross-Site Scripting",
    "slug": "manuall-dofollow",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49031",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49031",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photoswipe Masonry Gallery \u003c= 1.2.14 Stored Cross-Site Scripting",
    "slug": "photoswipe-masonry",
    "type": "plugin",
    "affected_version": "* - 1.2.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0750",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinpoint Booking System \u003c= 2.9.9.5.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "* - 2.9.9.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53815",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WOLF – WordPress Posts Bulk Editor and Manager Professional \u003c= 1.0.8.5 - Authenticated (Editor+) Path Traversal",
    "slug": "bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-24605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24605",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Caldera Forms \u003c= 1.5.9.1 - Cross Site Scripting",
    "slug": "caldera-forms",
    "type": "plugin",
    "affected_version": "* - 1.5.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-7747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-7747",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Live Chat Support \u003c= 8.0.05 - Stored Cross-Site Scripting",
    "slug": "wp-live-chat-support",
    "type": "plugin",
    "affected_version": "* - 8.0.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-9864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-9864",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Plum: Spin Wheel \u0026 Email Pop-up \u003c= 2.0 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting",
    "slug": "qodeblock",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38744",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon \u003c= 1.1.18 - Stored Cross-Site Scripting",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "[*, 1.1.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-5657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5657",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reviews and Rating – Google Reviews \u003c= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "g-business-reviews-rating",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5218",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.8.8 - Cross-Site Request Forgery",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "* - 4.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30478",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Forex Calculators \u003c= 1.3.7 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "fx-calculators",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13716",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43288",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Currency Switcher for WooCommerce \u003c= 0.0.7 - Cross-Site Request Forgery",
    "slug": "currency-switcher-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 0.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30857",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Gallery Plugin – NextGEN Gallery \u003c= 3.4.7 - Cross-Site Request Forgery",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35942",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form Submissions \u003c= 1.7.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contact-form-submissions",
    "type": "plugin",
    "affected_version": "[*, 1.7.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0248",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 6.4.7.1 - Cross-Site Request Forgery",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2110",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Premium Addons PRO \u003c= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multi Scroll Widget",
    "slug": "premium-addons-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2000",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TheGem \u003c= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "thegem",
    "type": "theme",
    "affected_version": "* - 5.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Link My Posts \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "linkmyposts",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13881",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery \u003c= 1.5.68 - Multiple Reflected Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.69)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.69",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24291",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Twitter Feeds (Tweets Widget) \u003c= 2.2.3 - Cross-Site Request Forgery",
    "slug": "custom-twitter-feeds",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49685",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Arconix FAQ \u003c= 1.9.5 - Reflected Cross-Site Scripting",
    "slug": "arconix-faq",
    "type": "plugin",
    "affected_version": "* - 1.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32531",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Meta \u003c= 1.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "post-meta",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24549",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss \u003c= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13612",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixiv Custom \u003c 2.1.6 - Cross-Site Scripting",
    "slug": "pixiv-custom",
    "type": "theme",
    "affected_version": "[*, 2.1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-3858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3858",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Tracking Pro \u003c= 3.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "order-tracking",
    "type": "plugin",
    "affected_version": "* - 3.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4500",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog Manager WP \u003c= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "blog-manager-wp",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46517",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Simple PayPal Shopping Cart \u003c= 5.1.3 - Insecure Direct Object Reference via 'quantity'",
    "slug": "wordpress-simple-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 5.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3889",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElasticPress \u003c= 5.1.0 - Cross-Site Request Forgery",
    "slug": "elasticpress",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35684",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stock Quotes List \u003c= 2.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "stock-quotes-list",
    "type": "plugin",
    "affected_version": "* - 2.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41666",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Same but Different – Related Posts by Taxonomy \u003c= 1.0.16 - Reflected Cross-Site Scripting",
    "slug": "same-but-different",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11363",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kenta Blocks – Responsive Blocks and block templates library \u003c= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kenta-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35731",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Blog2Social \u003c= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "* - 6.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3622",
    "auth_type": "Auth",
    "cvss_score": 4.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Flozen \u003c 1.5.1 - Unauthenticated Arbitrary File Upload",
    "slug": "flozen-theme",
    "type": "theme",
    "affected_version": "[*, 1.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-49071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49071",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SKT Blocks – Gutenberg based Page Builder \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-blocks",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13733",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Neuvoo Jobroll \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "neuvoo-jobroll",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9404",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Borderless – Widgets, Elements, Templates and Toolkit for Elementor \u0026 Gutenberg \u003c= 1.4.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "borderless",
    "type": "plugin",
    "affected_version": "* - 1.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38518",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookie Scanner \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cookie-scanner",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49220",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Navis DocumentCloud \u003c 0.1.1 - Reflected Cross-Site Scripting",
    "slug": "navis-documentcloud",
    "type": "plugin",
    "affected_version": "[*, 0.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-2807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2807",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Compact WP Audio Player \u003c= 1.9.6 - Contributor+ Stored Cross-Site Scripting",
    "slug": "compact-wp-audio-player",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24734",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mesmerize Companion \u003c= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode",
    "slug": "mesmerize-companion",
    "type": "plugin",
    "affected_version": "* - 1.6.148",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.148",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3494",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Neshan Maps \u003c= 1.1.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "neshan-maps",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47426",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Wawp \u003c 3.0.18 - Unauthenticated Privilege Escalation",
    "slug": "automation-web-platform",
    "type": "plugin",
    "affected_version": "[*, 3.0.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.18",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2024-52475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52475",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VOD Infomaniak \u003c= 1.5.6 - Reflected Cross-Site Scripting",
    "slug": "vod-infomaniak",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33571",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Content Password Protect \u003c= 1.1.0 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "exclusive-content-password-protect",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52402",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Gallery Grid \u003c= 2.3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "responsive-gallery-grid",
    "type": "plugin",
    "affected_version": "* - 2.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1664",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Header \u0026 Footer Builder \u003c= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10325",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Website Collaboration, Feedback \u0026 Project Management – Atarim \u003c= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "atarim-visual-collaboration",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7621",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Big Store \u003c= 2.0.8 - Missing Authorization",
    "slug": "big-store",
    "type": "theme",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30881",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Single Sign On \u003c= 4.1.1 - Insecure OAuth Implementation to Authentication Bypass",
    "slug": "single-sign-on-client",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2083",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-ISPConfig 3 \u003c= 1.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-ispconfig3",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53720",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Comments Ratings \u003c= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "comments-ratings",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23702",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.4 (Pro) \u0026 \u003c= 2.2.7 (Free) - Missing Authorization via config_virtual_event",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0236",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin \u003c= 4.5.4 (Pro) \u0026 \u003c= 2.2.7 (Free) - Missing Authorization via config_virtual_event",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0236",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better Follow Button for Jetpack \u003c= 8.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "better-follow-button-for-jetpack",
    "type": "plugin",
    "affected_version": "* - 8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP JobSearch \u003c= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalation",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11925",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ibtana – WordPress Website Builder \u003c= 1.1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "ibtana-visual-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Org Chart \u003c= 2.3.4 - Cross-Site Request Forgery",
    "slug": "simple-org-chart",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28791",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Testimonials Showcase \u003c= 1.9.16 - Reflected Cross-Site Scripting",
    "slug": "testimonials-showcase",
    "type": "plugin",
    "affected_version": "* - 1.9.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49245",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Data Tables Generator by Supsystic \u003c= 1.10.36 - Missing Authorization",
    "slug": "data-tables-generator-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.10.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56253",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PubyDoc \u003c= 2.0.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pubydoc-data-tables-and-charts",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4970",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Locatoraid Store Locator \u003c= 3.9.23 - Reflected Cross-Site Scripting",
    "slug": "locatoraid",
    "type": "plugin",
    "affected_version": "* - 3.9.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4476",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Caldera Forms Google Sheets Connector \u003c= 1.3 - Cross-Site Request Forgery",
    "slug": "gsheetconnector-caldera-forms",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2330",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Access Manager \u003c= 2.2.16 - IP Spoofing",
    "slug": "user-access-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1601",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Templines Elementor Helper Core \u003c= 2.7 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "templines-helper-core",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1295",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Store Locator WordPress \u003c= 1.4.14 - Authenticated(Administrator+) Directory Traversal to Arbitrary File Deletion",
    "slug": "agile-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50885",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gutenberg Blocks with AI by Kadence WP – Page Builder Features \u003c= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12304",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multipurpose Ticket Booking Manager \u003c= 4.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bus-booking-manager",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44037",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Continuous Image Carousel With Lightbox \u003c= 1.0.15 - Reflected Cross-Site Scripting via search_term, order_by and order_pos",
    "slug": "continuous-image-carousel-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28776",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bookshelf \u003c= 2.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bookshelf",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24478",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Copy Anything to Clipboard \u003c= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "copy-the-code",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52419",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Super Page Cache for Cloudflare \u003c= 4.7.5 - Cross-Site Request Forgery",
    "slug": "wp-cloudflare-page-cache",
    "type": "plugin",
    "affected_version": "* - 4.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27968",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Slider Block Gutenslider \u003c= 5.1.5 - Cross-Site Scripting",
    "slug": "gutenslider",
    "type": "plugin",
    "affected_version": "[*, 5.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24640",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscribe2 \u003c= 10.37 - Cross-Site Request Forgery",
    "slug": "subscribe2",
    "type": "plugin",
    "affected_version": "* - 10.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.37",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4309",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
  },
  {
    "title": "WP Forum Server \u003c 1.7.4 - SQL Injection",
    "slug": "forum-server",
    "type": "plugin",
    "affected_version": "[*, 1.7.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2012-6625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6625",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slider by Supsystic \u003c= 1.8.10 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "slider-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30448",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin \u003c= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "frontend-post-submission-manager-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8427",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Donorbox – Free Recurring Donation Form \u003c= 7.1.6 - Cross-Site Scripting",
    "slug": "donorbox-donation-form",
    "type": "plugin",
    "affected_version": "* - 7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1396",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1396",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Original texts Yandex WebMaster \u003c= 1.18 - Cross-Site Request Forgery",
    "slug": "original-texts-yandex-webmaster",
    "type": "plugin",
    "affected_version": "* - 1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46775",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "DiveBook \u003c= 1.1.4 - Improper Access Control",
    "slug": "divebook",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-14205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-14205",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpDataTables (Premium) \u003c= 3.4.1 - Blind SQL Injection via start Parameter",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "[*, 3.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24199",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 0.9.1.6 - Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "[*, 0.9.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-20714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20714",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Poll Maker \u003c= 3.4 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "epoll-wp-voting",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32514",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Easiest Funnel Builder For WordPress \u0026 WooCommerce by WPFunnels \u003c= 3.5.5 - Reflected Cross-Site Scripting",
    "slug": "wpfunnels",
    "type": "plugin",
    "affected_version": "* - 3.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10792",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Linkz.ai \u003c= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via AJAX",
    "slug": "linkz-ai",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9587",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Essential Blocks – Page Builder Gutenberg Blocks, Patterns \u0026 Templates \u003c= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 5.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4682",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez \u003c= 3.4.0 - Missing Authorization",
    "slug": "houzez",
    "type": "theme",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24754",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultra Addons Lite for Elementor \u003c= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ut-elementor-addons-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32192",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chess Tempo Viewer \u003c= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "chesstempoviewer",
    "type": "plugin",
    "affected_version": "* - 0.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23868",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Popup Builder – Popup Forms and Marketing Lead Generation \u003c= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add",
    "slug": "wp-popup-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9061",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Media Library Assistant \u003c= 3.17 - Reflected Cross-Site Scripting",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5544",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TheGem \u003c 5.8.1.1 - Missing Authorization",
    "slug": "thegem",
    "type": "theme",
    "affected_version": "[*, 5.8.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-32238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32238",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "RDFa Breadcrumb \u003c= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "rdfa-breadcrumb",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50020",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGraphQL \u003c= 0.2.3 - Administrative User Creation",
    "slug": "wp-graphql",
    "type": "plugin",
    "affected_version": "* - 0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-9879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-9879",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Clink \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "clink",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30566",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Content for Elementor \u003c 2.12.5 - Cross-Site Request Forgery",
    "slug": "dynamic-content-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 2.12.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-52150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52150",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jetpack \u003c 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[*, 12.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-47774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47774",
    "auth_type": "Auth",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Social Icons Widget \u0026 Block by WPZOOM \u003c= 4.2.15 - Missing Authorization",
    "slug": "social-icons-widget-by-wpzoom",
    "type": "plugin",
    "affected_version": "* - 4.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30464",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Qi Addons For Elementor \u003c= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "qi-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6252",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post views Stats \u003c= 1.3 - Reflected Cross-Site Scripting via from and to",
    "slug": "post-views-stats",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22289",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woo Total Sales \u003c= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval",
    "slug": "woo-total-sales",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1688",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.35.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.35.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9352",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking System Trafft \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "booking-system-trafft",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11754",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "One Click SSL \u003c= 1.4.6 - Cross-Site Request Forgery",
    "slug": "one-click-ssl",
    "type": "plugin",
    "affected_version": "[*, 1.4.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-15828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15828",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP User Profile Avatar \u003c= 1.0.0 - Authenticated (Author+) Insecure Direct Object Reference to Avatar Deletion/Update",
    "slug": "wp-user-profile-avatar",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6384",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Log HTTP Requests \u003c= 1.3.1 - Stored Cross-Site Scripting",
    "slug": "log-http-requests",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3402",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mitm Bug Tracker \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "mitm-bug-tracker",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49224",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AnalyticsWP \u003c= 2.0.0 - Unauthenticated SQL Injection",
    "slug": "analyticswp",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13321",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Blog Introduction \u003c= 0.3.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "blogintroduction-wordpress-plugin",
    "type": "plugin",
    "affected_version": "* - 0.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7862",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SNS Anton \u003c= 4.1 - Unauthenticated Local File Inclusion",
    "slug": "snsanton",
    "type": "theme",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-28992",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28992",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin \u003c= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6660",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Field For WP Job Manager \u003c= 1.2 -  Insecure Direct Object Reference to Sensitive Information Exposure via Shortcode",
    "slug": "custom-field-for-wp-job-manager",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7049",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "iframe Shortcode \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "iframe-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50825",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailMunch – Grow your Email List \u003c= 3.1.2 - Cross-Site Request Forgery",
    "slug": "mailmunch",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41852",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4805",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4805",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Elementor Addons \u003c= 2.2.7 - Missing Authorization",
    "slug": "easy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54712",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Goodlayers Core \u003c= 2.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG Upload",
    "slug": "goodlayers-core",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12163",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Woo Search \u003c= 3.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via aws_search_terms Shortcode",
    "slug": "advanced-woo-search",
    "type": "plugin",
    "affected_version": "* - 3.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2302",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Testimonial Carousel for Elementor \u003c= 3.0.0 - Missing Authorization",
    "slug": "advanced-testimonial-carousel-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32783",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pressroom - News Magazine WordPress Theme \u003c= 6.9 - Reflected Cross-Site Scripting",
    "slug": "pressroom",
    "type": "theme",
    "affected_version": "* - 6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32311",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BetterDocs  \u003c= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information Disclosure",
    "slug": "betterdocs",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7499",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JVM rich text icons \u003c= 1.2.6 - Directory Traversal to Authenticated(Subscriber+) Arbitrary File Deletion",
    "slug": "jvm-rich-text-icons",
    "type": "plugin",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51418",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Drop Shadow Boxes \u003c= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "drop-shadow-boxes",
    "type": "plugin",
    "affected_version": "* - 1.7.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5469",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woo Update Variations In Cart \u003c= 0.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "woo-update-variations-in-cart",
    "type": "plugin",
    "affected_version": "* - 0.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23829",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP LinkedIn Auto Publish \u003c= 8.11 - Missing Authorization",
    "slug": "wp-linkedin-auto-publish",
    "type": "plugin",
    "affected_version": "* - 8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32797",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Content Manager Light \u003c= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "content-manager-light",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31770",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6703",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeproDev Ultimate Invoice \u003c= 2.0.0 - Missing Authorization",
    "slug": "pepro-ultimate-invoice",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32518",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, \u0026 Animations \u003c= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8874",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Captchinoo Captcha \u003c= 2.3 - Missing Authorization to Arbitrary Plugin Installation/Activation",
    "slug": "captchinoo-captcha-for-login-form-protection",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24189",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Member \u003c= 2.10.3 - Authenticated (Administrator+) Arbitrary Function Call",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47691",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PropertyHive \u003c= 2.0.9 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "propertyhive",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-27985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27985",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Follow-Up Emails \u003c= 4.9.40 - Cross-Site Request Forgery",
    "slug": "woocommerce-follow-up-emails",
    "type": "plugin",
    "affected_version": "* - 4.9.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33316",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom User Profile Fields \u003c= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "pmpro-register-helper",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4831",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GS Filterable Portfolio \u003c= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gs-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Ad Manager \u003c= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-ad-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25460",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25460",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Comment Notifications \u003c= 1.0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "custom-comment-notifications",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25154",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Foodbakery \u003c= 4.7 - Unauthenticated Arbitrary File Upload",
    "slug": "wp-foodbakery",
    "type": "plugin",
    "affected_version": "* - 4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13011",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Axeptio \u003c= 2.5.4 - Unauthenticated Local File Inclusion",
    "slug": "axeptio-sdk-integration",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54270",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Doccure \u003c= 1.4.9 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "doccure",
    "type": "theme",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9112",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Daily Prayer Time \u003c= 2021.08.09 - Stored Cross-Site Scripting",
    "slug": "daily-prayer-time-for-mosques",
    "type": "plugin",
    "affected_version": "[*, 2021.08.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2021.08.10",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24523",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magento 2 WordPress Integration \u003c= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "m2wp",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58669",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "imPress \u003c= 0.1.4 - Reflected Cross-Site Scripting",
    "slug": "wp-js-impress",
    "type": "plugin",
    "affected_version": "* - 0.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51704",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UsersWP \u003c= 1.2.3 - Subscriber+ User Avatar Override",
    "slug": "userswp",
    "type": "plugin",
    "affected_version": "[*, 1.2.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0442",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form by WPForms \u003c= 1.5.8.2 - Stored Cross-Site Scripting",
    "slug": "wpforms-lite",
    "type": "plugin",
    "affected_version": "[*, 1.5.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-10385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-10385",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Header Footer Code Manager Pro \u003c= 1.0.16 - Reflected Cross-Site Scripting via message",
    "slug": "99robots-header-footer-code-manager-pro",
    "type": "plugin",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3473",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Innovs HR \u003c= 1.0.3.4 - Reflected Cross-Site Scripting",
    "slug": "innovs-hr-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49171",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventer \u003c= 3.9.8 - Reflected Cross-Site Scripting",
    "slug": "eventer",
    "type": "plugin",
    "affected_version": "* - 3.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22635",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms \u003c= 2024.7 - Cross-Site Request Forgery to Multiple Administrative Actions",
    "slug": "stop-spammer-registrations-plugin",
    "type": "plugin",
    "affected_version": "* - 2024.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2935",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Zeenshare \u003c= 1.0.1 - Cross-Site Scripting",
    "slug": "zeenshare",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4606",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.2.5.7 - Command Injection",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6634",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "YITH WooCommerce Product Add-Ons \u003c= 4.9.2 - Unauthenticated Content Injection",
    "slug": "yith-woocommerce-product-add-ons",
    "type": "plugin",
    "affected_version": "* - 4.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35680",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP VR \u003c= 8.2.9 - Missing Authorization",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1414",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Anchor Episodes Index (Spotify for Podcasters) \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "anchor-episodes-index",
    "type": "plugin",
    "affected_version": "[*, 2.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44145",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User – Custom Registration Forms, Login and User Profile \u003c 7.0 - Reflected Cross-Site Scripting",
    "slug": "wp-user",
    "type": "plugin",
    "affected_version": "[*, 7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IgniteUp – Coming Soon and Maintenance Mode \u003c= 3.4 - Unauthenticated Arbitrary File Deletion",
    "slug": "igniteup",
    "type": "plugin",
    "affected_version": "[*, 3.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-17234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17234",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "video carousel slider with lightbox \u003c= 1.0.6 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-responsive-video-gallery-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-25212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25212",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Pricer Ninja \u003c= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pricer-ninja-pricing-tables",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50518",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Highlight and Share – Social Text and Image Sharing \u003c= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "highlight-and-share",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58260",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "0mk Shortener \u003c= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "0mk-shortener",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45361",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hive Support – WordPress Help Desk \u003c= 1.1.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "hive-support",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52370",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "External Markdown \u003c= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "external-markdown",
    "type": "plugin",
    "affected_version": "* - 0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile Events Manager \u003c 1.4.4 - Cross-Site Scripting",
    "slug": "mobile-events-manager",
    "type": "plugin",
    "affected_version": "[*, 1.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25049",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c= 10.9 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 10.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47316",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Slider Widget \u003c= 1.8.4 - Reflected Cross-Site Scripting",
    "slug": "instagram-slider-widget",
    "type": "plugin",
    "affected_version": "[*, 1.8.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24196",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Buy Me a Coffee – Button and Widget Plugin \u003c= 3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "buymeacoffee",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2578",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2385",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Invitation Code Content Restriction Plugin from CreativeMinds \u003c= 1.5.4 - Reflected Cross-Site Scripting",
    "slug": "invitation-code-content-access",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4965",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PostaPanduri \u003c= 2.1.3 - Unauthenticated SQL Injection",
    "slug": "postapanduri",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49452",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Use Any Font \u003c= 6.1.7 - Cross-Site Request Forgery to API Key Deactivation",
    "slug": "use-any-font",
    "type": "plugin",
    "affected_version": "* - 6.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27851",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Falang multilanguage \u003c= 1.3.39 - Cross-Site Request Forgery via add_language",
    "slug": "falang",
    "type": "plugin",
    "affected_version": "* - 1.3.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37968",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Login Me Now \u003c= 1.7.2 - Authentication Bypass",
    "slug": "login-me-now",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1717",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Awesome Support \u003c= 6.1.10 - Missing Authorization",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49757",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 5.12 - Authenticated Information Disclosure",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "[*, 5.12.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-23183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23183",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 5.12 - Authenticated Information Disclosure",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "[*, 5.12.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.12.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-23183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23183",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Child Theme Creator by Orbisius \u003c= 1.5.1 - Cross-Site Request Forgery to Arbitrary File Modification and Creation",
    "slug": "orbisius-child-theme-creator",
    "type": "plugin",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-28649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28649",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "elink – Embed Content \u003c= 1.1.0 - Authenticated (Contributor+) Insufficient Input Validation",
    "slug": "elink-embed-content",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7507",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"
  },
  {
    "title": "Media File Organizer \u003c= 1.0.1 - Directory Traversal",
    "slug": "media-file-organizer",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-24144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-24144",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder \u003c= 4.8 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "real3d-flipbook-lite",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9849",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "StoryMap \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-storymap",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58874",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Private Messages for UserPro \u003c= 4.10.0 - Reflected Cross-Site Scripting",
    "slug": "userpro-messaging",
    "type": "plugin",
    "affected_version": "* - 4.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22322",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SupportEzzy Ticket System Plugin \u003c= 1.2.5 - Cross-Site Scripting",
    "slug": "supportezzy",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9179",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Magic the Gathering Card Tooltips \u003c= 3.5.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "magic-the-gathering-card-tooltips",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26756",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VibeBP \u003c 1.9.9.7.7 - Unauthenticated SQL Injection",
    "slug": "vibebp",
    "type": "plugin",
    "affected_version": "[*, 1.9.9.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.7.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-56039",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56039",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GDPR Cookie Compliance \u003c= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "gdpr-cookie-compliance",
    "type": "plugin",
    "affected_version": "* - 4.15.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1619",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 5.10 - Missing Authorization on Option Changes",
    "slug": "advanced-custom-fields",
    "type": "plugin",
    "affected_version": "[*, 5.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-20867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20867",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields \u003c= 5.10 - Missing Authorization on Option Changes",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "[*, 5.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-20867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20867",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form \u0026 Custom Contact Form builder 2.0 - 2.13.4 - Authenticater (Administrator+) Arbitrary File Deletion",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "2.0 - 2.13.4",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.13.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7782",
    "auth_type": "Privileged",
    "cvss_score": 8.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H"
  },
  {
    "title": "Sensei LMS \u003c= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sensei-lms",
    "type": "plugin",
    "affected_version": "* - 4.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50875",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NAB Transact \u003c 2.1.2 - Payment System Bypass",
    "slug": "woocommerce-gateway-nab-dp",
    "type": "plugin",
    "affected_version": "[*, 2.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-11497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11497",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "BA Plus \u003c= 1.0.3 - Reflected Cross-Site Scripting",
    "slug": "ba-plus-before-after-image-slider-free",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22286",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ezoic \u003c= 2.8.8 - Missing Authorization to Stored Cross-Site Scripting",
    "slug": "ezoic-integration",
    "type": "plugin",
    "affected_version": "* - 2.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-41132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41132",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "myCred \u003c= 2.9.4.2 - Missing Authorization",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "* - 2.9.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49872",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.8.27 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44043",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Improve My City \u003c= 1.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "improve-my-city",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22501",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LabTools \u003c= 1.0 - Missing Authorization",
    "slug": "labtools",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25097",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Add Chat App Button \u003c= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "add-whatsapp-button",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52489",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Internal Link Optimiser \u003c= 5.1.2 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "internal-link-finder",
    "type": "plugin",
    "affected_version": "* - 5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32243",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Admin Notes \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "admin-note",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49446",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "weForms \u003c= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via Referer",
    "slug": "weforms",
    "type": "plugin",
    "affected_version": "* - 1.6.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.21",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0386",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CalendApp \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "calendapp",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13669",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Varnish WordPress \u003c= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "varnish-wp",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31616",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accessibility Suite by Online ADA \u003c= 4.18 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "online-accessibility",
    "type": "plugin",
    "affected_version": "* - 4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.18",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32215",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ListingPro \u003c= 2.9.8 - Missing Authorization",
    "slug": "listingpro-plugin",
    "type": "plugin",
    "affected_version": "* - 2.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60103",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NitroPack \u003c= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update",
    "slug": "nitropack",
    "type": "plugin",
    "affected_version": "* - 1.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11851",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Launchpad – Coming Soon \u0026 Maintenance Mode Plugin \u003c= 1.0.13 - Authenticated (Administrator+) Cross-Site Scripting",
    "slug": "launchpad-by-obox",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0295",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Duplicator \u003c= 2.36 - Authenticated (Contributor+) Protected Post Disclosure",
    "slug": "post-duplicator",
    "type": "plugin",
    "affected_version": "* - 2.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12472",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12472",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jobmonster \u003c 4.7.5 - Unauthenticated Arbitrary File Deletion",
    "slug": "noo-jobmonster",
    "type": "theme",
    "affected_version": "[*, 4.7.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2024-37928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37928",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Maps – Google Maps \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "robo-maps",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2279",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Child Theme Creator by Orbisius \u003c= 1.2.7 - Arbitrary File Write",
    "slug": "orbisius-child-theme-creator",
    "type": "plugin",
    "affected_version": "[*, 1.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9456",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Elementor Website Builder – More Than Just a Page Builder \u003c= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.27.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.27.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Theme Addon For Elementor and WooCommerce \u003c= 1.2.2 - Authenticated (Contributor+) Post Disclosure",
    "slug": "unlimited-theme-addons",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12116",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Razorpay Subscription Button Elementor Plugin \u003c= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg Functions",
    "slug": "razorpay-subscription-button-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13827",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Html5 Audio Player \u003c= 2.1.2 - Contributor+ Stored Cross-Site Scripting",
    "slug": "html5-audio-player",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24412",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload (Pro) - WooCommerce \u003c= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload",
    "slug": "drag-and-drop-file-uploads-wc-pro",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5746",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Drag and Drop Multiple File Upload (Pro) - WooCommerce \u003c= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload",
    "slug": "drag-and-drop-file-uploads-wc-pro",
    "type": "plugin",
    "affected_version": "5.0 - 5.0.5",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-5746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5746",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rank Math SEO with AI SEO Tools \u003c= 1.0.214 - Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributes",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.214",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.214",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2536",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery \u003c= 1.5.74 - Stored Cross-Site Scripting via Uploaded SVG",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.5.75)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.75",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24362",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Digits \u003c= 8.4.1 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "digits",
    "type": "plugin",
    "affected_version": "8.4.1",
    "from_version": "8.4.1",
    "from_inclusive": true,
    "to_version": "8.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0203",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Redirect Redirection \u003c= 1.1.3 - Cross-Site Request Forgery via 'addRedirect' function",
    "slug": "redirect-redirection",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1330",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Property \u003c= 1.35.0 - Remote File Upload",
    "slug": "wp-property",
    "type": "plugin",
    "affected_version": "* - 1.35.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.35.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-10027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10027",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Soledad \u003c= 8.6.8 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-59588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59588",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "adBuddy+ (AdBlocker Detection) by NetfunkDesign \u003c= 1.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "adbuddy-adblocker-detection",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10510",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Slider \u003c= 3.7.3 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "gs-logo-slider",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2262",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "PilotPress \u003c= 2.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pilotpress",
    "type": "plugin",
    "affected_version": "* - 2.0.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58238",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Teaser \u003c= 4.1.5 - Missing Authorization",
    "slug": "post-teaser",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45811",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Booking Calendar \u003c= 10.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 10.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10893",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Catch Themes Demo Import \u003c= 1.7 - Arbitrary File Upload",
    "slug": "catch-themes-demo-import",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39352",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ivory Search – WordPress Search Plugin \u003c= 5.5.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "add-search-to-menu",
    "type": "plugin",
    "affected_version": "* - 5.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5209",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Asambleas \u003c= 2.85.0 - Reflected Cross-Site Scripting",
    "slug": "wp-asambleas",
    "type": "plugin",
    "affected_version": "* - 2.85.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.85.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22796",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Path for Elementor \u003c= 3.0.0 - Missing Authorization",
    "slug": "slider-path",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31529",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JetGridBuilder \u003c= 1.1.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "jetgridbuilder",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43221",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tutor LMS \u003c= 1.9.11 - Reflected Cross-Site Scripting",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 1.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25017",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Testimonial Slider and Form \u003c= 1.0.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "easy-testimonial-rotator",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45754",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Appbox \u003c= 4.5.3 - Reflected Cross-Site Scripting",
    "slug": "wp-appbox",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12710",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EzyOnlineBookings Online Booking System Widget \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ezyonlinebookings-online-booking-system",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51628",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zoho Billing \u003c= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zoho-subscriptions",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57963",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tockify Events Calendar \u003c= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tockify-events-calendar",
    "type": "plugin",
    "affected_version": "* - 2.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32174",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 3.0.12 - Authenticated SQL Injection",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 3.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-16175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-16175",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Customize Login Page \u003c= 1.6.5 - Missing Authorization",
    "slug": "wp-customize-login-page",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46485",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Side Menu Lite \u003c= 2.2 - SQL Injection",
    "slug": "side-menu-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24521",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventPrime \u003c= 4.0.3.2 - Missing Authorization via calendar_event_create()",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 4.0.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43223",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Button Generator – easily Button Builder \u003c= 2.3.8 - Missing Authorization",
    "slug": "button-generation",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49154",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Community by PeepSo \u003c= 6.2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47850",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for KingComposer \u003c= 1.1.1 - Unauthenticated Local File Inclusion",
    "slug": "premium-addons-for-kingcomposer",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49036",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49036",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Don't Break The Code \u003c= .3.1 - Reflected Cross-Site Scripting",
    "slug": "dont-break-the-code",
    "type": "plugin",
    "affected_version": "* - .3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": ".3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51779",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Booking Bundle Hours \u003c= 0.7.4 - Cross-Site Request Forgery",
    "slug": "woo-booking-bundle-hours",
    "type": "plugin",
    "affected_version": "* - 0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58991",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Clockinator Lite \u003c= 1.0.7 - Missing Authorization",
    "slug": "clockify-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31777",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ocean Extra \u003c= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3167",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3167",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Horsemanager \u003c= 1.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "fruitcake-horsemanager",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51843",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Export All URLs \u003c= 4.3 - Arbitrary File Deletion",
    "slug": "export-all-urls",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2638",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Custom Product Tabs for WooCommerce \u003c= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "yikes-inc-easy-custom-woocommerce-product-tabs",
    "type": "plugin",
    "affected_version": "* - 1.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-43463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-43463",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Library Management System \u003c= 3.0.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "library-management-system",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12406",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12406",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Event List \u003c= 0.7.9 - Unauthenticated Cross-Site Scripting",
    "slug": "event-list",
    "type": "plugin",
    "affected_version": "* - 0.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-12068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-12068",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LaTeX \u003c= 3.4.10 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting",
    "slug": "latex",
    "type": "plugin",
    "affected_version": "* - 3.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1780",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 Redirect \u0026 Thank You Page \u003c= 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "cf7-redirect-thank-you-page",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10685",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cimatti Contact Forms \u003c= 1.4.11 - Cross-Site Scripting",
    "slug": "contact-forms",
    "type": "plugin",
    "affected_version": "[*, 1.4.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24744",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Manager - WooCommerce Advanced Bulk Edit, Inventory Management \u0026 more... \u003c= 8.27.0 - Authenticated (Admin+) SQL Injection",
    "slug": "smart-manager-for-wp-e-commerce",
    "type": "plugin",
    "affected_version": "* - 8.27.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.27.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0566",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Side Cart Woocommerce (Ajax) \u003c= 2.2 Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "side-cart-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28415",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WORDPRESS VIDEO GALLERY \u003c 2.6 - SQL Injection",
    "slug": "contus-video-gallery",
    "type": "plugin",
    "affected_version": "[*, 2.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-9097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9097",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yoast SEO: Local \u003c= 14.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpseo-local",
    "type": "plugin",
    "affected_version": "* - 14.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "14.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28785",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vimeotheque \u003c= 2.2.1 - Reflected Cross-Site Scripting via 'view' and 'page'",
    "slug": "codeflavors-vimeo-video-post-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30498",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rank Math SEO with AI Best SEO Tools \u003c= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "seo-by-rank-math",
    "type": "plugin",
    "affected_version": "* - 1.0.217",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.217",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4335",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Tools \u003c= 5.18 - Cross-Site Request Forgery to Arbitrary File Renaming",
    "slug": "wptools",
    "type": "plugin",
    "affected_version": "* - 5.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39544",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Easy Gallery \u003c= 1.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "simple-gallery-odihost",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51570",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Map Block \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-map-block",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5194",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eMember \u003c= 10.3.8 - Reflected Cross-Site Scripting via 'fieldId'",
    "slug": "wp-eMember",
    "type": "plugin",
    "affected_version": "* - 10.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4749",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TemplatesNext ToolKit \u003c= 3.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "templatesnext-toolkit",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0333",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DJ EmailPublish \u003c= 1.7.2 Reflected Cross-Site Scripting",
    "slug": "dj-email-publish",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38329",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple SEO \u003c= 1.8.12 - Cross-Site Request Forgery to Sitemap Deletion/Creation",
    "slug": "cds-simple-seo",
    "type": "plugin",
    "affected_version": "* - 1.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36404",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36404",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yummly Rich Recipes \u003c= 4.2 - Cross-Site Request Forgery",
    "slug": "yummly-rich-recipes",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30549",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales \u0026 More \u003c= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "storeengine",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9215",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ImagePress - Image Gallery \u003c= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings",
    "slug": "image-gallery",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9776",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Gallery \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "bee-quick-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8400",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form, Survey \u0026 Form Builder – MightyForms \u003c= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mightyforms",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11897",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 6.1.9 - Authenticated (Contributor+) Information Disclosure",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39589",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ShiftThis Newsletter \u003c= 2.3.1 - SQL Injection",
    "slug": "st_newsletter",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-4625",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-4625",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.3.1 - Email Spoofing",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23738",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PayU India \u003c= 3.8.8 - Reflected Cross-Site Scripting via type",
    "slug": "payu-india",
    "type": "plugin",
    "affected_version": "* - 3.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27193",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 2.11.7 - Cross-Site Request Forgery to Arbitrary Post Deletion",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 2.11.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2387",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks \u003c= 3.2.25 - Authenticated (Author+) Server-Side Request Forgery",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24888",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vitepos \u003c= 3.1.7 - Missing Authorization",
    "slug": "vitepos-lite",
    "type": "plugin",
    "affected_version": "* - 3.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39535",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c 3.2 - Missing Authorization",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "[*, 3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-1000511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-1000511",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WPIDE \u003c= 3.4.9 - Unauthenticated Full Path Dislcosure",
    "slug": "wpide",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9546",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Media Cleaner \u003c= 2.2.6 - Cross-Site Scripting",
    "slug": "wp-media-cleaner",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-2195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2195",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cart66 Lite :: WordPress Ecommerce \u003c 1.5.1.15 - Cross-Site Scripting",
    "slug": "cart66-lite",
    "type": "plugin",
    "affected_version": "[*, 1.5.1.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-5978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5978",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Live Preview for Contact Form 7 \u003c= 1.2.0 - Missing Authorization via update_option",
    "slug": "cf7-live-preview",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47830",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1766",
    "auth_type": "Auth",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – For Customers of FedEx Freight  \u003c= 3.4.1 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-fedex-freight-edition",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13480",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Robo Gallery \u003c= 3.2.18 - Unauthenticated Information Exposure",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34382",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP-PostRatings \u003c= 1.91.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-postratings",
    "type": "plugin",
    "affected_version": "* - 1.91.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.91.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39659",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Football Pool \u003c 2.6.5 - Cross-Site Scripting",
    "slug": "football-pool",
    "type": "plugin",
    "affected_version": "[*, 2.6.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18524",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Draw Attention \u003c= 2.0.15 - Improper Access Control via register_cpt",
    "slug": "draw-attention",
    "type": "plugin",
    "affected_version": "* - 2.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46616",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "USM Premium \u003c= 16.2 - Authenticated(Administrator+) Stored Cross-Site Scripting",
    "slug": "Ultimate-Premium-Plugin",
    "type": "plugin",
    "affected_version": "* - 16.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1166",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smooth Maps \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "colour-smooth-maps",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51901",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup \u003c= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form",
    "slug": "wpb-popup-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11038",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Skyword API Plugin \u003c= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skyword-plugin",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58703",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Abstracts \u003c= 2.6.2  - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-abstracts-manuscripts-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28692",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Houzez Login Register \u003c= 3.2.5 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover",
    "slug": "houzez-login-register",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-21743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-21743",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tickera \u003c= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion",
    "slug": "tickera-event-ticketing-system",
    "type": "plugin",
    "affected_version": "* - 3.5.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5860",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventON \u003c= 2.2.2 - Reflected Cross-Site Scripting",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4635",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Weather Widget \u003c= 3.0.2 - Reflected Cross-site Scripting via id Parameter",
    "slug": "awesome-weather",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24474",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GDPR CCPA Compliance Support \u003c= 2.7.3 - Missing Authorization",
    "slug": "ninja-gdpr-compliance",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48260",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Reviews \u003c= 3.2.8 - Unauthenticated stored Cross-Site Scripting via reviews",
    "slug": "ultimate-reviews",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25597",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal – A Complete Recruitment System for Company or Job Board website \u003c= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12131",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "My Reservation System \u003c= 2.3 - Reflected Cross-Site Scripting",
    "slug": "my-reservation-system",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7022",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile Call Now \u0026 Map Buttons \u003c= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mobile-call-now-map-buttons",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24401",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BM Content Builder \u003c= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "bm-builder",
    "type": "plugin",
    "affected_version": "* - 3.16.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1279",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Subscribe to Download \u003c= 2.0.9 - Missing Authorization",
    "slug": "subscribe-to-download",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60148",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GTPayment Donations \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "gtpayment-donation",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11607",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Admin by DynamiApps \u003c= 3.24.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "acf-frontend-form-element",
    "type": "plugin",
    "affected_version": "* - 3.24.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.24.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11720",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rover IDX \u003c= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions",
    "slug": "rover-idx",
    "type": "plugin",
    "affected_version": "* - 3.0.0.2903",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0.2903",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10003",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Thank You Page Customizer for WooCommerce – Increase Your Sales \u003c= 1.0.13 - Cross-Site Request Forgery via send_email",
    "slug": "woo-thank-you-page-customizer",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46812",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PiwigoPress \u003c= 2.33 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "piwigopress",
    "type": "plugin",
    "affected_version": "* - 2.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26896",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Symposium \u003c 11.12.24 - Arbitrary File Upload",
    "slug": "wp-symposium",
    "type": "plugin",
    "affected_version": "[*, 11.12.24)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.12.24",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2011-5051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5051",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Oliver POS – A WooCommerce Point of Sale (POS) \u003c= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation",
    "slug": "oliver-pos",
    "type": "plugin",
    "affected_version": "* - 2.4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13513",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Giveaways and Contests by RafflePress \u003c= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "rafflepress",
    "type": "plugin",
    "affected_version": "* - 1.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5049",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM Perks \u003c= 1.1.7 - Reflected Cross-Site Scripting",
    "slug": "support-x",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39558",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c= 4.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7878",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Tape \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "social-tape",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24411",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Posten \u003c= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "posten-post-blocks",
    "type": "plugin",
    "affected_version": "* - 0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31790",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amministrazione Trasparente \u003c= 8.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "amministrazione-trasparente",
    "type": "plugin",
    "affected_version": "* - 8.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45758",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Instant Images \u003c= 5.1.0.1 - Authenticated (Author+) Server-Side Request Forgery via instant_images_download",
    "slug": "instant-images",
    "type": "plugin",
    "affected_version": "* - 5.1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27451",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Wow Skype Buttons \u003c= 4.0.3 - Cross-Site Request Forgery",
    "slug": "mwp-skype",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3474",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms - File Uploads Extension \u003c= 3.3.0 - Arbitrary File Upload",
    "slug": "ninja-forms-uploads",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0888",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0888",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.8 - Reflected Cross-Site Scripting",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32511",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popularis Extra \u003c= 1.2.7 - Authenticated (Contributor+) Post Disclosure",
    "slug": "popularis-extra",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10795",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AS English Admin \u003c= 1.0.0 - Open Redirection",
    "slug": "as-english-admin",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28896",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Slides \u0026 Presentations \u003c= 0.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slide",
    "type": "plugin",
    "affected_version": "* - 0.0.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22511",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22511",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2790",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brave Conversion Engine (PRO) \u003c= 0.7.7 - Authentication Bypass to Administrator",
    "slug": "bravepopup-pro",
    "type": "plugin",
    "affected_version": "* - 0.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7710",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Forms by Cimatti \u003c= 1.5.4 - Reflected Cross-Site Scripting via 'form-field-id', 'edit-fid', 'id', 'name', 'type', 'description' Parameters",
    "slug": "contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28789",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS Feed Widget \u003c= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode",
    "slug": "rss-feed-widget",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10057",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Football Pool \u003c= 2.12.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "football-pool",
    "type": "plugin",
    "affected_version": "* - 2.12.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5490",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login with phone number \u003c= 1.7.18 - Missing Authorization",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "* - 1.7.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34371",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Master Addons for Elementor \u003c= 2.0.9.5 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52387",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Portable phpMyAdmin \u003c= 1.3.0 - Authentication Bypass",
    "slug": "portable-phpmyadmin",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-5469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-5469",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "PixelYourSite – Your smart PIXEL (TAG) \u0026 API Manager \u003c= 10.1.1.1 - Unauthenticated PHP Object Injection",
    "slug": "pixelyoursite",
    "type": "plugin",
    "affected_version": "10.1.1.1",
    "from_version": "10.1.1.1",
    "from_inclusive": true,
    "to_version": "10.1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0769",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BMLT Tabbed Map \u003c= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bmlt-tabbed-map",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11866",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VR Calendar \u003c= 2.4.7 - Cross-Site Request Forgery to Calendar Sync",
    "slug": "vr-calendar-sync",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5936",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Droip \u003c= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Change",
    "slug": "droip",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43954",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Checkout Mestres WP \u003c= 7.1.9.6 - Missing Authorization to Unauthenticated Arbitrary Options Update",
    "slug": "checkout-mestres-wp",
    "type": "plugin",
    "affected_version": "* - 7.1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.9.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-51471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51471",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hero Maps Pro \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "hero-maps-pro",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000137",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Weaver Xtreme \u003c= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "weaver-xtreme",
    "type": "theme",
    "affected_version": "* - 6.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6990",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Datepicker \u003c= 2.1.1 - Missing Authorization",
    "slug": "wp-datepicker",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47321",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wishlist \u003c= 1.0.39 - Reflected Cross-Site Scripting",
    "slug": "wishlist",
    "type": "plugin",
    "affected_version": "* - 1.0.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24655",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category and Taxonomy Meta Fields \u003c= 1.0.0 - Cross-Site Request Forgery to Taxonomy Meta Add/Delete",
    "slug": "wp-custom-taxonomy-meta",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9588",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Coming Soon Page – Responsive Coming Soon \u0026 Maintenance Mode \u003c= 1.1.18 - Cross-Site Scripting via social_icon_1 parameter",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5664",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5763",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Behance Portfolio \u003c= 0.2 - Reflected Cross-Site Scripting",
    "slug": "simple-behace-portfolio",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34649",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Country Blocker \u003c= 3.2 - Reflected Cross-Site Scripting",
    "slug": "country-blocker",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11459",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Booking System – Booking Calendar \u003c= 2.0.14 - Reflected Cross-Site Scripting",
    "slug": "wp-booking-system",
    "type": "plugin",
    "affected_version": "[*, 2.0.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25061",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Vospari Forms \u003c 1.4 - Reflected Cross-Site Scripting",
    "slug": "vospari-forms",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-1000033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-1000033",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Staggs Product Configurator for WooCommerce \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "staggs",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54342",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fitness Park \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fitness-park",
    "type": "theme",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50033",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultra Addons Lite for Elementor \u003c= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure",
    "slug": "ut-elementor-addons-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13832",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13832",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Content Audit \u003c= 1.9.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "content-audit",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18560",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Activity Log \u003c 2.3.3 - Cross-Site Scripting",
    "slug": "aryo-activity-log",
    "type": "plugin",
    "affected_version": "[*, 2.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10891",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Staff Directory Plugin \u003c= 3.6 - Cross-Site Request Forgery Bypass",
    "slug": "staff-directory-pro",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4397",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dynamic Featured Image \u003c= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured Parameter",
    "slug": "dynamic-featured-image",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6929",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6929",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clariti \u003c= 1.2.1 - Missing Authorization",
    "slug": "clariti",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57991",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Zoho Flow for WordPress \u003c= 2.8.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "zoho-flow",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47334",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Login with Vipps and MobilePay \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "login-with-vipps",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11786",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Payment Gateway Per Category \u003c= 2.0.10 - Reflected Cross-Site Scripting",
    "slug": "wc-payment-gateway-per-category",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38341",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Filestack Official \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "filestack-upload",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11462",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.30",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.26",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.22",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.10",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.4 - 6.4.6",
    "from_version": "6.4",
    "from_inclusive": true,
    "to_version": "6.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.7 - 6.7.3",
    "from_version": "6.7",
    "from_inclusive": true,
    "to_version": "6.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.8 - 6.8.2",
    "from_version": "6.8",
    "from_inclusive": true,
    "to_version": "6.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.13",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.11",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.2 - 6.2.7",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.5 - 6.5.6",
    "from_version": "6.5",
    "from_inclusive": true,
    "to_version": "6.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.19",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.17",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.15",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.27",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.23",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.20",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.16",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.11",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.1 - 6.1.8",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.3 - 6.3.6",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress \u003c= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.6 - 6.6.3",
    "from_version": "6.6",
    "from_inclusive": true,
    "to_version": "6.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58246",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58246",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Audio Merchant \u003c= 5.0.4 - Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site Scripting",
    "slug": "audio-merchant",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6197",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "News Kit Elementor Addons \u003c= 1.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template",
    "slug": "news-kit-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9541",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "GSpeech TTS – WordPress Text To Speech Plugin \u003c= 3.17.13 - Authenticated (Admin+) SQL injection",
    "slug": "gspeech",
    "type": "plugin",
    "affected_version": "* - 3.17.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.17.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10187",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Lightbox slider – Responsive Lightbox Gallery \u003c= 1.10.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "simple-lightbox-gallery",
    "type": "plugin",
    "affected_version": "* - 1.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49280",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Read More Copy Link \u003c= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "read-more-copy-link",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25148",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25148",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9993",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smooth Gallery Replacement \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "smooth-gallery-replacement",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8032",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.24.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6583",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Relevanssi – A Better Search \u003c= 4.22.1 - Unauthenticated Second Order CSV Injection",
    "slug": "relevanssi-premium",
    "type": "plugin",
    "affected_version": "* - 2.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3214",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Relevanssi – A Better Search \u003c= 4.22.1 - Unauthenticated Second Order CSV Injection",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "* - 4.22.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.22.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3214",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "LightStart – Maintenance Mode, Coming Soon and Landing Page Builder \u003c= 2.6.8 - Missing Authorization",
    "slug": "wp-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7019",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Categorify \u003c= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "* - 1.0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1649",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Backup and Staging by WP Time Capsule \u003c= 1.22.21 - Unauthenticated Arbitrary File Upload",
    "slug": "wp-time-capsule",
    "type": "plugin",
    "affected_version": "* - 1.22.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.21",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8856",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Accessibility Helper \u003c= 0.6.2.8 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update",
    "slug": "wp-accessibility-helper",
    "type": "plugin",
    "affected_version": "* - 0.6.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5987",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Steveas WP Live Chat Shoutbox \u003c= 1.4.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-shoutbox-live-chat",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0899",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StreamWeasels Kick Integration \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text Parameter",
    "slug": "streamweasels-kick-integration",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5589",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thumbnail Editor \u003c= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "thumbnail-editor",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53282",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53282",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share And Social Locker – ARSocial \u003c= 1.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "social-share-and-social-locker-arsocial",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11189",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.35.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.35.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9351",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9351",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jobmonster \u003c= 4.7.5 - Unauthenticated Privilege Escalation",
    "slug": "noo-jobmonster",
    "type": "theme",
    "affected_version": "* - 4.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37927",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MF Gig Calendar \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "mf-gig-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33651",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Foundation Columns \u003c= 0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "foundation-columns",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 6.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 6.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51915",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reformer for Elementor \u003c= 1.0.5 - Unauthenticated Arbitrary File Upload",
    "slug": "reformer-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49444",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Table Editor \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-table-editor",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13661",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fiddle \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-fiddle",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54393",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search order by product SKU for WooCommerce \u003c= 0.2 - Reflected Cross-Site Scripting",
    "slug": "search-order-by-product-sku-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51693",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schema App Structured Data \u003c= 2.2.0 - Cross-Site Request Forgery",
    "slug": "schema-app-structured-data-for-schemaorg",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0892",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FunKItools \u003c= 1.0.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "funkitools",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10301",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP All Import \u003c= 3.4.5 - Cross-Site Scripting",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "[*, 3.4.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-0546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0546",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stop Referrer Spam \u003c= 1.3.0 - Cross-Site Request Forgery via processParameters",
    "slug": "stop-referrer-spam",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33207",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "The Conference \u003c= 1.2.0 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "the-conference",
    "type": "theme",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31428",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Add Widget After Content \u003c= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "add-widget-after-content",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9892",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LWS Hide Login \u003c= 2.1.8 - Protection Mechanism Bypass",
    "slug": "lws-hide-login",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47818",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Super Cache \u003c 1.3.2 - Remote Code Execution",
    "slug": "wp-super-cache",
    "type": "plugin",
    "affected_version": "[*, 1.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-2011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2011",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Roseta \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "roseta",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45451",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Swagger \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "embed-swagger",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0381",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Page Visit Counter \u003c= 8.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-page-visit-counter",
    "type": "plugin",
    "affected_version": "* - 8.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50371",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mapwiz \u003c= 1.0.1 - Authenticated (Admin+) SQL Injection",
    "slug": "mapwiz",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4546",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4546",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Jetpack \u003c= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[*, 12.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-47788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47788",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Happyforms \u003c= 1.25.10 - Missing Authorization",
    "slug": "happyforms",
    "type": "plugin",
    "affected_version": "* - 1.25.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23521",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Textillate \u003c= 2.02 - Authenticated(Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-textillate",
    "type": "plugin",
    "affected_version": "* - 2.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32526",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Audio Player with Playlist Ultimate \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "audio-player-with-playlist-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38516",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Page Widget \u003c= 3.9 - Cross-Site Request Forgery",
    "slug": "wp-page-widget",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-32587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-32587",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appointments \u003c= 2.2.1 - Unauthenticated PHP Object Injection",
    "slug": "appointments",
    "type": "plugin",
    "affected_version": "[*, 2.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-20206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20206",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MStore API \u003c= 4.0.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-45055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45055",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile \u0026 User signup \u003c= 4.0.28 - Missing Authorization",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32948",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32948",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPBITS Addons For Elementor Page Builder \u003c= 1.5.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "wpbits-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8962",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SendGrid for WordPress \u003c= 1.4 - Unauthenticated SQL Injection",
    "slug": "wp-sendgrid-mailer",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43965",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP Github \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-github",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22549",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 3.7.56 - Server-Side Request Forgery via church_admin_import_csv",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 3.7.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.56",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38515",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 6.0.14 - Reflected Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24752",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hide Login+ \u003c= 3.5.1 - Reflected Cross-Site Scripting",
    "slug": "hide-login",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22341",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Payment \u003c= 2.3.7 - Reflected Cross-Site Scripting",
    "slug": "simple-payment",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54303",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Function",
    "slug": "booking-x",
    "type": "plugin",
    "affected_version": "1.0 - 1.1.2",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6814",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Simple Booking Calendar \u003c= 2.0.6 - Authenticated SQL Injection",
    "slug": "wp-simple-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24726",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Flower Delivery by Florist One \u003c= 3.5.8 - (Admin+) Stored Cross-Site Scripting",
    "slug": "flower-delivery-by-florist-one",
    "type": "plugin",
    "affected_version": "* - 3.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1113",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1113",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unite Gallery Lite \u003c 1.5 - Cross-Site Request Forgery and SQL Injection",
    "slug": "unite-gallery-lite",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9447",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP krpano \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-krpano",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23876",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fastly \u003c= 0.97 - Reflected Cross-Site Scripting",
    "slug": "fastly",
    "type": "plugin",
    "affected_version": "* - 0.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.97",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder Plugin (Starter Version) \u003c= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "bb-plugin",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4102",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.13.4 - Cross-Site Request Forgery to Local File Inclusion",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.13.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-11590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11590",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Plugin A/B Image Optimizer \u003c= 3.3 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "images-optimizer",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25163",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Activello \u003c= 1.4.4 - Reflected Cross-Site Scripting",
    "slug": "activello",
    "type": "theme",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45358",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JSM file_get_contents() Shortcode \u003c= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-file-get-contents",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58653",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Copymatic – AI Content Writer \u0026 Generator \u003c= 1.9 - Missing Authorization",
    "slug": "copymatic",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35716",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Modal Popup with Cookie Integration \u003c= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-modal-popup-with-cookie-integration",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31772",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SyntaxHighlighter Evolved \u003c= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "syntaxhighlighter",
    "type": "plugin",
    "affected_version": "* - 3.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30903",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category Posts Widget \u003c= 4.9.16 \u0026 Pro \u003c 4.9.13 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "category-posts",
    "type": "plugin",
    "affected_version": "* - 4.9.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6158",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category Posts Widget \u003c= 4.9.16 \u0026 Pro \u003c 4.9.13 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "term-and-category-based-posts-widget",
    "type": "plugin",
    "affected_version": "* - 4.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6158",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thim Elementor Kit \u003c= 1.2.8 - Missing Authorization",
    "slug": "thim-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24725",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPFront Notification Bar \u003c= 2.0.0 - Authenticated Stored Cross-Site Scripting",
    "slug": "wpfront-notification-bar",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24601",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form for Plugin by Fluent Forms \u003c= 5.0.8 - Insecure Direct Object Reference",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "[*, 5.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-41952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41952",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Infility Global \u003c= 2.9.8 - Reflected Cross-Site Scripting via set_type Parameter",
    "slug": "infility-global",
    "type": "plugin",
    "affected_version": "* - 2.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12290",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NinjaScanner – Virus \u0026 Malware scan \u003c= 3.2.5 - Authenticated (Administrator+) Arbitrary File Deletion",
    "slug": "ninjascanner",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8213",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cab fare calculator \u003c= 1.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cab-fare-calculator",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3556",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile Events Manager \u003c= 1.4.7 - Authenticated (Administrator+) CSV Injection",
    "slug": "mobile-events-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-1194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1194",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Library Bookshelves \u003c= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "library-bookshelves",
    "type": "plugin",
    "affected_version": "* - 5.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13464",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Booster \u003c= 3.8.9 - Cross-Site Request Forgery",
    "slug": "seo-booster",
    "type": "plugin",
    "affected_version": "* - 3.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32438",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wp secure \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "wp-secure-by-sitesecuritymonitorcom",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32490",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The7 — Website and eCommerce Builder for WordPress \u003c= 11.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute",
    "slug": "dt-the7",
    "type": "theme",
    "affected_version": "* - 11.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5451",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cool Video Gallery \u003c= 1.9 - Authenticated Command Injection",
    "slug": "cool-video-gallery",
    "type": "plugin",
    "affected_version": "[*, 2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-7527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-7527",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Oxygen \u003c 4.4 - Cross-Site Request Forgery",
    "slug": "oxygen",
    "type": "plugin",
    "affected_version": "[*, 4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-46841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46841",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Info Boxes Shortcode and Widget \u003c= 1.15 - Cross-Site Request Forgery",
    "slug": "info-boxes-shortcode-and-widget",
    "type": "plugin",
    "affected_version": "* - 1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30541",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AMP for WP – Accelerated Mobile Pages \u003c= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode",
    "slug": "accelerated-mobile-pages",
    "type": "plugin",
    "affected_version": "* - 1.0.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.92",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6782",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quotes llama \u003c= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quotes-llama",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30786",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forms \u003c= 2.8.0 - Unauthenticated Arbitrary File Upload",
    "slug": "forms-by-made-it",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-51791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51791",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Generate Images – Magic Post Thumbnail \u003c= 5.2.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "magic-post-thumbnail",
    "type": "plugin",
    "affected_version": "* - 5.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6724",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6724",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid \u003c= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6410",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Membership SwiftCloud.io \u003c= 1.0 - Authenticated (Admin+) SQL Injection",
    "slug": "club-management-software",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24392",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP IMAP Auth \u003c= 4.0.1 - Reflected Cross-Site Scripting",
    "slug": "wp-imap-authentication",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23506",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Recent Posts Slider \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "recent-posts-slider",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35778",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Alemha Watermarker \u003c= 1.3.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "alemha-watermark",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3754",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WonderPlugin Audio Player \u003c 2.1 - Multiple Cross-Site Scripting",
    "slug": "wonderplugin-audio",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-2218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2218",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Special Feed Items \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "special-feed-items",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8051",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts \u003c= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3100",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leopard \u003c= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "leopard-wordpress-offload-media",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10589",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Post Meta Manager \u003c= 1.0.9 - Reflected Cross-Site Scripting",
    "slug": "simple-post-meta-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32556",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Link List Widget \u003c= 0.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-link-list-widget",
    "type": "plugin",
    "affected_version": "* - 0.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58810",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Knowledge Base documentation \u0026 wiki plugin – BasePress \u003c= 2.16.1 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "basepress",
    "type": "plugin",
    "affected_version": "* - 2.16.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33590",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Reply Notify \u003c= 1.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-reply-notify",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7195",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Text Expander \u003c= 1.0.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-text-expander",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49421",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49421",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Portfolio Slideshow \u003c= 1.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "portfolio-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23717",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Parsian Bank Gateway for Woocommerce \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "parsian-bank-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39309",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WidgetKit \u003c= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "widgetkit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37428",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyBoss Platform \u003c= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'",
    "slug": "buddyboss-platform",
    "type": "plugin",
    "affected_version": "* - 2.7.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13402",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple History \u003c= 3.3.1 - Authenticated (Subscriber+) CSV Injection",
    "slug": "simple-history",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45350",
    "auth_type": "Auth",
    "cvss_score": 6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "MC4WP: Mailchimp for WordPress \u003c= 4.8.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mailchimp-for-wp",
    "type": "plugin",
    "affected_version": "* - 4.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36833",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36833",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyStream \u003c= 3.6.2 - Reflected Cross-Site Scripting",
    "slug": "buddystream",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-10007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-10007",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blocksy \u003c= 2.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blocksy",
    "type": "theme",
    "affected_version": "* - 2.0.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32961",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-RecentComments \u003c= 2.0.7 - SQL Injection",
    "slug": "wp-recentcomments",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-1067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-1067",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "flexo-social-gallery \u003c= 1.0006 - Cross-Site Request Forgery",
    "slug": "flexo-social-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0006",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0006",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52769",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Exxp \u003c= 2.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "exxp-wp",
    "type": "plugin",
    "affected_version": "* - 2.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45812",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CP Polls \u003c= 1.0.81 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cp-polls",
    "type": "plugin",
    "affected_version": "* - 1.0.81",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.81",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50025",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Pre-Orders \u003c= 1.9.0 - Unauthenticated Cross-Site Scripting",
    "slug": "woocommerce-pre-orders",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-32802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32802",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Homey \u003c= 2.4.5 - Unauthenticated SQL Injection",
    "slug": "homey",
    "type": "theme",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52834",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Konnichiwa! Membership \u003c= 0.8.3 Reflected Cross-Site Scripting",
    "slug": "konnichiwa",
    "type": "plugin",
    "affected_version": "* - 0.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38317",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Entries \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via vx-entries shortcode",
    "slug": "contact-form-entries",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33311",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPLMS \u003c 1.9.9.5.3 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "[*, 1.9.9.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-56050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56050",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shortcode Redirect \u003c= 1.0.02 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcode-redirect",
    "type": "plugin",
    "affected_version": "* - 1.0.02",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.02",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54746",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GD Security Headers \u003c= 1.7 - Authenticated (Admin+) SQL Injection",
    "slug": "gd-security-headers",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46821",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ziteboard Online Whiteboard \u003c= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ziteboard Shortcode",
    "slug": "ziteboard-online-whiteboard",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5076",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Image Gallery, Gallery Album \u003c= 2.0.3 - Missing Authorization via Multiple AJAX Actions",
    "slug": "gallery-album",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45631",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Matterport Shortcode \u003c= 2.1.9 - Cross-Site Request Forgery",
    "slug": "shortcode-gallery-for-matterport-showcase",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32109",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Eventer \u003c= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "eventer",
    "type": "plugin",
    "affected_version": "* - 3.9.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11132",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Disqus Popular Posts \u003c= 2.1.1 - Reflected Cross-Site Scripting",
    "slug": "disqus-popular-posts",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22705",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LWS Affiliation \u003c= 2.2.6 - Unauthenticated Remote/Local File Inclusion",
    "slug": "lws-affiliation",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-32297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32297",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Recently \u003c= 1.1 - Unauthenticated PHP Object Injection",
    "slug": "recently-viewed-most-viewed-and-sold-products-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49218",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pricing Table by Supsystic \u003c= 1.8.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "pricing-table-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-9393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9393",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8519",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyBookTable Bookstore \u003c= 3.4.0 - Cross-Site Request Forgery",
    "slug": "mybooktable",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43255",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Automatic Plugin \u003c= 3.53.2 - Unauthenticated Arbitrary Options Update",
    "slug": "wp-automatic",
    "type": "plugin",
    "affected_version": "[*, 3.53.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.53.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4374",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "CRM Perks Forms \u003c= 1.1.5 - Missing Authorization to Unauthenticated Form Submission",
    "slug": "crm-perks-forms",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37463",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woocommerce check pincode/zipcode for shipping \u003c= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "woocommerce-check-pincode-zipcode-for-shipping",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12218",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Giphypress \u003c= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "giphypress",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33927",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 4.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11228",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Awesome Wp Image Gallery \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "awesome-wp-image-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46476",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FULL – Cliente 3.1.5 - 3.1.25 - Authenticated (Subscriber+) SQL Injection",
    "slug": "full-customer",
    "type": "plugin",
    "affected_version": "* - 3.1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12023",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Tempera \u003c= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tempera",
    "type": "theme",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43951",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 2.7.3 - Missing Authorization",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43142",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Private Content Plus \u003c= 3.1 - Cross-Site Request Forgery Bypass",
    "slug": "wp-private-content-plus",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4385",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hypotext \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hypotext",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31761",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JTRT Responsive Tables \u003c 4.1.2 - SQL Injection",
    "slug": "jtrt-responsive-tables",
    "type": "plugin",
    "affected_version": "[*, 4.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18597",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Modern Events Calendar Lite \u003c= 5.16.4 - Unauthenticated Events Export",
    "slug": "modern-events-calendar-lite",
    "type": "plugin",
    "affected_version": "* - 5.16.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.16.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24146",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SureForms \u003c= 1.7.1 - Reflected Cross-Site Scripting",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5921",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jetpack 13.0 - 14.0 - Reflected DOM-based Cross-Site Scripting",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "13.0 - 14.0",
    "from_version": "13.0",
    "from_inclusive": true,
    "to_version": "14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10858",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Civi - Job Board \u0026 Freelance Marketplace WordPress Theme \u003c= 2.1.4 - Sensitive Information Exposure",
    "slug": "civi",
    "type": "theme",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13773",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "CYSTEME Finder \u003c= 1.3 - Arbitrary File Upload/Read",
    "slug": "cysteme-finder",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10955",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Blocksy \u003c= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blocksy",
    "type": "theme",
    "affected_version": "* - 2.0.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4158",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EAN for WooCommerce \u003c= 4.4.2 - Authenticated (Contributor+ )Stored Cross-Site Scripting via Shortcode",
    "slug": "ean-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0062",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FW Food Menu  \u003c= 6.0.0 - Unauthenticated Arbitrary File Deletion",
    "slug": "fw-food-menu",
    "type": "plugin",
    "affected_version": "* - 6.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49448",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "The Post Grid \u003c= 7.7.17 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "the-post-grid",
    "type": "plugin",
    "affected_version": "* - 7.7.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30814",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "W4 Post List \u003c= 2.4.5 - Information Disclosure via post_excerpt",
    "slug": "w4-post-list",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1371",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "MainWP Child \u003c= 4.1.7.1 - SQL Injection via orderby,  order Parameters",
    "slug": "mainwp-child",
    "type": "plugin",
    "affected_version": "[*, 4.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24877",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Meta – User Profile Builder and User management plugin \u003c= 2.4.3 - Path Traversal",
    "slug": "user-meta",
    "type": "plugin",
    "affected_version": "[*, 2.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0779",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form 7 Style \u003c= 3.1.9 Cross-Site Request Forgery",
    "slug": "contact-form-7-style",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24159",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JetEngine \u003c= 3.6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-engine",
    "type": "plugin",
    "affected_version": "* - 3.6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26870",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MailUp newsletter sign-up form \u003c 1.3.2 - Cross-Site Scripting",
    "slug": "wp-mailup",
    "type": "plugin",
    "affected_version": "[*, 1.3.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-2640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2640",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Privacy Policy Generator, Terms \u0026 Conditions Generator - WPLegalPages \u003c= 2.7.0 - Arbitrary Settings Update to Stored Cross-Site Scripting",
    "slug": "wplegalpages",
    "type": "plugin",
    "affected_version": "[*, 2.7.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25106",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Slider – Responsive Touch Slider \u003c= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1449",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opal Estate Pro – Property Management and Submission \u003c= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "opal-estate-pro",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3666",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDataTables \u003c= 2.1.27 - Authenticated Cross-Site Scripting",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "* - 2.1.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29432",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.17.2 - Reflected Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "[*, 2.17.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25100",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zyrex Popup \u003c= 1.0 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "popup-zyrex",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0924",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HL Twitter \u003c= 2014.1.18 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "hl-twitter",
    "type": "plugin",
    "affected_version": "* - 2014.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2014.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3630",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Open edX LMS \u003c= 2.6.1 - Reflected Cross-Site Scripting",
    "slug": "edunext-openedx-integrator",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52452",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPJobBoard \u003c= 5.5.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wpjobboard",
    "type": "plugin",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-9019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9019",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Modal Dialog \u003c= 3.5.14 - Reflected Cross-Site Scripting",
    "slug": "modal-dialog",
    "type": "plugin",
    "affected_version": "[*, 3.5.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-31071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31071",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bestbooks \u003c= 2.6.3 - Unauthenticated SQL Injection",
    "slug": "bestbooks",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0827",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Customer Reviews for WooCommerce \u003c= 5.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "customer-reviews-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0079",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Redirection \u003c= 1.1.4 - Cross-Site Request Forgery to Plugin Reset",
    "slug": "redirect-redirection",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1331",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WC1C \u003c= 0.23.0 - Reflected Cross-Site Scripting",
    "slug": "wc1c-main",
    "type": "plugin",
    "affected_version": "* - 0.23.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.23.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11375",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RJ Quickcharts \u003c= 0.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "rj-quickcharts",
    "type": "plugin",
    "affected_version": "* - 0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25131",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 2.11.5 - Admin+ Cross-Site Scripting",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "[*, 2.11.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0706",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0706",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RomanCart On WordPress \u003c= 0.0.2 - Reflected Cross-Site Scripting",
    "slug": "romancart-on-wordpress",
    "type": "plugin",
    "affected_version": "* - 0.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23685",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Taxi Booking Manager for WooCommerce \u003c= 1.2.1 - Missing Authorization",
    "slug": "ecab-taxi-booking-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30839",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30839",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FooGallery Premium \u003c= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "foogallery-premium",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FooGallery Premium \u003c= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 2.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Insertify \u003c= 1.1.4 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "insertify",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54372",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress \u0026 WooCommerce \u003c= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hurrytimer",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32556",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-FormAssembly \u003c= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "formassembly-web-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49768",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple 301 Redirects 2.0.0 - 2.0.3 - Authenticated Arbitrary Plugin Activation",
    "slug": "simple-301-redirects",
    "type": "plugin",
    "affected_version": "2.0.0 - 2.0.3",
    "from_version": "2.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24356",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery Bank – WordPress Photo Gallery Plugin \u003c 3.0.70 - Reflected Cross-Site Scripting",
    "slug": "gallery-bank",
    "type": "plugin",
    "affected_version": "[*, 3.0.70)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.70",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-8758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8758",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Profiles \u003c= 2.6.2 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "wp-user-profiles",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31524",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Church Admin \u003c 0.810 - Stored Cross-Site Scripting",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "[*, 0.810)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.810",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-4127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4127",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donation Block For PayPal \u003c=  2.1.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "donations-block",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6021",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DirectIQ Email Marketing \u003c= 2.0 - Unauthenticated SQL Injection",
    "slug": "directiq-wp",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52829",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Sticky Button \u003c= 1.4 - Missing Authorization to Arbitrary Settings Update",
    "slug": "wa-sticky-button",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2375",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP likes \u003c= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "wp-likes",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58848",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category Specific RSS Feed Subscription \u003c= 2.0 - Cross-Site Request Forgery",
    "slug": "category-specific-rss-feed-menu",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-5993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5993",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BM Content Builder \u003c= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_page_options_save",
    "slug": "bm-builder",
    "type": "plugin",
    "affected_version": "* - 3.16.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.16.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Help Scout \u003c= 6.5.6 - Missing Authorization",
    "slug": "help-scout",
    "type": "plugin",
    "affected_version": "* - 6.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22512",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP User \u003c= 7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-user",
    "type": "plugin",
    "affected_version": "* - 7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4519",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4519",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS Feed Pro \u003c= 1.1.8 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "rss-feed-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53581",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SpaBiz \u003c= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spabiz",
    "type": "theme",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26740",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Osom Blocks \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter",
    "slug": "osomblocks",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5940",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5940",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopLentor \u003c= 2.8.1 - Improper Authorization via woolentor_template_store",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7067",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RPS Include Content \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "rps-include-content",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31093",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ChatBot \u003c= 4.4.4 - Unauthenticated Stored Cross-Site Scripting via Cross-Site Request Forgery",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1011",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Category Slider for WooCommerce \u003c= 4.3.4 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "woo-category-slider-by-pluginever",
    "type": "plugin",
    "affected_version": "* - 4.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39364",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sala \u003c= 1.1.3 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "sala",
    "type": "theme",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52826",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "External Login \u003c= 1.11.2 - Authenticated (Subscriber+) Sensitive Data Exposure via Test Connection",
    "slug": "external-login",
    "type": "plugin",
    "affected_version": "* - 1.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11196",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11196",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Quiz and Survey Master  \u003c= 9.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 9.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6390",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "워드프레스 결제 심플페이 \u003c= 5.2.11 - Cross-Site Request Forgery",
    "slug": "pgall-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47661",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.102 - Missing Authorization to Authenticated (Subscriber+) Status Updates",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.102",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.102",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43916",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Popups \u003c= 2.1.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-popups-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29105",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29105",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PuzzleMe for WordPress \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "puzzleme",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58621",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FormBuilder \u003c= 0.90 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "formbuilder",
    "type": "plugin",
    "affected_version": "* - 0.90",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.90",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-6715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6715",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Print Invoice \u0026 Delivery Notes for WooCommerce \u003c= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "woocommerce-delivery-notes",
    "type": "plugin",
    "affected_version": "* - 5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13640",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "GigPress \u003c= 2.3.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "gigpress",
    "type": "plugin",
    "affected_version": "* - 2.3.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4759",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4759",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PickPlugins Product Slider for WooCommerce \u003c= 1.13.41 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woocommerce-products-slider",
    "type": "plugin",
    "affected_version": "* - 1.13.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0166",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GetYourGuide Ticketing \u003c= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "getyourguide-ticketing",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3609",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Slider \u003c= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodes",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.10.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5291",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5291",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simen \u003c= 4.6 - Unauthenticated Local File Inclusion",
    "slug": "snssimen",
    "type": "theme",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-29002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29002",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All in One SEO \u003c= 4.1.0.1 - Authenticated Code Injection",
    "slug": "all-in-one-seo-pack",
    "type": "plugin",
    "affected_version": "[*, 4.1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24307",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Web Icons \u003c= 1.0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "icon",
    "type": "plugin",
    "affected_version": "* - 1.0.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29933",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Field Suite \u003c= 2.5.14 - Authenticated Cross-Site Scripting",
    "slug": "custom-field-suite",
    "type": "plugin",
    "affected_version": "* - 2.5.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-11871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-11871",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PHPSpreadsheet Library \u003c 2.3.0 - XXE Injection",
    "slug": "products-stock-manager-with-excel",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-45293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PHPSpreadsheet Library \u003c 2.3.0 - XXE Injection",
    "slug": "woo-order-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-45293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PHPSpreadsheet Library \u003c 2.3.0 - XXE Injection",
    "slug": "woo-product-excel-importer",
    "type": "plugin",
    "affected_version": "* - 5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-45293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PHPSpreadsheet Library \u003c 2.3.0 - XXE Injection",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.11.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-45293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PHPSpreadsheet Library \u003c 2.3.0 - XXE Injection",
    "slug": "tablepress",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-45293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PHPSpreadsheet Library \u003c 2.3.0 - XXE Injection",
    "slug": "content-excel-importer",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-45293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PHPSpreadsheet Library \u003c 2.3.0 - XXE Injection",
    "slug": "advanced-cf7-db",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-45293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PHPSpreadsheet Library \u003c 2.3.0 - XXE Injection",
    "slug": "webd-woocommerce-product-excel-importer-bulk-edit",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-45293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PHPSpreadsheet Library \u003c 2.3.0 - XXE Injection",
    "slug": "users-import-export-with-excel-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-45293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45293",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Google Doc Embedder \u003c= 2.6.1 - Cross-Site Request Forgery",
    "slug": "google-document-embedder",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10882",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "File Select Control For Elementor \u003c= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "file-select-control-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51841",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bus Ticket Booking with Seat Reservation \u003c= 5.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bus-ticket-booking-with-seat-reservation",
    "type": "plugin",
    "affected_version": "* - 5.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43985",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inactive User Deleter \u003c= 1.59 - Cross-Site Request Forgery via Multiple Functions",
    "slug": "inactive-user-deleter",
    "type": "plugin",
    "affected_version": "* - 1.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.59",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-27424",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27424",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
  },
  {
    "title": "wpForo Forum \u003c 1.4.12 - Reflected Cross-Site Scripting",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "[*, 1.4.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-11709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-11709",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! \u003c= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget",
    "slug": "elespare",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4615",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks – Page Builder Features \u003c= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4209",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Countdown Widget \u003c= 3.1.9.1 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "wordpress-countdown-widget",
    "type": "plugin",
    "affected_version": "* - 3.1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45847",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Testimonials \u003c= 3.5.2 - Authenticated Stored Cross-Site Scripting",
    "slug": "easy-testimonials",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-14959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-14959",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conference Scheduler \u003c= 2.4.3 - Reflected Cross-Site Scripting",
    "slug": "conference-scheduler",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0600",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Your Lightbox \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "your-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23704",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Forms \u003c= 2.6.98 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "smart-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.98",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.98",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5055",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallerio \u003c= 1.01 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "gallerio",
    "type": "plugin",
    "affected_version": "* - 1.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52400",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 21.3.4 - Authenticated (Author+) Arbitrary File Deletion",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 21.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32778",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Themify Ultra \u003c= 7.3.5 - Privilege Escalation",
    "slug": "themify-ultra",
    "type": "theme",
    "affected_version": "* - 7.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46145",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings Parameter",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8858",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease \u003c= 2.6.6 - Missing Authorization to Sensitive Information Exposure",
    "slug": "password-protected",
    "type": "plugin",
    "affected_version": "* - 2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0437",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Yandex Metrica Counter \u003c= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "counter-yandex-metrica",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34173",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Revolut Gateway for WooCommerce \u003c= 4.9.7 - Missing Authorization",
    "slug": "revolut-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52224",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "my flatonica \u003c= 0.0.8 \u0026 my wooden under construction \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "my-engine",
    "type": "theme",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49269",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "my flatonica \u003c= 0.0.8 \u0026 my wooden under construction \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "my-flatonica",
    "type": "theme",
    "affected_version": "* - 0.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49269",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "my flatonica \u003c= 0.0.8 \u0026 my wooden under construction \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "my-money",
    "type": "theme",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49269",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "my flatonica \u003c= 0.0.8 \u0026 my wooden under construction \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "my-depressive",
    "type": "theme",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49269",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "my flatonica \u003c= 0.0.8 \u0026 my wooden under construction \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "my-wooden-under-construction",
    "type": "theme",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49269",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "my flatonica \u003c= 0.0.8 \u0026 my wooden under construction \u003c= 2.0.7 - Reflected Cross-Site Scripting",
    "slug": "my-zebra",
    "type": "theme",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49269",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wezido \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wezido-elementor-addon-based-on-easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51836",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 4.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via meta-text",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30193",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PZ Frontend Manager \u003c= 1.0.5 - Cross-Site Request Forgery to Profile Picture Update",
    "slug": "pz-frontend-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6244",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MStore API \u003c= 3.9.6 - Cross-Site Request Forgery to Order Title Update",
    "slug": "mstore-api",
    "type": "plugin",
    "affected_version": "* - 3.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3199",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Import Export Lite \u003c= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-import-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.9.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6207",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6207",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Administrator Z  \u003c= 2025.03.04 - Cross-Site Request Forgery",
    "slug": "administrator-z",
    "type": "plugin",
    "affected_version": "* - 2025.03.04",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2025.03.04",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32276",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Page Builder by SiteOrigin \u003c= 2.29.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image Widget",
    "slug": "siteorigin-panels",
    "type": "plugin",
    "affected_version": "* - 2.29.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.29.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2202",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bitly's WordPress Plugin \u003c= 2.7.2 - Missing Authorization",
    "slug": "wp-bitly",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43209",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c= 9.5 - Unauthenticated Arbitrary File Upload",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30510",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Codestyling Localization \u003c= 1.99.30 - Cross-Site Request Forgery to Remote Code Execution",
    "slug": "codestyling-localization",
    "type": "plugin",
    "affected_version": "* - 1.99.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.99.30",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-4179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4179",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI ChatBot \u003c= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5204",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MainWP File Uploader Extension \u003c= 4.1 - Unauthenticated Arbitrary File Upload",
    "slug": "mainwp-file-uploader-extension",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-23656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23656",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Like box – Page \u003c= 3.7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ays-facebook-popup-likebox",
    "type": "plugin",
    "affected_version": "* - 3.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31387",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Icons \u003c= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "easy-social-icons",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48336",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.25.1 - Cross-Site Request Forgery via give_cache_flush",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25450",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Carousel Slider \u0026 Grid Ultimate for WooCommerce \u003c= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'",
    "slug": "woo-product-carousel-slider-and-grid-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12040",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "iMember360is 3.8.012 - 3.9.001 - Cross-Site Scripting",
    "slug": "imember360",
    "type": "plugin",
    "affected_version": "[3.8.012, 3.9.002)",
    "from_version": "3.8.012",
    "from_inclusive": true,
    "to_version": "3.9.002",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-3842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3842",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IDB Ecommerce (wpStoreCart 5) \u003c 2.5.30 - Arbitrary File Upload",
    "slug": "wpstorecart",
    "type": "plugin",
    "affected_version": "* - 2.5.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.29",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2012-3576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-3576",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FileOrganizer \u003c= 1.0.3 - Authenticated (Admin+) Arbitrary File Access",
    "slug": "fileorganizer",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-3664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3664",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Product Feed PRO for WooCommerce by AdTribes – WooCommerce Product Feeds for Google, Facebook/Meta, Bing, \u0026 More \u003c= 13.2.5 - Reflected Cross-Site Scripting",
    "slug": "woo-product-feed-pro",
    "type": "plugin",
    "affected_version": "* - 13.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24800",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "QuickieBar \u003c= 1.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "quickiebar",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34425",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "json5 \u003c= 1.0.1 and 2.0.0-2.2.1 - Prototype Pollution",
    "slug": "simple-podcasting",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-46175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46175",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "json5 \u003c= 1.0.1 and 2.0.0-2.2.1 - Prototype Pollution",
    "slug": "maps-block-apple",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-46175",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46175",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup by Supsystic \u003c= 1.10.4 - Reflected Cross-Site Scripting",
    "slug": "popup-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24275",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload",
    "slug": "aidreform",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload",
    "slug": "kingclub-theme",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload",
    "slug": "spikes-black",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload",
    "slug": "statfort",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload",
    "slug": "bolster",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload",
    "slug": "club-theme",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload",
    "slug": "spikes",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload",
    "slug": "soundblast",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload",
    "slug": "westand",
    "type": "theme",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload",
    "slug": "footysquare",
    "type": "theme",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0316",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Builder \u003c= 4.2.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "[*, 4.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-6000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6000",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Catalog Simple \u003c= 1.7.6 - Sensitive Information Exposure via Product CSV",
    "slug": "post-type-x",
    "type": "plugin",
    "affected_version": "[*, 1.7.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-51687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51687",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Library Viewer \u003c= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "library-viewer",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AppPresser \u003c= 4.2.5 - Insecure Password Reset Mechanism",
    "slug": "apppresser",
    "type": "plugin",
    "affected_version": "* - 4.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4214",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "kStats Reloaded \u003c= 0.7.4 - Reflected Cross-Site Scripting",
    "slug": "kstats-reloaded",
    "type": "plugin",
    "affected_version": "* - 0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46440",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Currency Switcher \u003c= 1.1.6 - Cross-site request forgery",
    "slug": "currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-20780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20780",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Church Admin \u003c 5.0.0 - Reflected Cross-Site Scripting",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "[*, 5.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-50438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50438",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TF Woo Product Grid Addon For Elementor \u003c= 1.0.1 - Unauthenticated PHP Object Injection",
    "slug": "tf-woo-product-grid",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-59007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59007",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Floating Action Button \u003c= \u003c=1.2.1 - Cross-Site Request Forgery to Settings Modification",
    "slug": "floating-action-button",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31088",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Js paper \u003c= 2.5.7 - Reflected Cross-Site Scripting",
    "slug": "js-paper",
    "type": "theme",
    "affected_version": "* - 2.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49678",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Meta – User Profile Builder and User management plugin \u003c= 3.1.1 - Insecure Direct Object Reference to Sensitive Information Exposure",
    "slug": "user-meta",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9262",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Material Dashboard \u003c= 1.4.5 - Unauthenticated Privilege Escalation",
    "slug": "material-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31095",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31095",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "IP2Location World Clock \u003c= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ip2location-world-clock",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32644",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flickr Justified Gallery \u003c= 3.5 - Cross-Site Request Forgery via fjgwpp_settings()",
    "slug": "flickr-justified-gallery",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25473",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JS Help Desk – Best Help Desk \u0026 Support Plugin \u003c= 2.8.3 - Missing Authorization",
    "slug": "js-support-ticket",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31273",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - Local File Inclusion",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-10956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10956",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Team Showcase \u003c 25.05.13 - Authenticated (Subscriber+) Arbitrary Shortcode Execution",
    "slug": "team-showcase-cm",
    "type": "plugin",
    "affected_version": "[*, 25.05.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "25.05.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-49250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49250",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter by Supsystic \u003c 1.1.8 - Cross-Site Request Forgery",
    "slug": "newsletter-by-supsystic",
    "type": "plugin",
    "affected_version": "[*, 1.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18512",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.1",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.12",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.10",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.9",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.6",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.12",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.9",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.4.2 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.2",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-2222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-2222",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Save as PDF  \u003c= 3.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "save-as-pdf-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31930",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real-Time Find and Replace \u003c= 3.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "real-time-find-and-replace",
    "type": "plugin",
    "affected_version": "* - 3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-13641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13641",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gestion-Pymes \u003c= 1.5.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "gestion-pymes",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38397",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thank You Page Customizer for WooCommerce – Increase Your Sales \u003c= 1.1.7 - Missing Authorization",
    "slug": "woo-thank-you-page-customizer",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30993",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video Widget \u003c= 1.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "video-widget",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5169",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meta Data Filter \u0026 Taxonomies Filter \u003c= 1.2.7.2 -  Cross-Site Request Forgery",
    "slug": "wp-meta-data-filter-and-taxonomy-filter",
    "type": "plugin",
    "affected_version": "[*, 2.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-20781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20781",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Affiliates Plugin — SliceWP Affiliates \u003c= 1.1.10 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "slicewp",
    "type": "plugin",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34413",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPack Lite for Beaver Builder  \u003c= 1.2.9.2 Reflected Cross-Site Scripting",
    "slug": "powerpack-addon-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0176",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "oAuth Twitter Feed for Developers \u003c= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "oauth-twitter-feed-for-developers",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25042",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25042",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IA Map Analytics Basic \u003c= 20170413 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ia-map-analytics-basic",
    "type": "plugin",
    "affected_version": "* - 20170413",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "20170413",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51937",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51937",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Protected Posts Logout Button \u003c= 1.4.5 - Missing Authorization on pplb_options_save",
    "slug": "protected-posts-logout-button",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25454",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "FooGallery \u003c= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "foogallery",
    "type": "plugin",
    "affected_version": "* - 2.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2081",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2081",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Campus Explorer Widget \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "campus-explorer-widget",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49660",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Search Analytics \u003c= 1.4.7 - Reflected Cross-Site Scripting via 'render_stats_page'",
    "slug": "search-analytics",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30471",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NinjaFirewall \u003c= 4.3.3 - Authenticated PHAR Deserialization",
    "slug": "ninjafirewall",
    "type": "plugin",
    "affected_version": "[*, 4.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-4451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4451",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Media Library Assistant \u003c= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "media-library-assistant",
    "type": "plugin",
    "affected_version": "* - 3.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59590",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Total Upkeep – WordPress Backup Plugin plus Restore \u0026 Migrate by BoldGrid \u003c= 1.16.10 - Authenticated (Admin+) Command Injection",
    "slug": "boldgrid-backup",
    "type": "plugin",
    "affected_version": "* - 1.16.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2257",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "kineticPay for WooCommerce \u003c= 2.0.8 - Unauthenticated Arbitrary File Upload",
    "slug": "kineticpay-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-52379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52379",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Download Manager \u003c= 3.2.15 - Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "[*, 3.2.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24773",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ERP | Complete HR solution with recruitment \u0026 job listings | WooCommerce CRM \u0026 Accounting \u003c= 1.12.9 - Authenticated (Subscriber+) SQL Injection",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.12.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0608",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode \u003c= 1.7 -  Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "paypal-pay-buy-donation-and-cart-buttons-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3065",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTTP Headers \u003c= 1.18.11 - Server-Side Request Forgery",
    "slug": "http-headers",
    "type": "plugin",
    "affected_version": "* - 1.18.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37978",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Elementor Addons \u003c= 1.0.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "dynamic-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49243",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Email Newsletter \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-email-newsletter",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13098",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backend Localization \u003c= 2.1.10 - Cross-Site Request Forgery",
    "slug": "kau-boys-backend-localization",
    "type": "plugin",
    "affected_version": "* - 2.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44471",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.8.3 - Missing Authorization",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3946",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Libsyn Publisher Hub \u003c= 1.3.2 - Sensitive Information Exposure",
    "slug": "libsyn-podcasting",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25057",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "User Photo \u003c= 0.9.5 - Cross-Site Scripting",
    "slug": "user-photo",
    "type": "plugin",
    "affected_version": "* - 0.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-2920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-2920",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Slider \u003c= 1.1.121 - Cross-Site Request Forgery to Post Duplication",
    "slug": "image-slider-widget",
    "type": "plugin",
    "affected_version": "* - 1.1.121",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.121",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2223",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time \u003c= 1.0.0 - Authenticated (Contributor+) Post Disclosure",
    "slug": "builder-shortcode-extras",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13841",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 6.5.1 - Unauthenticated Privilege Escalation",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 6.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50550",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARPrice \u003c= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "arprice",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26731",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPC Order Notes for WooCommerce \u003c= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "woo-order-notes",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12004",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12004",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShopLentor \u003c= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link",
    "slug": "woolentor-addons",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1960",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyBookProgress by Stormhill Media \u003c= 1.0.8 - Missing Authorization",
    "slug": "mybookprogress",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31887",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Post Type Page Template \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "custom-post-type-page-template",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50372",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50372",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "REST API TO MiniProgram \u003c= 4.7.1 - Unauthenticated SQL Injection",
    "slug": "rest-api-to-miniprogram",
    "type": "plugin",
    "affected_version": "* - 4.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-8484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8484",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Shortcode For Elementor Templates \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "shortcode-support-for-elementor-templates",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48022",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48022",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikRentCar Car Rental Management System \u003c= 1.4.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "vikrentcar",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11640",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Auto Load Next Post \u003c= 1.5.14 - Cross-Site Request Forgery",
    "slug": "auto-load-next-post",
    "type": "plugin",
    "affected_version": "* - 1.5.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30529",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "amr personalise \u003c= 2.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "amr-personalise",
    "type": "plugin",
    "affected_version": "* - 2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23880",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SMS \u003c= 6.5 - Cross-Site Request Forgery to Subscriber Deletion",
    "slug": "wp-sms",
    "type": "plugin",
    "affected_version": "* - 6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6980",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form \u0026 Custom Contact Form builder \u003c= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.15.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9507",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Contact Form 7 Connector \u003c= 1.2.2 - Cross-Site Request Forgery",
    "slug": "ari-cf7-connector",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24884",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 0.8.8.5 - Cross-Site Scripting via the rules[0][content] parameter in a wpfc_save_exclude_pages action",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 0.8.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-17583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17583",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Gravity Forms Constant Contact Plugin \u003c= 1.1.0 - Open Redirect",
    "slug": "gf-constant-contact",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30954",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0695",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Send to Twitter \u003c= 1.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "send-to-twitter",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23691",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PDF Light Viewer \u003c= 1.4.11 - Authenticated Command Injection",
    "slug": "pdf-light-viewer",
    "type": "plugin",
    "affected_version": "* - 1.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24684",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Add User Role \u003c= 0.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "add-user-role",
    "type": "plugin",
    "affected_version": "* - 0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37403",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37403",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Quantity Dropdown For Woocommerce \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "product-quantity-dropdown-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47451",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 5.1.9.2 - Improper Authorization to Price Change",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23976",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Boxed Content \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "boxed-content",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58851",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery, Images, Slider in Rbs Image Gallery \u003c= 3.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Title",
    "slug": "robo-gallery",
    "type": "plugin",
    "affected_version": "* - 3.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3896",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Inline Stock Quotes \u003c= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock Shortcode",
    "slug": "inline-stock-quotes",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8688",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sign-up Sheets \u003c= 2.2.12 - Reflected Cross-Site Scripting",
    "slug": "sign-up-sheets",
    "type": "plugin",
    "affected_version": "* - 2.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6020",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Doneren met Mollie \u003c= 2.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "doneren-met-mollie",
    "type": "plugin",
    "affected_version": "* - 2.10.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30779",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EZPZ SAML SP Single Sign On (SSO) \u003c= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ezpz-sp",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24749",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 3.7.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 3.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58993",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PORTONE 우커머스 결제 \u003c= 3.2.5 - Reflected Cross-Site Scripting",
    "slug": "iamport-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24609",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Foxit eSign for WordPress \u003c= 2.0.3 - Authenticated (Admin+) Information Exposure",
    "slug": "esign-genie-for-wp",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-49419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49419",
    "auth_type": "Privileged",
    "cvss_score": 2.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \u003c= 6.0.6.2 - Authenticated (Administrator+) SQL Injection",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 6.0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-11204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11204",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventPrime – Events Calendar, Bookings and Tickets \u003c= 3.4.2 - Unauthenticated Booking Payment Bypass",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1321",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.09 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "2.1",
    "from_version": "2.1",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2007-1049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1049",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.09 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2007-1049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-1049",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Snippy \u003c= 1.4.1 - Reflected Cross-Site Scripting",
    "slug": "snippy",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23803",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Beaver Builder \u003c= 1.35.14 - Authenticated(Contributor+) Privilege Escalation",
    "slug": "bb-ultimate-addon",
    "type": "plugin",
    "affected_version": "* - 1.35.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.35.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51398",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "W4 Post List \u003c= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Options",
    "slug": "w4-post-list",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0374",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IntoTheDark \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "intothedark",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43958",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder: Pagelayer \u003c= 1.7.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7115",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Contact Form 7 \u003c= 3.1.28 - Reflected Cross-Site Scripting",
    "slug": "ultimate-addons-for-contact-form-7",
    "type": "plugin",
    "affected_version": "[*, 3.1.29)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.29",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2803",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zen Sticky Social \u003c= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "zen-social-sticky",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6055",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DMSGuestbook \u003c 1.9.0 - Cross-Site Scripting",
    "slug": "dmsguestbook",
    "type": "plugin",
    "affected_version": "[*, 1.9.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2008-0617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0617",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Table \u003c= 2.0.1 - Missing Authorization",
    "slug": "elfsight-pricing-table",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4102",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Simple Events Calendar \u003c= 1.4.0 - Authenticated SQL Injection",
    "slug": "simple-events-calendar",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24552",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24552",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Sliders \u0026 Post Grids \u003c= 1.0.20 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "post-slider-carousel",
    "type": "plugin",
    "affected_version": "* - 1.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47226",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47226",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meteor Slides \u003c= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "meteor-slides",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52493",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Knight Lab Timeline \u003c= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "knight-lab-timelinejs",
    "type": "plugin",
    "affected_version": "* - 3.9.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2287",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IntelliWidget Elements \u003c= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "intelliwidget-elements",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51912",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "1-Click Login: Passwordless Authentication  1.4.5 - Authentication Bypass via Account Takeover",
    "slug": "swoop-password-free-authentication",
    "type": "plugin",
    "affected_version": "1.4.5",
    "from_version": "1.4.5",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50478",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Checkout Files Upload for WooCommerce \u003c= 2.1.2 - Cross-Site Scripting",
    "slug": "checkout-files-upload-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29425",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Incredible Font Awesome \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "incredible-font-awesome",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23927",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zero Spam \u003c= 5.5.6 - Spam Protection Bypass",
    "slug": "zero-spam",
    "type": "plugin",
    "affected_version": "* - 5.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32521",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shortcodes by Angie Makes \u003c= 3.46 - Missing Authorization",
    "slug": "wc-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23725",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23725",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LayerSlider \u003c= 7.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "LayerSlider",
    "type": "plugin",
    "affected_version": "* - 7.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47786",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pie Register \u003c= 1.30 - Multiple Cross-Site Scripting",
    "slug": "pie-register",
    "type": "plugin",
    "affected_version": "* - 1.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-4954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-4954",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Short URL \u003c= 1.6.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "shorten-url",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2921",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.4 - Missing Authorization via settings_reset",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41870",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CBX Map for Google Map \u0026 OpenStreetMap \u003c= 1.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cbxgooglemap",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47669",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Audio Editor \u0026amp; Recorder \u003c= 2.2.3 - Unauthenticated Information Exposure",
    "slug": "audio-editor-recorder",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53211",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "DynamicTags \u003c= 1.4.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "dynamictags",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22348",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BulkGate SMS Plugin for WooCommerce \u003c= 3.0.2 - Missing Authorization via Multiple AJAX Actions",
    "slug": "woosms-sms-module-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51679",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MapSVG - All Kinds of Maps and Store Locator for WordPress \u003c= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mapsvg",
    "type": "plugin",
    "affected_version": "* - 8.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9544",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Popups – WordPress Popup builder \u003c= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-popups-lite",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1905",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Betheme \u003c= 26.7.5 - Reflected Cross-Site Scripting",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 26.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29101",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "underConstruction \u003c= 1.21 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "underconstruction",
    "type": "plugin",
    "affected_version": "* - 1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30548",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form by Bit Form \u003c= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "bit-form",
    "type": "plugin",
    "affected_version": "* - 2.18.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2580",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Different Menu in Different Pages – Control Menu Visibility (All in One) \u003c= 2.3.2 - Missing Authorization to Menu Duplication",
    "slug": "different-menus-in-different-pages",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3206",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11180",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Private Files \u003c= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access",
    "slug": "user-private-files",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7848",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Eupago Gateway For Woocommerce \u003c= 3.1.9 - Cross-Site Request Forgery via eupago_page_content",
    "slug": "eupago-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45638",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CP Polls \u003c= 1.0.74 - Reflected Cross-Site Scripting",
    "slug": "cp-polls",
    "type": "plugin",
    "affected_version": "* - 1.0.74",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.74",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47297",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP System \u003c= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-system",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12003",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hover Effects For WPBakery Page Builder \u003c= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "image-hover-effects-visual-composer-extension",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23681",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MaxGalleria \u003c= 6.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcode",
    "slug": "maxgalleria",
    "type": "plugin",
    "affected_version": "* - 6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5970",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bSecure 1.3.7 - 1.7.9 - Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint",
    "slug": "bsecure",
    "type": "plugin",
    "affected_version": "1.3.7 - 1.7.9",
    "from_version": "1.3.7",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6187",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6187",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 Skins \u003c= 2.5.0 - Reflected Cross-Site Scripting",
    "slug": "contact-form-7-skins",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25063",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "T\u0026P Gallery Slider \u003c= 1.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "tp-gallery-slider",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32527",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Education Zone \u003c= 1.3.4 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "education-zone",
    "type": "theme",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37103",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSVP and Event Management Plugin \u003c= 2.7.14 - Authenticated (Administrator+) SQL Injection",
    "slug": "rsvp",
    "type": "plugin",
    "affected_version": "* - 2.7.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24683",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Dynamic AJAX Product Filters for WooCommerce \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter",
    "slug": "dynamic-ajax-product-filters-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6255",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CodeMirror Blocks \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-codemirror-block",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1791",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4876",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin side data storage for Contact Form 7 plugin \u003c= 1.1.1 - Missing Authorization to Unauthenticated Read Status Update",
    "slug": "admin-side-data-storage-for-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1779",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Book Your Travel \u003c= 8.18.17 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "bookyourtravel",
    "type": "theme",
    "affected_version": "* - 8.18.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.18.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37952",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Espresso 4 Decaf – Event Registration Event Ticketing \u003c= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modification",
    "slug": "event-espresso-decaf",
    "type": "plugin",
    "affected_version": "* - 4.10.46.decaf",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.46.decaf",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6883",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Uncanny Automator – Easy Automation, Integration, Webhooks \u0026 Workflow Builder Plugin  \u003c= 6.4.0.2 - Missing Authorization",
    "slug": "uncanny-automator",
    "type": "plugin",
    "affected_version": "* - 6.4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48133",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Cue \u003c= 2.4.4 - Missing Authorization",
    "slug": "cue",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31787",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Include Me \u003c= 1.2.1 - Local File Inclusion leading to Authenticated Remote Code Execution",
    "slug": "include-me",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24453",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Social Feed – Social Photos Gallery – Post Feed – Like Box \u003c= 6.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting",
    "slug": "easy-facebook-likebox",
    "type": "plugin",
    "affected_version": "* - 6.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6067",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sensei LMS – Online Courses, Quizzes, \u0026 Learning \u003c= 4.19.2 - Authenticated (Teacher+) User Email Disclosure",
    "slug": "sensei-lms",
    "type": "plugin",
    "affected_version": "* - 4.19.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8009",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Optimate Ads \u003c= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "optimate-ads",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25136",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup and Staging by WP Time Capsule \u003c= 1.21.15 - Authentication Bypass",
    "slug": "wp-time-capsule",
    "type": "plugin",
    "affected_version": "[*, 1.21.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21.16",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-8771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-8771",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Emoji One \u003c= 0.6.0 - Cross-Site Request Forgery",
    "slug": "wp-emoji-one",
    "type": "plugin",
    "affected_version": "* - 0.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37991",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Awesome Feed – Custom Feed \u003c= 2.2.5 - Reflected Cross-Site Scripting",
    "slug": "wp-facebook-feed",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46077",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46077",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pixel Manager for WooCommerce (PRO) \u003c= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode",
    "slug": "woocommerce-google-adwords-conversion-tracking-tag",
    "type": "plugin",
    "affected_version": "* - 1.49.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.49.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6201",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinterest RSS Widget \u003c= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "pinterest-rss-widget",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23877",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Beaver Builder – Lite \u003c= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget",
    "slug": "ultimate-addons-for-beaver-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2143",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AHAthat Plugin \u003c= 1.6 - Authenticated (Admin+) SQL Injection",
    "slug": "ahathat",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11269",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Image Map Pro \u003c= 6.0.20 - Missing Authorization to Authenticated (Contributor+) Map Project Add/Update/Delete",
    "slug": "image-map-pro",
    "type": "plugin",
    "affected_version": "* - 6.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9584",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Coaching Staffs \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "coaching-staffs",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13663",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 3.73 - Reflected Cross-Site Scripting",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 3.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24152",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24152",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sitekit \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "sitekit",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29111",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Return Refund and Exchange For WooCommerce \u003c= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "woo-refund-and-exchange-lite",
    "type": "plugin",
    "affected_version": "* - 4.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13641",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Document Management System \u003c= 1.24 - Reflected Cross-Site Scripting",
    "slug": "dms",
    "type": "plugin",
    "affected_version": "* - 1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46448",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \u003c= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bdthemes-prime-slider-lite",
    "type": "plugin",
    "affected_version": "* - 3.14.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4339",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Album Gallery – WordPress Gallery \u003c= 1.5.7 - Missing Authorization",
    "slug": "new-album-gallery",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35720",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Catalyst Connect Zoho CRM Client Portal \u003c= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "catalyst-connect-client-portal",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44629",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-CRM System \u003c= 3.4.2 - Missing Authorization",
    "slug": "wp-crm-system",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49270",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hero Mega Menu - Responsive WordPress Menu Plugin \u003c= 1.16.5 - Reflected Cross-Site Scripting",
    "slug": "hmenu",
    "type": "plugin",
    "affected_version": "* - 1.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13779",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Reveal Template \u003c= 3.7 - Unauthenticated Full Path Disclosure",
    "slug": "reveal-template",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7416",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WCFM Marketplace \u003c= 3.4.12 - Cross-Site Request Forgery",
    "slug": "wc-multivendor-marketplace",
    "type": "plugin",
    "affected_version": "* - 3.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4936",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Essential Blocks – Page Builder Gutenberg Blocks, Patterns \u0026 Templates \u003c= 4.5.9 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting via \"Social Icons\" Block",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3818",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3818",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Support Board \u003c= 3.3.4 - Agent+ Stored Cross-Site Scripting",
    "slug": "supportboard",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24807",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Over Image For WPBakery Page Builder \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "image-over-image-vc-extension",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-0399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0399",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feed Statistics \u003c 4.0 - Open Redirect",
    "slug": "wordpress-feed-statistics",
    "type": "plugin",
    "affected_version": "[*, 4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-17074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17074",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.27.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.27.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50413",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GD Mail Queue \u003c= 4.3 - Reflected Cross-Site Scripting",
    "slug": "gd-mail-queue",
    "type": "plugin",
    "affected_version": "* - 4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24608",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24608",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HUSKY – Products Filter for WooCommerce (formerly WOOF) \u003c= 1.3.5.1 - Cross-Site Request Forgery",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30462",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30462",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Giveaways and Contests by RafflePress \u003c= 1.12.16 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "rafflepress",
    "type": "plugin",
    "affected_version": "* - 1.12.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10107",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LWS Affiliation \u003c= 2.3.4 - Missing Authorization",
    "slug": "lws-affiliation",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43962",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gutensee \u003c= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutensee",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54360",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Elementor \u003c= 1.36.20 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "ultimate-elementor",
    "type": "plugin",
    "affected_version": "* - 1.36.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.36.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-50890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50890",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LearnPress – WordPress LMS Plugin \u003c= 4.2.6.8 - Basic Information Disclosure via JSON API",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5483",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Database Toolset \u003c= 1.8.4 - Unauthenticated Arbitrary File Deletion",
    "slug": "database-toolset",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32633",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "PlainInventory – Inventory Management Plugin \u003c= 3.1.5 - Reflected Cross-Site Scripting",
    "slug": "z-inventory-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24557",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP TripAdvisor Review Slider \u003c= 12.6 - Authenticated (Administrator+) SQL Injection",
    "slug": "wp-tripadvisor-review-slider",
    "type": "plugin",
    "affected_version": "* - 12.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-35630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35630",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Contest Gallery \u003c= 21.2.8.4 - Cross-Site Request Forgery",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 21.2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "21.2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24887",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.2.3 - Unauthenticated Privilege Escalation",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-47868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47868",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPSchoolPress \u003c= 2.2.3 - Missing Authorization",
    "slug": "wpschoolpress",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37887",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Votecount For Balatarin \u003c= 0.1.1 - Reflected Cross-Site Scripting",
    "slug": "votecount-for-balatarin",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4572",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Piwik \u003c= 1.0.27 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Display Name",
    "slug": "wp-piwik",
    "type": "plugin",
    "affected_version": "* - 1.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33211",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mail Log \u003c= 1.1.2 - Authenticated (Contributor+) Arbitrary File Read",
    "slug": "wp-mail-log",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5672",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Gallery Custom Links \u003c= 2.2.5 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "gallery-custom-links",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60104",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Divi \u003c= 4.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "Divi",
    "type": "theme",
    "affected_version": "* - 4.20.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.20.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-29099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-29099",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Shortcodes Plugin — Shortcodes Ultimate \u003c= 5.0.0 - Authenticated Remote Code Execution",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "[*, 5.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-18580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18580",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.30",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.18",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.11",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.30",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.28",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.27",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.20",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.13",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.10",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.24",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.6",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.2",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.3",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.27",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.19",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.4 - Type Confusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.15",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-17675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17675",
    "auth_type": "Auth",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Booqable Rental Plugin \u003c= 2.4.15 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "booqable-rental-reservations",
    "type": "plugin",
    "affected_version": "* - 2.4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30746",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30746",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Simple Slideshow \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-simple-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26576",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Notes \u003c= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "user-notes",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60136",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Usersnap \u003c= 4.16 - Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "usersnap",
    "type": "plugin",
    "affected_version": "* - 4.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47607",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Terms Descriptions \u003c= 3.4.4 - Reflected Cross-Site Scripting via term_search",
    "slug": "terms-descriptions",
    "type": "plugin",
    "affected_version": "* - 3.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28779",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "StreamWeasels YouTube Integration \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "streamweasels-youtube-integration",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7811",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Breadcrumbs \u003c= 1.1.1 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "essential-breadcrumbs",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31038",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Foxiz \u003c= 2.3.5 - Unauthenticated Server-Side Request Forgery",
    "slug": "foxiz",
    "type": "theme",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37260",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "s2Member Pro \u003c= 241216 - Unauthenticated PHP Object Injection",
    "slug": "s2member-pro",
    "type": "plugin",
    "affected_version": "* - 241216",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "241216",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-12562",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12562",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.8.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3923",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Translate This - Google Translate Web Element Shortcode \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via base_lang Parameter",
    "slug": "translate-this-google-translate-web-element-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8719",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elite Notification – Sales Popup, Social Proof, FOMO \u0026 WooCommerce \u003c= 1.5 - Missing Authorization",
    "slug": "elite-notification",
    "type": "plugin",
    "affected_version": "1.5",
    "from_version": "1.5",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54241",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Amazon Link \u003c= 3.2.10 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "amazon-link",
    "type": "plugin",
    "affected_version": "* - 3.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1645",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Waiting: One-click countdowns \u003c= 0.6.2 - Missing Authorization",
    "slug": "waiting",
    "type": "plugin",
    "affected_version": "* - 0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3999",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Social Stickers \u003c= 2.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "social-stickers",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1418",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor \u003c= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2784",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 2.6.5 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2008-5278",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-5278",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PayTR Taksit Tablosu \u003c= 1.3.3 - Improper Authorization",
    "slug": "paytr-taksit-tablosu-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49853",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Realty Workstation \u003c= 1.0.45 - Authentication Bypass to Account Takeover",
    "slug": "realty-workstation",
    "type": "plugin",
    "affected_version": "* - 1.0.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.45",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50489",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bank Mellat \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "bank-mellat",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0643",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0643",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Addons \u003c= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0433",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "post highlights 2.0 - 2.6 - Cross-Site Scripting",
    "slug": "post-highlights",
    "type": "plugin",
    "affected_version": "2.0 - 2.6",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-8087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8087",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Profile Builder \u003c= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.10.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0324",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"
  },
  {
    "title": "404 Error Monitor \u003c= 1.1 - Cross-Site Request Forgery to Plugin Settings Update via updatePluginSettings Function",
    "slug": "404-error-monitor",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11118",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11118",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "reSmush.it Image Optimizer \u003c= 0.4.6 - Cross-Site Request Forgery",
    "slug": "resmushit-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 0.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2449",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2449",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "InPost Gallery \u003c= 2.1.4.3 - Cross-Site Request Forgery",
    "slug": "inpost-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26903",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GeoDirectory \u003c= 2.3.28 - Authenticated(Administrator+) SQL Injection",
    "slug": "geodirectory",
    "type": "plugin",
    "affected_version": "[*, 2.3.29)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.29",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-50845",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50845",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yoast SEO \u003c= 5.7.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "* - 5.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-16842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-16842",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Control Manager for WordPress by ItalyStrap \u003c= 2.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "advanced-control-manager",
    "type": "plugin",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50541",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Log \u003c= 2.4.7 - Reflected Cross-Site Scripting",
    "slug": "email-log",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24924",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor Page Builder Lite \u003c= 5.6.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43977",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Betheme \u003c= 26.6.2 - Missing Authorization Check on Core Functionality",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 26.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45356",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EventPrime \u003c= 3.0.5 - Reflected Cross-Site Scripting",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35884",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "URL-Preview-Box \u003c= 1.20 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "good-url-preview-box",
    "type": "plugin",
    "affected_version": "* - 1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25104",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0792",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "collectchat \u003c= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "collectchat",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30436",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ni WooCommerce Sales Report \u003c= 3.7.3 - Missing Authorization via ajax_sales_order",
    "slug": "ni-woocommerce-sales-report",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32299",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "FormBuilder \u003c= 1.05 - Reflected Cross-Site Scripting",
    "slug": "formbuilder",
    "type": "plugin",
    "affected_version": "* - 1.05",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.05",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10910",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10910",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Display Custom Post \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "display-custom-post",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48317",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elo Rating Shortcode \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elo-rating-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51678",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Crowdfunding \u003c= 2.1.6 - Reflected Cross-Site Scripting via postid",
    "slug": "wp-crowdfunding",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47532",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Naver Blog \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "naver-blog-api",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51639",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Linet ERP-Woocommerce Integration \u003c= 3.5.12 - Authenticated (Admin+) Arbitrary File Read \u0026 Deletion",
    "slug": "linet-erp-woocommerce-integration",
    "type": "plugin",
    "affected_version": "* - 3.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31411",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JSM file_get_contents() Shortcode \u003c= 2.7.0 - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode",
    "slug": "wp-file-get-contents",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6991",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder Pro – More than Just a Page Builder \u003c= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.25.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8494",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "agendapress",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51807",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShiftNav – Responsive Mobile Menu \u003c= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "shiftnav-responsive-mobile-menu",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4627",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CLUEVO LMS, E-Learning Platform \u003c= 1.13.2 - Reflected Cross-Site Scripting",
    "slug": "cluevo-lms",
    "type": "plugin",
    "affected_version": "* - 1.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11328",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdWork Media EZ Content Locker \u003c= 3.0 - Reflected Cross-Site Scripting",
    "slug": "adwork-media-ez-content-locker",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56025",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "amtyThumb \u003c= 4.2.0 - Authenticated SQL Injection",
    "slug": "amtythumb",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1683",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Announcement \u0026 Notification Banner Plugin – Bulletin \u003c= 3.8.5 - Authenticated (Administrator+) SQL Injection",
    "slug": "bulletin-announcements",
    "type": "plugin",
    "affected_version": "* - 3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-30478",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30478",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stars SMTP Mailer \u003c= 1.7 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "stars-smtp-mailer",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50530",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Relevanssi – A Better Search \u003c= 4.23.0 (Free) and \u003c= 2.26.0 (Premium) - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "relevanssi-premium",
    "type": "plugin",
    "affected_version": "* - 2.26.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.26.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9021",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Relevanssi – A Better Search \u003c= 4.23.0 (Free) and \u003c= 2.26.0 (Premium) - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "relevanssi",
    "type": "plugin",
    "affected_version": "* - 4.23.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.23.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9021",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WhyDoWork AdSense \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "whydowork-adsense",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-9100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9100",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Title Experiments Free \u003c= 9.0.0 - SQL Injection",
    "slug": "wp-experiments-free",
    "type": "plugin",
    "affected_version": "[*, 9.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2022-0784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0784",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Meteor Page Speed Optimization Topping \u003c= 3.1.4 - Cross-Site Request Forgery via processAjaxNoticeDismiss",
    "slug": "wp-meteor",
    "type": "plugin",
    "affected_version": "* - 3.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26543",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Namaste! LMS \u003c= 2.5.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "namaste-lms",
    "type": "plugin",
    "affected_version": "* - 2.5.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0548",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Customers Manager \u003c= 29.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "woocommerce-customers-manager",
    "type": "plugin",
    "affected_version": "* - 29.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "29.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-0399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0399",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Popup Builder \u003c= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 4.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2541",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Data Tables Generator by Supsystic \u003c= 1.9.91 - Cross-Site Request Forgery",
    "slug": "data-tables-generator-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.9.91",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.91",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-12076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12076",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SVG Uploads Support \u003c= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "svg-uploads-support",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7086",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7086",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Ultimate Post Grid \u003c= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcode",
    "slug": "wp-ultimate-post-grid",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4043",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Hashtags [#hashtagger] \u003c= 7.2.3 - Missing Authorization",
    "slug": "hashtagger",
    "type": "plugin",
    "affected_version": "* - 7.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46470",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Theme Builder For Elementor \u003c= 1.2.2 - Authenticated (Contributor+) Post Disclosure",
    "slug": "theme-builder-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10782",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "OneSignal Web Push Notifications \u003c=1.17.7 - Stored Cross-Site Scripting",
    "slug": "onesignal-free-web-push-notifications",
    "type": "plugin",
    "affected_version": "* - 1.17.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15827",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10146",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MakeCommerce for WooCommerce \u003c= 3.5.1 - Reflected Cross-Site Scripting",
    "slug": "makecommerce",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37509",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SCSS WP Editor \u003c= 1.1.8 - Cross-Site Request Forgery",
    "slug": "scss-wp-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31808",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post SMTP \u003c= 2.1.6 - Authenticated (Administrator+) Blind Server-Side Request Forgery",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2352",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Comment Date and Gravatar remover \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "remove-date-and-gravatar-under-comment",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28862",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28862",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HT Easy GA4 ( Google Analytics 4 ) \u003c= 1.0.6 - Cross-Site Request Forgery via plugin_activation",
    "slug": "ht-easy-google-analytics",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23802",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "connectDaily \u003c= 1.4.4 - Reflected Cross-Site Scripting",
    "slug": "connect-daily-web-calendar",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4320",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM WordPress Plugin – RepairBuddy \u003c= 3.8120 - Missing Authorization to Account Takeover/Privilege Escalation",
    "slug": "computer-repair-shop",
    "type": "plugin",
    "affected_version": "* - 3.8120",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8120",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12259",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Digihood HTML Sitemap \u003c= 3.1.1 - Reflected Cross-Site Scripting",
    "slug": "wedesin-html-sitemap",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31901",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logaster Logo Generator \u003c= 1.3 - Cross-Site Request Forgery to Arbitrary Media Deletion and Creation",
    "slug": "logaster-logo-generator",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47159",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WooSidebars \u003c= 1.4.1 - Reflected Cross-Site Scripting",
    "slug": "woosidebars",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-10114",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10114",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.8.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9049",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prevent Landscape Rotation \u003c= 2.0 - Cross-Site Request Forgery via adminpage.php",
    "slug": "prevent-landscape-rotation",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48772",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48772",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "ShiftThis (Unspecified Version) - SQL Injection",
    "slug": "st_newsletter",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2008-0683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-0683",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "mTouch Quiz \u003c= 3.1.2 - Reflected Cross-Site Scripting",
    "slug": "mtouch-quiz",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9386",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Media Engine \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "social-media-engine",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22749",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile Themes \u003c= 1.1.1 - Cross-Site Request Forgery",
    "slug": "wp-mobile-themes",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28881",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Posts to Page \u003c= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "posts-to-page",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52195",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Menu \u003c= 1.2.1 - Cross-Site Request Forgery via plugin_activation",
    "slug": "ht-menu-lite",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23791",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Protect WP Admin \u003c= 3.6 - Unauthenticated Plugin Deactivation",
    "slug": "protect-wp-admin",
    "type": "plugin",
    "affected_version": "* - 3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24906",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "codeSnips \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "codesnips",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51808",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Under Construction \u003c= 3.96 - Cross-Site Request Forgery via admin_action_ucp_dismiss_notice",
    "slug": "under-construction-page",
    "type": "plugin",
    "affected_version": "* - 3.96",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.96",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0831",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Meetup \u003c= 0.1 - Authentication Bypass via Account Takeover",
    "slug": "meetup",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50483",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Grid and Gutenberg Blocks – ComboBlocks \u003c= 2.3.5 - Unauthenticated Paid Order Creation",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13798",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "2D Tag Cloud \u003c= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parameter",
    "slug": "2d-tag-cloud-widget-by-sujin",
    "type": "plugin",
    "affected_version": "* - 6.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9670",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Korea SNS \u003c= 1.6.4 - Cross-Site Request Forgery via kon_tergos_options",
    "slug": "korea-sns",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47670",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Transposh WordPress Translation \u003c= 1.0.7 -  Unauthenticated Stored Cross-Site Scripting via 'tp_translation'",
    "slug": "transposh-translation-filter-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24911",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Rate My Post – Star Rating Plugin by FeedbackWP \u003c= 4.2.4 - Unauthenticated Voting On Scheduled Posts",
    "slug": "rate-my-post",
    "type": "plugin",
    "affected_version": "* - 4.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12309",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2484",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Additional Fees On Checkout (Free) \u003c= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "woo-additional-fees-on-checkout-wordpress",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57903",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57903",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Learning Courses \u003c 5.0 - Authenticated Cross-Site Scripting",
    "slug": "nd-learning",
    "type": "plugin",
    "affected_version": "[*, 5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24707",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Profile Builder \u003c= 3.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24448",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Showcase \u003c 25.05.13 - Reflected Cross-Site Scripting",
    "slug": "team-showcase-cm",
    "type": "plugin",
    "affected_version": "[*, 25.05.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "25.05.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2025-49247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49247",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra \u003c= 2.6.6 - Missing Authorization",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36676",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Services updates for customers \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "service-updates-for-customers",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56034",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid  \u003c= 5.7.8 - Authenticated (Subscriber+) SQL Injection",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-30491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30491",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "AdForest \u003c= 5.1.6 - Authentication Bypass",
    "slug": "adforest",
    "type": "theme",
    "affected_version": "* - 5.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11349",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Meta Slider and Carousel with Lightbox \u003c= 1.6.2 - Cross-Site Request Forgery",
    "slug": "meta-slider-and-carousel-with-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25703",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Build App Online \u003c= 1.0.23 - Unauthenticated Local File Inclusion",
    "slug": "build-app-online",
    "type": "plugin",
    "affected_version": "* - 1.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.23",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32577",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Themify Store Locator \u003c= 1.1.9 - Cross-Site Request Forgery",
    "slug": "themify-store-locator",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12414",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ps Ads Pro \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "ps-ads-pro",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23738",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anonymize Links \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "anonymize-links",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23702",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Common Ninja: Fully Customizable \u0026 Perfectly Responsive Free Widgets for WordPress Websites \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "common-ninja",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11382",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.5 - Cross-Site Request Forgery to Account Logout",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2416",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Fonts Manager | Custom Fonts \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "fonts-manager-custom-fonts",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31578",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tripetto \u003c= 8.0.6 - Unauthentiated Stored Cross-Site Scripting via Form File Upload",
    "slug": "tripetto",
    "type": "plugin",
    "affected_version": "* - 8.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10260",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Event Tickets, RSVPs, Calendar \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ticket-spot",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9875",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shop \u003c= 3.9.6 - Missing Authentication to Settings Change and Order Deletion",
    "slug": "wp-shop-original",
    "type": "plugin",
    "affected_version": "* - 3.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-36793",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36793",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SVG Block \u003c= 1.1.19 - Authenticated (Author+) Stored Cross-Site Scripting via SVG",
    "slug": "svg-block",
    "type": "plugin",
    "affected_version": "* - 1.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4269",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Time Validation for Gravity Forms \u003c= 1.7.0 - Unauthenticated Local File Inclusion",
    "slug": "real-time-validation-for-gravity-forms",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48330",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product list Widget for Woocommerce \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "gm-woo-product-list-widget",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4329",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Weaver Xtreme Theme Support \u003c= 6.3.0 - Authenticated (Administrator+) PHP Object Injection via Imported File",
    "slug": "weaverx-theme-support",
    "type": "plugin",
    "affected_version": "* - 6.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4971",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cost Calculator Builder \u003c= 3.2.15 - Unauthenticated SQL Injection",
    "slug": "cost-calculator-builder",
    "type": "plugin",
    "affected_version": "* - 3.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43144",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "BuddyBoss Theme \u003c= 2.4.61 - Cross-Site Request Forgery",
    "slug": "buddyboss-theme",
    "type": "theme",
    "affected_version": "* - 2.4.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37925",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Activity Log \u003c= 1.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "user-activity-log",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31356",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "LWS SMS \u003c= 2.4.1 - Cross-Site Request Forgery",
    "slug": "lws-sms",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31457",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Genesis Blocks \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "genesis-blocks",
    "type": "plugin",
    "affected_version": "* - 3.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3901",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jannah \u003c= 7.4.1 - Unauthenticated Local File Inclusion",
    "slug": "jannah",
    "type": "theme",
    "affected_version": "* - 7.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53334",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy WP Optimizer \u003c= 1.1.0 - Missing Authorization",
    "slug": "easy-wp-optimizer",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32147",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32147",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.13",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.13",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.10",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.6",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.5",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.4",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.1",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.16",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.16",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.14",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-5488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5488",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NertWorks All in One Social Share Tools \u003c= 1.26 - Cross-Site Request Forgery",
    "slug": "nertworks-all-in-one-social-share-tools",
    "type": "plugin",
    "affected_version": "* - 1.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31447",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.44.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.44.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6464",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WCFM Marketplace \u003c= 3.4.11 - Missing Authorization",
    "slug": "wc-multivendor-marketplace",
    "type": "plugin",
    "affected_version": "* - 3.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4935",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PixCodes \u003c= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "pixcodes",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4671",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Elementor Addons \u003c= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9045",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP RSS Aggregator \u003c= 4.23.5 - Authenticated (Admin+) Server-Side Request Forgery via RSS Feed Source",
    "slug": "wp-rss-aggregator",
    "type": "plugin",
    "affected_version": "4.23.5",
    "from_version": "4.23.5",
    "from_inclusive": true,
    "to_version": "4.23.5",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-0628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0628",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.12.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1392",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetBlocks For Elementor \u003c= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2084",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aria Font \u003c= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "aria-font",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32488",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easily Generate Rest API Url \u003c= 1.0.0 - Stored Cross-Site Scripting",
    "slug": "easily-generate-rest-api-url",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1338",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PPWP – Password Protect Pages \u003c= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "password-protect-page",
    "type": "plugin",
    "affected_version": "* - 1.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11280",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Envolve Plugin \u003c= 1.0 - Unauthenticated Language File Deletion",
    "slug": "envolve-plugin",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11615",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11615",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Responsive Food and Drink Menu \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus Shortcode",
    "slug": "responsive-food-and-drink-menu",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6378",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bus Ticket Booking with Seat Reservation \u003c= 5.4.3 - Cross-Site Request Forgery",
    "slug": "bus-ticket-booking-with-seat-reservation",
    "type": "plugin",
    "affected_version": "* - 5.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49294",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Video PopUp \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "video-popup",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4962",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The School Management – Education \u0026 Learning Management \u003c= 4.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "school-management-system",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47430",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lunar \u003c= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "lunar-sell-photos-online",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28936",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zarinpal Paid Download \u003c= 2.3 - Reflected Cross-Site Scripting",
    "slug": "zarinpal-paid-downloads",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22766",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AllInOne - Banner Rotator \u003c= 3.8 - Authenticated (Contributor+) SQL Injection",
    "slug": "all-in-one-bannerRotator",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60110",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WIP WooCarousel Lite \u003c= 1.1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wip-woocarousel-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30769",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Change Monitor \u003c= 1.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "seo-change-monitor",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-33209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33209",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Education Center | LMS \u0026 Online Courses WordPress Theme \u003c= 3.6.10 - PHP Object Injection",
    "slug": "education",
    "type": "theme",
    "affected_version": "* - 3.6.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13786",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popularis Verse \u003c= 1.0.1 - Cross-Site Request Forgery",
    "slug": "popularis-verse",
    "type": "theme",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38763",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paytm Payment Gateway \u003c= 2.7.0 - Unauthenticated Server-Side Request Forgery",
    "slug": "paytm-payments",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45362",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OnionBuzz Plugin \u003c 1.2.7 - SQL Injection",
    "slug": "onionbuzz-viral-quiz",
    "type": "plugin",
    "affected_version": "[*, 1.2.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-14230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14230",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Buy one click WooCommerce \u003c= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import",
    "slug": "buy-one-click-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10854",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CBX Bookmark \u0026 Favorite \u003c= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cbxwpbookmark",
    "type": "plugin",
    "affected_version": "* - 1.7.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51514",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xpro Theme Builder \u003c= 1.2.8.4 - Missing Authorization",
    "slug": "xpro-theme-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32201",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Comment Validation Reloaded \u003c=  0.5 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "comment-validation-reloaded",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31026",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icons Enricher \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "icons-enricher",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22573",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.4",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.1",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.23",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.21",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.21",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.14",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.13",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.12",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.9",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.24",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.24",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.18",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.1 - Cross-domain Flash injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.8",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-9263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-9263",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Hour Booking \u003c= 1.3.16 - Cross-Site Scripting",
    "slug": "appointment-hour-booking",
    "type": "plugin",
    "affected_version": "[*, 1.3.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24712",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24712",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPMU Ldap Authentication \u003c= 5.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wpmuldap",
    "type": "plugin",
    "affected_version": "* - 5.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48343",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple CSV/XLS Exporter \u003c= 1.5.8 - CSV Injection",
    "slug": "simple-csv-xls-exporter",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-42882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42882",
    "auth_type": "Privileged",
    "cvss_score": 5.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Seriously Simple Podcasting \u003c= 3.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "seriously-simple-podcasting",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3751",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 9.4.2 - PostMessage-Based Cross-Site Scripting",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "* - 9.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5062",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 9.4.2 - PostMessage-Based Cross-Site Scripting",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "9.4 - 9.4.2",
    "from_version": "9.4",
    "from_inclusive": true,
    "to_version": "9.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5062",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPRecovery \u003c= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion",
    "slug": "wprecovery",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-10726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10726",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Impreza \u003c= 8.17.4 - Reflected Cross-Site Scripting",
    "slug": "impreza",
    "type": "plugin",
    "affected_version": "* - 8.17.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.17.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50893",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Twitter Feeds (Tweets Widget) \u003c= 1.8.4 - Cross-Site Request Forgery",
    "slug": "custom-twitter-feeds",
    "type": "plugin",
    "affected_version": "[*, 2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-33974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33974",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CoverManager \u003c= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "covermanager",
    "type": "plugin",
    "affected_version": "* - 0.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31620",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eazy Plugin Manager \u003c= 4.1.2 - Missing Authorization via update_options",
    "slug": "plugins-on-steroids",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51482",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Add Customer for WooCommerce \u003c= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "add-customer-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24841",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pin WP \u003c 7.2 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "pin-wp",
    "type": "theme",
    "affected_version": "[*, 7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-53251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53251",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "El mejor Cluster \u003c= 1.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mejorcluster",
    "type": "plugin",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49232",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ERP \u003c= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.12.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0913",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PostmagThemes Demo Import \u003c= 1.0.7 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "postmagthemes-demo-import",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1540",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slimstat Analytics \u003c= 4.9.3.2 - Authenticated (Subscriber+) SQL Injection via Shortcode",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "* - 4.9.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0630",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Aklamator INfeed \u003c= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "aklamator-infeed",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12717",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3985",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TableOn – WordPress Posts Table Filterable \u003c= 1.0.4 - Unauthenticated PHP Object Injection",
    "slug": "posts-table-filterable",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32569",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin \u003c= 2.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "eazydocs",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3999",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Checker \u003c= 1.11.8 - Reflected Cross-Site Scripting",
    "slug": "broken-link-checker",
    "type": "plugin",
    "affected_version": "[*, 1.11.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16521",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Project Manager \u003c= 2.6.16 - Authenticated (Project Manager+) SQL Injection",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12015",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12015",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Sponsors \u003c= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-sponsors",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30483",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eHive Objects Image Grid \u003c= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ehive-objects-image-grid",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13662",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YaMaps for WordPress \u003c= 0.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yamaps",
    "type": "plugin",
    "affected_version": "* - 0.6.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43224",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GTmetrix for WordPress \u003c= 0.4.7 - Cross-Site Request Forgery",
    "slug": "gtmetrix-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 0.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37996",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iBryl Switch User \u003c= 1.0.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover",
    "slug": "ibryl-switch-user",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49675",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \u003c= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.6.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2341",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Secure CAPTCHA \u003c= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "secure-captcha",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23693",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KeyCAPTCHA \u003c= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "keycaptcha",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32619",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32619",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Events Manager – Calendar, Bookings, Tickets, and more! \u003c= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.4.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3492",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fusion Lite \u003c= 3.41.24 - Authenticated (Contributor+) Remote Code Execution",
    "slug": "wp-fusion-lite",
    "type": "plugin",
    "affected_version": "* - 3.41.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.41.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-27972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27972",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Annual Archive \u003c= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "anual-archive",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49847",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmailShroud \u003c= 2.2.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "emailshroud",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23456",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.40",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1296",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1296",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Patreon WordPress \u003c= 1.7.0 - Reflected Cross-Site Scripting",
    "slug": "patreon-connect",
    "type": "plugin",
    "affected_version": "[*, 1.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24228",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "File Manager Pro – Filester \u003c= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion",
    "slug": "filester",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9669",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fonts \u003c= 3.7.7 - Cross-Site Request Forgery",
    "slug": "olympus-google-fonts",
    "type": "plugin",
    "affected_version": "* - 3.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43301",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid Combo – 36+ Gutenberg Blocks \u003c= 2.2.64 - Authenticated (Contributor+) Cross-Site Scripting",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.64",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.64",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6645",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.3.18.727 - SQL Injection",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.3.18.727",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.18.727",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2019-13573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-13573",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Photo Album Plus \u003c= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 8.7.00.003",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.7.00.003",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4037",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4037",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Share This Image \u003c= 2.01 - Reflected Cross-Site Scripting",
    "slug": "share-this-image",
    "type": "plugin",
    "affected_version": "* - 2.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47326",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47326",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OSMapper \u003c= 2.1.5 - Unauthenticated Arbitrary Post Deletion",
    "slug": "osmapper",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24978",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 5.5.1 - Multiple Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-7477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7477",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tiki Time \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "tiki-time",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23986",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks \u003c= 4.0.6 - Missing Authorization via get",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2084",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form Maker \u003c= 1.13.23 - Authenticated (Administrator+) SQL Injection",
    "slug": "contact-form-maker",
    "type": "plugin",
    "affected_version": "* - 1.13.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2655",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Travel Engine \u003c= 5.8.0 - Unauthenticated Price Manipulation",
    "slug": "wp-travel-engine",
    "type": "plugin",
    "affected_version": "* - 5.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32798",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Canva – Design beautiful blog graphics \u003c= 1.2.4 - Reflected Cross-Site Scripting",
    "slug": "canva",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32545",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Total Contest Lite \u003c= 2.8.1 - Reflected Cross-Site Scripting",
    "slug": "totalcontest-lite",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13822",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS – eLearning and online course solution \u003c= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "* - 2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1502",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Vampire Character Manager \u003c= 2.13 - Reflected Cross-Site Scripting",
    "slug": "vampire-character",
    "type": "plugin",
    "affected_version": "* - 2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23465",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cryptocurrency Widgets – Price Ticker \u0026 Coins List 2.0 - 2.6.5 - Unauthenticated SQL Injection",
    "slug": "cryptocurrency-price-ticker-widget",
    "type": "plugin",
    "affected_version": "2.0 - 2.6.5",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-0709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0709",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "flowpaper \u003c= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "flowpaper-lite-pdf-flipbook",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40197",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40197",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Picture / Portfolio / Media Gallery \u003c= 3.0.1 - Unauthenticated Server-Side Request Forgery",
    "slug": "nimble-portfolio",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5021",
    "auth_type": "Unauth",
    "cvss_score": 9.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Seriously Simple Podcasting \u003c= 2.25.3 - Unauthenticated Email Disclosure",
    "slug": "seriously-simple-podcasting",
    "type": "plugin",
    "affected_version": "* - 2.25.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.25.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6444",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP PHPList \u003c= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "phplist-form-integration",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26572",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Display Products by Tags \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woocommerce-display-products-by-tags",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27331",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GP Back To Top \u003c= 3.0 - Cross-Site Request Forgery",
    "slug": "gp-back-to-top",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30521",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.29.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.29.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50555",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "* - 3.29.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.29.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50555",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Testimonials \u003c= 2.5.11 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode",
    "slug": "testimonial-free",
    "type": "plugin",
    "affected_version": "* - 2.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4648",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ActivityPub \u003c= 0.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Metadata",
    "slug": "activitypub",
    "type": "plugin",
    "affected_version": "* - 0.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.17.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5057",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stream \u003c= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update",
    "slug": "stream",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7423",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Search \u0026 Filter \u003c= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "search-filter",
    "type": "plugin",
    "affected_version": "* - 1.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4467",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Likes and Dislikes Plugin \u003c= 1.0.0 - Unauthenticated SQL Injection",
    "slug": "inprosysmedia-likes-dislikes-post",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4840",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Contact Slider \u003c= 2.4.6 - Stored Cross-Site Scripting",
    "slug": "wp-contact-slider",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1301",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SSL Wireless SMS Notification \u003c= 3.5.0 - Unauthenticated SQL Injection",
    "slug": "ssl-wireless-sms-notification",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-56284",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56284",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Gallery Lightbox \u003c= 1.0.0.41 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gallery-lightbox-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.0.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57966",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57966",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WoW Guild Armory Roster \u003c= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "guild-armory-roster",
    "type": "plugin",
    "affected_version": "* - 0.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51850",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBakery Page Builder \u003c= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 8.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4968",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit Form Pro \u003c= 2.6.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update",
    "slug": "bitformpro",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43250",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Location Manager \u003c 2.1.0.10 - SQL Injection",
    "slug": "geodir_location_manager",
    "type": "plugin",
    "affected_version": "[*, 2.1.0.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0.10",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24361",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mini Program API \u003c= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-mini-program",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11380",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bulgarisation for WooCommerce \u003c= 3.0.14 - Missing Authorization",
    "slug": "bulgarisation-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0683",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WordPress File Sharing Plugin \u003c= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "user-private-files",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4636",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooHoo Newspaper Magazine Theme \u003c= 2.5.3 - Cross-Site Request Forgery to Settings Update",
    "slug": "woohoo",
    "type": "theme",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4824",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate GDPR \u0026 CCPA \u003c= 2.4 - Unauthenticated Settings Import \u0026 Export",
    "slug": "ct-ultimate-gdpr",
    "type": "plugin",
    "affected_version": "[*, 2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4348",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.9.2 - Authenticated SQL Injection",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12276",
    "auth_type": "Auth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) \u003c= 4.9.54 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file'",
    "slug": "uni-woo-custom-product-options-premium",
    "type": "plugin",
    "affected_version": "* - 4.9.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.54",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-10412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10412",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Burst Statistics – Privacy-Friendly Analytics for WordPress 1.4.0 to 1.4.6.1 - Unauthenticated SQL Injection",
    "slug": "burst-statistics",
    "type": "plugin",
    "affected_version": "1.4.0 - 1.4.6.1",
    "from_version": "1.4.0",
    "from_inclusive": true,
    "to_version": "1.4.6.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5761",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Burst Statistics – Privacy-Friendly Analytics for WordPress 1.4.0 to 1.4.6.1 - Unauthenticated SQL Injection",
    "slug": "burst-pro",
    "type": "plugin",
    "affected_version": "1.4.0 - 1.5.0",
    "from_version": "1.4.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-5761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5761",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "System Dashboard \u003c= 2.8.14 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "system-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.8.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11107",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Package \u003c= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter",
    "slug": "booking-package",
    "type": "plugin",
    "affected_version": "* - 1.6.72",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.72",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13508",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13508",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Forms by Cimatti \u003c= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30549",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themesflat Addons For Elementor \u003c= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themesflat-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31567",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Upcoming Events Lists \u003c= 1.4.0 - Authenticated (Subscriber+) Insecure Direct Object Reference",
    "slug": "upcoming-events-lists",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57994",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Fontific | Google Fonts \u003c= 0.1.6 - Cross-Site Request Forgery via ajax_fontific_save_all",
    "slug": "fontific",
    "type": "plugin",
    "affected_version": "* - 0.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-27194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27194",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N"
  },
  {
    "title": "WPLMS \u003c 1.9.9.5.2 - Authenticated (Contributor+) Arbitrary Directory Deletion",
    "slug": "wplms",
    "type": "theme",
    "affected_version": "[*, 1.9.9.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2024-56055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56055",
    "auth_type": "Auth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Starter Templates by FancyWP \u003c= 2.0.0 - Cross-Site Request Forgery to Arbitrary Plugin Installation",
    "slug": "starter-templates",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25106",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WP Reset \u003c= 2.02 - Missing Authorization to License Key Modification",
    "slug": "wp-reset",
    "type": "plugin",
    "affected_version": "* - 2.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4661",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BMI Adult \u0026 Kid Calculator \u003c= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bmi-adultkid-calculator",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53469",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53469",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Dropshipping \u003c= 5.0.4 - Missing Authorization to Unauthenticated Arbitrary Email Send",
    "slug": "woocommerce-dropshipping",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35748",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Default Thumbnail Plus \u003c= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Upload",
    "slug": "default-thumbnail-plus",
    "type": "plugin",
    "affected_version": "* - 1.0.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6161",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6161",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cookie Notice \u0026 Compliance for GDPR / CCPA \u003c= 2.4.17.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cookie-notice",
    "type": "plugin",
    "affected_version": "* - 2.4.17.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.17.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3399",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cost Calculator \u003c= 1.5 - Contributor+ Stored Cross-Site Scripting",
    "slug": "nd-projects",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24821",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chop Slider 3 \u003c= 3.4 - Unauthenticated SQL Injection",
    "slug": "chopslider",
    "type": "plugin",
    "affected_version": "* - 3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-11530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-11530",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Seraphinite Accelerator \u003c= 2.27.21 - Cross-Site Request Forgery to Multiple Administrative Actions",
    "slug": "seraphinite-accelerator",
    "type": "plugin",
    "affected_version": "* - 2.27.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.27.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6059",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-UserOnline \u003c= 2.87.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-useronline",
    "type": "plugin",
    "affected_version": "* - 2.87.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.87.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2473",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2473",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Biographia \u003c= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-biographia",
    "type": "plugin",
    "affected_version": "* - 4.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30928",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HTML5 Maps \u003c= 1.6.5.6 - Cross-Site Request Forgery",
    "slug": "html5-maps",
    "type": "plugin",
    "affected_version": "* - 1.6.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-5983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-5983",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ShipWorks Connector for Woocommerce \u003c= 5.2.5 - Cross-Site Request Forgery to Service Password/Username Update",
    "slug": "shipworks-e-commerce-bridge",
    "type": "plugin",
    "affected_version": "* - 5.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13317",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BerqWP \u003c= 1.7.5 - Unauthenticated Server-Side Request Forgery",
    "slug": "searchpro",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37942",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "COVID-19 (Coronavirus) Update Your Customers \u003c= 1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "covid-19-alert",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46523",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Sharing Plugin – Sassy Social Share \u003c= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "sassy-social-share",
    "type": "plugin",
    "affected_version": "* - 3.3.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1989",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Top Comments \u003c= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "top-comments",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12874",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12874",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26775",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CG Scroll To Top \u003c= 3.5 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "cg-scroll-to-top",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31399",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "price-calc \u003c= 0.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "price-calc",
    "type": "plugin",
    "affected_version": "* - 0.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28891",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Auto scroll for reading \u003c= 1.1.4 - Reflected Cross-Site Scripting",
    "slug": "auto-scroll-for-reading",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31594",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Transliteration \u003c= 1.7.2 - Reflected Cross-Site Scripting",
    "slug": "google-transliteration",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23493",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Encrypted Contact Form \u003c 1.1 - Cross-Site Scripting",
    "slug": "encrypted-contact-form",
    "type": "plugin",
    "affected_version": "[*, 1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-4010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4010",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arigato Autoresponder and Newsletter \u003c= 2.7.2.3 - Cross-Site Request Forgery",
    "slug": "bft-autoresponder",
    "type": "plugin",
    "affected_version": "* - 2.7.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34823",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Euro FxRef Currency Converter \u003c= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via currency Shortcode",
    "slug": "euro-fxref-currency-converter",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6257",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel – Ultimate Travel Booking System, Tour Management Engine \u003c= 10.0.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-travel",
    "type": "plugin",
    "affected_version": "* - 10.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12067",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Uncode Core \u003c= 2.9.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "uncode-core",
    "type": "plugin",
    "affected_version": "* - 2.9.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6944",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontpage category filter \u003c= 1.0.2 - Cross-Site Request Forgery",
    "slug": "frontpage-category-filter",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28867",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "THE Leads Management System: 59sec LITE \u003c= 3.4.1 - Authorization Bypass",
    "slug": "59sec-lite-contact-form-7-push-notifications-on-ios-and-android",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-35242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-35242",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Getwid – Gutenberg Blocks \u003c= 1.8.3 - Authenticated(Subscriber+) Server Side Request Forgery",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 1.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1895",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "The Ultimate WordPress Toolkit – WP Extended \u003c= 3.0.8 - Missing Authorization to Admin Username Change",
    "slug": "wpextended",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8121",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Team Showcase \u003c= 1.22.25 - Reflected Cross-Site Scripting",
    "slug": "team",
    "type": "plugin",
    "affected_version": "* - 1.22.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.22.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44002",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share Buttons by Supsystic \u003c= 2.2.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "social-share-buttons-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-33960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33960",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CSS3 Compare Pricing Tables for WordPress \u003c= 11.5 - Missing Authorization",
    "slug": "css3_web_pricing_tables_grids",
    "type": "plugin",
    "affected_version": "* - 11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47556",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Peadig's Like \u0026 Share Button \u003c= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "facebook-like-send-button",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25783",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BP Social Connect \u003c= 1.5 - Authentication Bypass",
    "slug": "bp-social-connect",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-2704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2704",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Video Embedder \u003c= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-video-embedder",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44590",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Timeline Lite \u003c= 1.1.9 - Missing Authorization to Admin Notice Dismissal",
    "slug": "bold-timeline-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45110",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45110",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BuddyBoss Platform \u003c 2.7.60 - Insecure Direct Object Reference to Private Post Comment Exposure",
    "slug": "buddyboss-platform",
    "type": "plugin",
    "affected_version": "[*, 2.7.60)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.60",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2024-12767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12767",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Better Messages \u003c= 1.9.10.68 - Authorization Bypass to Blocking Control Bypass",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "* - 1.9.10.68",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10.68",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40216",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder – WordPress Page Builder \u003c= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.8.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9505",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates \u003c= 1.6.4 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "responsive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13353",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Web Directory Free \u003c= 1.7.3 - Reflected Cross-Site Scripting",
    "slug": "web-directory-free",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47379",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGlobus – Multilingual Everything! \u003c= 1.9.6 - Cross-Site Scripting via wpglobus_option[post_type][page]",
    "slug": "wpglobus",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5362",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.5",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.25",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.22",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.19",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.13",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.4",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.25",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.23",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.22",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.15",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.14",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.10",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.9.5 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.9",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-10100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-10100",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPres 同步微博 \u003c= 1.1.0 - Cross-Site Request Forgery",
    "slug": "wp2wb",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30555",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CM On Demand Search And Replace \u003c= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cm-on-demand-search-and-replace",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54727",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View Widget",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6627",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "rajce \u003c= 0.4.2 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "rajce",
    "type": "plugin",
    "affected_version": "* - 0.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48364",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MicroPayments \u003c= 3.2.3 - Reflected Cross-Site Scripting",
    "slug": "paid-membership",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26579",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amelia \u003c= 1.0.46 - Reflected Cross-Site Scripting",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.0.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0627",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visualizer: Tables and Charts Manager for WordPress \u003c= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2256",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AWStats Script \u003c= 0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "awstats-script",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49890",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complianz - GDPR/CCPA Cookie Consent \u003c= 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1069",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complianz - GDPR/CCPA Cookie Consent \u003c= 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "complianz-gdpr-premium",
    "type": "plugin",
    "affected_version": "* - 6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1069",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happyforms \u003c= 1.25.9 - Reflected Cross-Site Scripting",
    "slug": "happyforms",
    "type": "plugin",
    "affected_version": "* - 1.25.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48752",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Pipes \u003c= 1.4.3 - Reflected Cross-Site Scripting",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28977",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spectra – WordPress Gutenberg Blocks \u003c= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "ultimate-addons-for-gutenberg",
    "type": "plugin",
    "affected_version": "* - 2.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4366",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appsplate \u003c= 2.1.3 - Unauthenticated SQL Injection",
    "slug": "appsplate",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54292",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54292",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Awesome Support \u003c= 6.0.7 - Authenticated Stored Cross-Site Scripting",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38073",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form to Chat App \u003c= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "form-to-chat",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31258",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ULike \u003c= 4.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-ulike",
    "type": "plugin",
    "affected_version": "* - 4.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22738",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Thumbnail Slider With Lightbox \u003c= 1.0 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "wp-responsive-slider-with-lightbox",
    "type": "plugin",
    "affected_version": "1.0",
    "from_version": "1.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-5820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5820",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "fioxen",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "boliin",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "paroti",
    "type": "theme",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "lestin",
    "type": "theme",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "conult",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "constix",
    "type": "theme",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "sominx",
    "type": "theme",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "halpes",
    "type": "theme",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "modins",
    "type": "theme",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "welowe",
    "type": "theme",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "qizon",
    "type": "theme",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "fude",
    "type": "theme",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "aports",
    "type": "theme",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "gowilds",
    "type": "theme",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "qempo",
    "type": "theme",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "pisole",
    "type": "theme",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "orgarium",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "tevily",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by gavias \u003c= Various Versions - Reflected Cross-Site Scripting",
    "slug": "zilom",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43334",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ideal Interactive Map \u003c= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ideal-interactive-map",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52189",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiLoca - WooCommerce Multi Locations Inventory Management \u003c= 4.1.11 - Authenticated (Subscriber+) SQL Injection",
    "slug": "WooCommerce-Multi-Locations-Inventory-Management",
    "type": "plugin",
    "affected_version": "* - 4.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13341",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Crafthemes Demo Import \u003c= 3.3 - Missing Authorization to Arbitrary Plugin Installation",
    "slug": "crafthemes-demo-import",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-34800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34800",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DZS Video Gallery \u003c 7.95 - Reflected Cross-Site Scripting",
    "slug": "dzs-videogallery",
    "type": "plugin",
    "affected_version": "[*, 7.95)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.95",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-3923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-3923",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.107 - Unauthenticated PHP Object Injection",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.107",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.107",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10962",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive \u003c= 5.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive",
    "type": "theme",
    "affected_version": "* - 5.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35654",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapPress Maps \u003c= 2.73.3 - Reflected Cross-Site Scripting",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "[*, 2.73.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.73.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0208",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blog2Social: Social Media Auto Post \u0026 Scheduler \u003c= 7.4.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "* - 7.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-3549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3549",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Custom Post Carousels with Owl \u003c= 1.4.6 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "dd-post-carousel",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51493",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MyCurator Content Curation \u003c= 3.76 - Reflected Cross-Site Scripting",
    "slug": "mycurator",
    "type": "plugin",
    "affected_version": "* - 3.76",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.76",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29139",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Testimonials Showcase  \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "simple-testimonials-showcase",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32530",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eStore \u003c= 8.5.4 - Reflected Cross-Site Scripting via Discount Editing",
    "slug": "wp-cart-for-digital-products",
    "type": "plugin",
    "affected_version": "* - 8.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6073",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "pdf.js \u003c 2.0.943 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "algori-pdf-viewer",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5158",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-media-category-management",
    "type": "plugin",
    "affected_version": "2.0 - 2.3.3",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0865",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Redirection for Contact Form 7 \u003c= 2.4.0 - Reflected Cross-Site Scripting",
    "slug": "wpcf7-redirect",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0250",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Visual Sitemap \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-visual-sitemap",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53290",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "prdctfltr",
    "type": "plugin",
    "affected_version": "[*, 8.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "improved-sale-badges",
    "type": "plugin",
    "affected_version": "[*, 4.4.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "xforwoocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "woocommerce-frontend-shop-manager",
    "type": "plugin",
    "affected_version": "[*, 4.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "woocommerce-warranties-and-returns",
    "type": "plugin",
    "affected_version": "[*, 5.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "price-commander-xforwc",
    "type": "plugin",
    "affected_version": "[*, 1.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "improved-variable-product-attributes",
    "type": "plugin",
    "affected_version": "[*, 5.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "spam-control-xforwc",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "package-quantity-xforwc",
    "type": "plugin",
    "affected_version": "[*, 1.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "share-print-pdf-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.8.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "bulk-add-to-cart-xforwc",
    "type": "plugin",
    "affected_version": "[*, 1.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "live-search-xforwc",
    "type": "plugin",
    "affected_version": "[*, 2.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "floating-cart-xforwc",
    "type": "plugin",
    "affected_version": "[*, 1.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "add-tabs-xforwc",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "product-loops",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization",
    "slug": "seo-for-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Woocommerce Email Report \u003c= 2.4 - Unauthenticated Cross-Site Scripting",
    "slug": "wooemailreport",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27627",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Flipbooks \u003c= 1.0 - Missing Authorization",
    "slug": "responsive-flipbooks",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24776",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Voting \u003c= 1.8 - Reflected Cross-Site Scripting",
    "slug": "wp-voting",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49057",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49057",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Composer \u003c= 26.0 - Multiple Cross-Site Scripting",
    "slug": "visualcomposer",
    "type": "plugin",
    "affected_version": "* - 26.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "26.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36722",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mmm Simple File List \u003c= 2.3 - Authenticated (Subscriber+) Directory Traversal",
    "slug": "mmm-file-list",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4297",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Balkon \u003c= 1.3.2 - Reflected Cross-Site Scripting",
    "slug": "balkon",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36502",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout \u003c= 1.1.5 - Reflected Cross-Site Scripting",
    "slug": "support-x",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24558",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Anti-Malware Security and Brute-Force Firewall \u003c= 4.21.74 - Reflected Cross-Site Scripting",
    "slug": "gotmls",
    "type": "plugin",
    "affected_version": "* - 4.21.74",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21.74",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2599",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MW WP Form \u003c= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion",
    "slug": "mw-wp-form",
    "type": "plugin",
    "affected_version": "* - 5.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6559",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Simple File List \u003c= 6.1.9 - Unauthenticated Arbitrary File Deletion",
    "slug": "simple-file-list",
    "type": "plugin",
    "affected_version": "* - 6.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-44227",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44227",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "OSS Upload \u003c= 4.8.9 - Cross-Site Request Forgery",
    "slug": "oss-upload",
    "type": "plugin",
    "affected_version": "* - 4.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30598",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Images to WebP \u003c= 1.8 - Local File Inclusion",
    "slug": "images-to-webp",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24644",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24644",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Magical Posts Display – Elementor \u0026 Gutenberg Posts Blocks \u003c= 1.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "magical-posts-display",
    "type": "plugin",
    "affected_version": "* - 1.2.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37951",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "KiviCare – Clinic \u0026 Patient Management System (EHR) \u003c= 3.2.0 - Missing Authorization",
    "slug": "kivicare-clinic-management-system",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2627",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Accessibility Suite by Ability, Inc \u003c= 4.18 - Missing Authorization",
    "slug": "online-accessibility",
    "type": "plugin",
    "affected_version": "* - 4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22698",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22698",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Magic Fields 1 \u003c= 1.7.1 - Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-group-id parameter",
    "slug": "magic-fields",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18610",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Distance Based Shipping Calculator \u003c= 2.0.23 - Authenticated (Subscriber+) SQL Injection",
    "slug": "distance-based-shipping-calculator",
    "type": "plugin",
    "affected_version": "* - 2.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52495",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Multi Store Locator \u003c= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-multi-store-locator",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12475",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WholesaleX \u003c= 1.3.2 - Unauthenticated Privilege Escalation",
    "slug": "wholesalex",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30542",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter Popup \u003c= 1.2 - Unauthenticted Stored Cross-Site Scripting via 'nl_data'",
    "slug": "newsletter-popup",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0733",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ChatBot \u003c= 5.1.0 - Unauthenticated PHP Object Injection",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-22309",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22309",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced PDF Generator \u003c= 0.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "advanced-pdf-generator",
    "type": "plugin",
    "affected_version": "* - 0.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51641",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LA-Studio Element Kit for Elementor \u003c= 1.5.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-lakit-element-link Parameter",
    "slug": "lastudio-element-kit",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4943",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Annual Archive \u003c= 1.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "anual-archive",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33598",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextGEN Gallery \u003c= 3.2.10 - SQL Injection",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "[*, 3.2.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.11",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-14314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14314",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Website Builder Pro \u003c= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.20.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2121",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2121",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Survey \u0026 Poll – Quiz, Survey and Poll Plugin for WordPress \u003c= 1.7.5 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-survey-and-poll",
    "type": "plugin",
    "affected_version": "* - 1.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13596",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Quentn WP \u003c= 1.2.8 - Unauthenticated Privilege Escalation",
    "slug": "quentn-wp",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39596",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Avada \u003c= 5.1.4 - Stored Cross-Site Scripting",
    "slug": "Avada",
    "type": "theme",
    "affected_version": "[*, 5.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18606",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 0.8.9.0 - Directory Traversal to Arbitrary File Deletion",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 0.8.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-6726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-6726",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"
  },
  {
    "title": "Leyka \u003c= 3.30.2 - Privilege Escalation via Admin Password Reset",
    "slug": "leyka",
    "type": "plugin",
    "affected_version": "* - 3.30.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.30.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-33327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33327",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simpler Checkout 0.7.0 - 1.1.13 - Authentication Bypass",
    "slug": "simpler-checkout",
    "type": "plugin",
    "affected_version": "0.7.0 - 1.1.13",
    "from_version": "0.7.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7642",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content – ProfilePress \u003c= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.14.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.14.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1046",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Firebase PHP-JWT \u003c 6.0.0 - Algorithm Confusion",
    "slug": "jwt-auth",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-46743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-46743",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Kubio AI Page Builder \u003c= 2.5.1 - Unauthenticated Local File Inclusion",
    "slug": "kubio",
    "type": "plugin",
    "affected_version": "* - 2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-2294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2294",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Print Science Designer \u003c= 1.3.155 - Unauthenticated Arbitrary File Download",
    "slug": "print-science-designer",
    "type": "plugin",
    "affected_version": "* - 1.3.155",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.155",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32671",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Admin Menu Post List \u003c= 2.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "admin-menu-post-list",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32492",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobSearch WP Job Board \u003c= 1.8.1 - Missing Authorization to Arbitrary Options Update",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4361",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4361",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Smart Forms \u003c= 2.6.93 - Cross-Site Request Forgery",
    "slug": "smart-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1306",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Import Users to MailChimp \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "import-users-to-mailchimp",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23675",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress 淘宝客插件 \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "taobaoke",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23492",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp-Adv-Quiz \u003c= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Quiz Title",
    "slug": "advanced-quiz",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5956",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "reSmush.it \u003c= 0.4.3 - Missing Authorization",
    "slug": "resmushit-image-optimizer",
    "type": "plugin",
    "affected_version": "* - 0.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2450",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \u003c= 4.4.2 - Missing Authorization to Unauthenticated Settings Reset",
    "slug": "print-invoices-packing-slip-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3216",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "S2W – Import Shopify to WooCommerce \u003c= 1.1.12 - Authenticated (Admin+) Local File Inclusion",
    "slug": "import-shopify-to-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-44634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44634",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2091",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Coupon Affiliates \u003c= 6.4.1 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "woo-coupon-usage",
    "type": "plugin",
    "affected_version": "* - 6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54025",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Projects Portfolio with Client Testimonials \u003c= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-projects-portfolio",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13115",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LaTeX2HTML \u003c= 2.5.4 - Reflected Cross-Site Scripting",
    "slug": "latex2html",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49673",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPGuppy \u003c= 1.1.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wpguppy-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30775",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Stream \u003c= 3.9.1 - Missing Authorization to Sensitive Information Disclosure",
    "slug": "stream",
    "type": "plugin",
    "affected_version": "* - 3.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4384",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SERPed.net \u003c= 4.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "serped-net",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24669",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24669",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PlainInventory \u003c= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "z-inventory-manager",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32623",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Appointments \u003c= 3.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "easy-appointments",
    "type": "plugin",
    "affected_version": "* - 3.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30748",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blrt WP Embed \u003c= 1.6.9 - Authenticated (Contributor+) SQL Injection",
    "slug": "blrt-wp-embed",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51606",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Leadinfo \u003c= 1.1 - Missing Authorization to Unauthenticated Settings Change",
    "slug": "leadinfo",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48271",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "While Loading \u003c= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "while-it-is-loading",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51635",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51635",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ConvertKit \u003c= 2.4.9 - Missing Authorization",
    "slug": "convertkit",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3961",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3961",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Site Offline \u003c= 1.5.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "site-offline",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49190",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Basics \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "wp-basics",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51703",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Audio Comments Plugin \u003c= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "audio-comments",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4189",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4189",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 2.2.1 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4153",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookie Bar \u003c= 1.8.8 - Admin+ Stored Cross-Site Scripting",
    "slug": "cookie-bar",
    "type": "plugin",
    "affected_version": "* - 1.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24653",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fat Rat Collect \u003c= 2.6.0 - Missing Authorization",
    "slug": "fat-rat-collect",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35045",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35045",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Schools Staff Directory \u003c= 1.1 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "simple-schools-staff-directory",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24663",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "G Web Pro Store Locator \u003c= 2.1 - Reflected Cross-Site Scripting",
    "slug": "gwebpro-store-locator",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11682",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Tour \u0026 Travel Booking Plugin for WooCommerce – WpTravelly \u003c= 1.7.1 - Missing Authorization via ttbm_new_place_save",
    "slug": "tour-booking-manager",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0434",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP SimpleWeather \u003c= 0.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-simpleweather",
    "type": "plugin",
    "affected_version": "* - 0.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25085",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Toggle The Title \u003c= 1.4 - Cross-Site Scripting",
    "slug": "toggle-the-title",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14795",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TS Poll – Survey, Versus Poll, Image Poll, Video Poll \u003c= 2.4.6 - Authenticated (Administrator+) SQL Injection via 's' Parameter",
    "slug": "poll-wp",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3470",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Header Footer Code Manager \u003c= 1.1.34 - Cross-Site Request Forgery via process_bulk_action",
    "slug": "header-footer-code-manager",
    "type": "plugin",
    "affected_version": "[*, 1.1.35)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.35",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-39989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39989",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Automatic \u003c= 3.92.0 - Unauthenticated Arbitrary File Download and Server-Side Request Forgery",
    "slug": "wp-automatic",
    "type": "plugin",
    "affected_version": "* - 3.92.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.92.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-27954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27954",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Categorify \u003c= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxUpdateFolderPosition",
    "slug": "categorify",
    "type": "plugin",
    "affected_version": "* - 1.0.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1912",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Payment Donations \u003c= 4.2.0 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-payment-form",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2565",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MemberPress \u003c= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key Parameters",
    "slug": "memberpress",
    "type": "plugin",
    "affected_version": "* - 1.11.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5024",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5024",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Best Contact Management Software \u003c= 3.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-easy-contact",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2151",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AP HoneyPot WordPress Plugin \u003c= 1.4 - Cross-Site Request Forgery",
    "slug": "ap-honeypot",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58855",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Media File Manager \u003c= 1.4.2 - Directory Traversal to Arbitrary File Read",
    "slug": "media-file-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-19043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19043",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Poll Maker \u003c= 5.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "poll-maker",
    "type": "plugin",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13602",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail \u003c= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "yeemail",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22802",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GamiPress \u003c= 2.5.6 - Missing Authorization to User Points Updates",
    "slug": "gamipress",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25715",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom API for WP \u003c= 4.2.2 - Unauthenticated SQL Injection",
    "slug": "custom-api-for-wp",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54048",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Global Elementor Buttons \u003c= 1.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via button link",
    "slug": "global-elementor-buttons",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2327",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.11.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58984",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All Bootstrap Blocks \u003c= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "all-bootstrap-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35169",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.10.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "give",
    "type": "plugin",
    "affected_version": "[*, 2.10.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24315",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BSK Contact Form 7 Blacklist \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "bsk-contact-form-7-blacklist",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5141",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ACL Floating Cart for WooCommerce \u003c= 0.9 - Reflected Cross-Site Scripting",
    "slug": "acl-floating-cart-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49640",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fundraising Donation and Crowdfunding Platform \u003c= 1.4.2 - Unauthenticated SQL Injection",
    "slug": "wp-fundraising-donation",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0788",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NOSpamPTI \u003c= 2.1 - SQL Injection",
    "slug": "nospampti",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2013-5917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5917",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Defender Security \u003c= 2.4.6 - Cross-Site Request Forgery Bypass",
    "slug": "defender-security",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4425",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "User Session Synchronizer \u003c= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "user-session-synchronizer",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32612",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Pickupp \u003c= 2.4.0 - Unauthenticated Local File Inclusion",
    "slug": "wc-pickupp",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32587",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Restrict User Registration \u003c= 1.0.1  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "restrict-user-registration",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32655",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP BookWidgets \u003c= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-bookwidgets",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10139",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime – Events Calendar, Bookings and Tickets \u003c= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1123",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1123",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Secure Copy Content Protection and Content Locking \u003c= 4.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "secure-copy-content-protection",
    "type": "plugin",
    "affected_version": "* - 4.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32133",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JupiterX Core \u003c= 2.0.6 - Information Disclosure, Modification, and Denial of Service",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1659",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WPC Shop as a Customer for WooCommerce \u003c= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key",
    "slug": "wpc-shop-as-customer",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12432",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12432",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Packages – Sell Digital Products Securely \u003c= 5.9.1 - Cross-Site Request Forgery",
    "slug": "wpdm-premium-packages",
    "type": "plugin",
    "affected_version": "* - 5.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7386",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Futurio Extra \u003c= 2.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_size tag",
    "slug": "futurio-extra",
    "type": "plugin",
    "affected_version": "* - 2.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53802",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tin Canny Reporting for LearnDash \u003c= 4.3.0.7 - Reflected Cross-Site Scripting",
    "slug": "tin-canny-learndash-reporting",
    "type": "plugin",
    "affected_version": "* - 4.3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39656",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Author for WooCommerce \u003c= 1.0.7 - Cross-Site Request Forgery",
    "slug": "wc-product-author",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30872",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PageLayer \u003c= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24573",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Booking System \u003c= 2.0.18 - Authenticated (Admin+) Stored Cross Site Scripting",
    "slug": "wp-booking-system",
    "type": "plugin",
    "affected_version": "* - 2.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24402",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24402",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MMX \u0026#8211; Make Me Christmas \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mmx-make-me-christmas",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31401",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31401",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Image Gallery Plugin \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skyboot-portfolio-gallery",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53744",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Elementor Addons \u003c= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26761",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking calendar, Appointment Booking System \u003c= 3.2.3 - Unauthenticated Bypass Vulnerability",
    "slug": "booking-calendar",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24373",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24373",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wbcom Designs – BuddyPress Activity Social Share \u003c= 3.5.0 - Cross-Site Request Forgery",
    "slug": "bp-activity-social-share",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28694",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Quiz and Survey Master (QSM)  \u003c= 9.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 9.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8758",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8758",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Plugin for WordPress – Envira Photo Gallery \u003c= 1.8.14 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "envira-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 1.8.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3899",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web and WooCommerce Addons for WPBakery Builder \u003c= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification",
    "slug": "vc-addons-by-bit14",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6579",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WH Cache \u0026 Security \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "wh-cache-and-security",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23611",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP GDPR Compliance \u003c= 2.0.23 - Cross-Site Request Forgery",
    "slug": "wp-gdpr-compliance",
    "type": "plugin",
    "affected_version": "* - 2.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33682",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPGuppy \u003c= 1.1.0 - Unauthenticated PHP Object Injection",
    "slug": "wpguppy-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49222",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Migration, Backup, Staging – WPvivid \u003c= 0.9.74 - Authenticated (Admin+) PHAR Deserialization",
    "slug": "wpvivid-backuprestore",
    "type": "plugin",
    "affected_version": "* - 0.9.74",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.74",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2442",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation \u0026 Analytics \u003c= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update",
    "slug": "makewebbetter-hubspot-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10591",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Global Notification Bar \u003c= 1.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "global-notification-bar",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35647",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YouTube Embed \u003c= 2.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "youtube-video-player",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24002",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Registration \u003c= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 4.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6831",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget Post Slider \u003c= 1.3.5. - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "widget-post-slider",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32801",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Real Estate \u003c= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "essential-real-estate",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4273",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Connections Business Directory \u003c= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion",
    "slug": "connections",
    "type": "plugin",
    "affected_version": "* - 10.4.66",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.4.66",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12885",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "tagDiv Composer \u003c= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3510",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Schema \u0026 Structured Data for WP \u0026 AMP \u003c= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "schema-and-structured-data-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22146",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22146",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Shieldon \u003c= 1.6.3 - Reflected Cross-Site Scripting",
    "slug": "wp-shieldon",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24124",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "1 Click WordPress Migration Plugin – 100% FREE for a limited time \u003c= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php",
    "slug": "1-click-migration",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13609",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BitPay Checkout for WooCommerce \u003c= 4.1.0 - Missing Authorization",
    "slug": "bitpay-checkout-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41803",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Manager, Events Calendar, Tickets, Registrations – Eventin \u003c= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6033",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contribuinte Checkout \u003c= 2.0.03 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "contribuinte-checkout",
    "type": "plugin",
    "affected_version": "* - 2.0.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47685",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FBGorilla (All Versions) - SQL Injection",
    "slug": "fbgorilla",
    "type": "plugin",
    "affected_version": "*",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "999999.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-5200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5200",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Free Shipping Bar: Amount Left for Free Shipping for WooCommerce \u003c= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "amount-left-free-shipping-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48253",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Elementor Addons \u003c= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54704",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chartify – WordPress Chart Plugin \u003c= 3.5.9 - Missing Authentication for Administrative Function",
    "slug": "chart-builder",
    "type": "plugin",
    "affected_version": "* - 3.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11171",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Marketplace – Complete Shopping Cart / eCommerce Solution \u003c= 2.4.0 - Arbitrary File Download",
    "slug": "wpmarketplace",
    "type": "plugin",
    "affected_version": "[*, 2.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9013",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MainWP Code Snippets Extension \u003c= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "mainwp-code-snippets-extension",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23650",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Annie \u003c= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "annie",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23884",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReviewsTap \u003c= 1.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "reviewstap",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24561",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Upload Fields for WPForms \u003c= 1.0.2 - Missing Authorization",
    "slug": "upload-fields-for-wpforms",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35661",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better Search \u003c= 2.5.2 - Cross-Site Request Forgery Bypass",
    "slug": "better-search",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4400",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4400",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9872",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Engine \u003c= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 2.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5570",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ooorl \u003c= 1.0.0 - Reflected Cross-Site Scripting",
    "slug": "ooorl",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4542",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SpreadPlugin \u003c 3.8.6.2 - Cross-Site Scripting",
    "slug": "wp-spreadplugin",
    "type": "plugin",
    "affected_version": "[*, 3.8.6.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.6.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-10132",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10132",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Uploadcare File Uploader and Adaptive Delivery (beta) \u003c= 3.0.11 - Cross-Site Request Forgery",
    "slug": "uploadcare",
    "type": "plugin",
    "affected_version": "* - 3.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35636",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Small Package Quotes – Unishippers Edition \u003c= 2.4.9 - Missing Authorization",
    "slug": "small-package-quotes-unishippers-edition",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26960",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26960",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Pixels by JEVNET \u003c= 2.13 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "easy-pixels-by-jevnet",
    "type": "plugin",
    "affected_version": "* - 2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5479",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Mega Menu – QuadMenu \u003c= 3.2.0 - Cross-Site Request Forgery to Limited User Meta Update",
    "slug": "quadmenu",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2871",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ReDi Restaurant Reservation \u003c= 24.0128 - Cross-Site Request Forgery via redi_restaurant_admin_options_page()",
    "slug": "redi-restaurant-reservation",
    "type": "plugin",
    "affected_version": "* - 24.0128",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.0128",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31299",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElementsKit Elementor addons \u003c= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3499",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Brizy – Page Builder \u003c= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality",
    "slug": "brizy",
    "type": "plugin",
    "affected_version": "* - 2.4.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1164",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category Featured Images \u003c= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "category-featured-images",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58655",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AnalyticsWP \u003c= 2.1.2 - Unauthenticated SQL Injection",
    "slug": "analyticswp",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39389",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Sensei LMS \u003c= 4.24.4 - Missing Authorization",
    "slug": "sensei-lms",
    "type": "plugin",
    "affected_version": "* - 4.24.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22740",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OTA Sync Booking Engine Widget 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ota-sync-booking-engine-widget",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7647",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Ultra \u003c= 7.3.5 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "themify-ultra",
    "type": "theme",
    "affected_version": "* - 7.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46149",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Video Blogster Lite \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "video-blogster-lite",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47689",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.975",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.975",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4342",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Redirect \u0026 Thank You Page \u003c= 1.0.7 - Reflected Cross-Site Scripting",
    "slug": "cf7-redirect-thank-you-page",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12423",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Course Booking System \u003c= 6.0.6 - Unauthenticated SQL Injection",
    "slug": "course-booking-system",
    "type": "plugin",
    "affected_version": "* - 6.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-22785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22785",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Fancy Product Designer \u003c= 4.7.4 - Admin+ SQL Injection",
    "slug": "fancy-product-designer",
    "type": "plugin",
    "affected_version": "* - 4.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4134",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PowerPress Podcasting \u003c= 11.9.17 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 11.9.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.9.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9230",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9230",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 7.0.1 - Authenticated (Editor+) Server-Side Request Forgery",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 7.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47437",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47437",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Waiting: One-click countdowns \u003c= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'pbc_down[meta][id]'",
    "slug": "waiting",
    "type": "plugin",
    "affected_version": "* - 0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28659",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Status Updater \u003c= 1.9.2 - Reflected Cross-Site Scripting",
    "slug": "fb-status-updater",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25124",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wp-championship \u003c 5.9 - SQL Injection",
    "slug": "wp-championship",
    "type": "plugin",
    "affected_version": "[*, 5.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-5308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5308",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Share Buttons for WordPress \u003c= 2.7 - Missing Authorization to Unauthenticated Image Upload \u0026 Path Traversal",
    "slug": "share-buttons",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13117",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13117",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Zapier for WordPress \u003c= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated_user Function",
    "slug": "zapier",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13411",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HC Custom WP-Admin URL \u003c= 1.4 - Information Exposure",
    "slug": "hc-custom-wp-admin-url",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1595",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Mail Log \u003c= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email",
    "slug": "wp-mail-log",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3088",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "litespeed cache \u003c= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9169",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ConvertKit \u003c= 2.4.5 - Unauthenticated Sensitive Information Exposure",
    "slug": "convertkit",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31245",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Sweet Date \u003c= 3.7.3 - Unauthenticated Privilege Escalation",
    "slug": "sweetdate",
    "type": "theme",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43222",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43222",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form by Supsystic \u003c= 1.7.28 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "contact-form-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.7.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-48046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-48046",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Popular Posts \u003c= 6.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress-popular-posts",
    "type": "plugin",
    "affected_version": "[*, 6.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-45607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45607",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Simple PayPal Shopping Cart \u003c= 5.1.2 - Unauthenticated Product Price Manipulation",
    "slug": "wordpress-simple-paypal-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3530",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Subscribe2 – Form, Email Subscribers \u0026 Newsletters \u003c= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameter",
    "slug": "subscribe2",
    "type": "plugin",
    "affected_version": "* - 10.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.43",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11582",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetBlocks For Elementor \u003c= 1.3.8 - Reflected Cross Site Scripting",
    "slug": "jet-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48756",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enter Addons \u003c= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "enteraddons",
    "type": "plugin",
    "affected_version": "* - 2.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43225",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43225",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UserPro \u003c= 5.1.1 - Sensitive Information Disclosure via Shortcode",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2446",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "SIP Calculator \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "sip-calculator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12555",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Database Addon \u003c= 1.2.6.3 - CSV Injection",
    "slug": "contact-form-cfdb7",
    "type": "plugin",
    "affected_version": "* - 1.2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3634",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Home Page Menu \u003c 3.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-home-page-menu",
    "type": "plugin",
    "affected_version": "[*, 3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0684",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Stock Manager \u003c 1.0.5 - Missing Authorization and Cross-Site Request Forgery",
    "slug": "addify-product-stock-manager",
    "type": "plugin",
    "affected_version": "[*, 1.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-3451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3451",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Zoho CRM Lead Magnet \u003c= 1.7.8.8 - Reflected Cross-Site Scripting",
    "slug": "zoho-crm-forms",
    "type": "plugin",
    "affected_version": "* - 1.7.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38696",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "osTicket WP Bridge \u003c= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "osticket-wp-bridge",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9882",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OAuth 2.0 client for SSO \u003c= 1.11.3 - Authentication Bypass",
    "slug": "oauth-client",
    "type": "plugin",
    "affected_version": "* - 1.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-34858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34858",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Page Health-O-Meter \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "page-health-o-meter",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23595",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewsMash \u003c= 1.0.34 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "newsmash",
    "type": "theme",
    "affected_version": "* - 1.0.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.34",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37441",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Animated Text Block \u003c= 1.0.7 - Missing Authorization",
    "slug": "animated-text-block",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26883",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Content Views \u003c= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Grid and List Widgets",
    "slug": "content-views-query-and-display-post-page",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8722",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "mb.YTPlayer \u003c= 3.3.8 - Missing Authorization",
    "slug": "wpmbytplayer",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31782",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.2.0.8 - SQL Injection",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "[*, 6.2.0.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.0.9",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24456",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Testimonial Slider \u003c= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "testimonial-slider",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9417",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Shortcodes \u003c= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "smpl-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5566",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accordion \u003c= 2.6 - Authenticated (Editor+) Stored Cross-Site Scripting via accordion settings",
    "slug": "accordions-wp",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47809",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TypeSquare Webfonts \u003c= 2.0.7 - Missing Authorization via typesquare_admin_init()",
    "slug": "xserver-typesquare-webfonts",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43120",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Themes Coder \u003c= 1.3.4 - Unauthenticated SQL Injection",
    "slug": "tc-ecommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13726",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "AFI – The Easiest Integration Plugin \u003c= 1.99.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "advanced-form-integration",
    "type": "plugin",
    "affected_version": "* - 1.99.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.99.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13122",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Table of Contents Block \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "table-of-contents",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27305",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27305",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Speed Booster Pack PageSpeed Optimization Suite \u003c= 4.1.9. - Authenticated (Admin+) Remote Code Execution",
    "slug": "speed-booster-pack",
    "type": "plugin",
    "affected_version": "[*, 4.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24430",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "VideoWhisper Video Presentation \u003c= 3.25 - Reflected Cross-Site Scripting",
    "slug": "videowhisper-video-presentation",
    "type": "plugin",
    "affected_version": "* - 3.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4570",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple History \u003c= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode",
    "slug": "simple-history",
    "type": "plugin",
    "affected_version": "* - 5.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5760",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Weluka Lite \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "weluka-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4591",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Seriously Simple Podcasting \u003c= 3.5.0 - Reflected Cross-Site Scripting via add_query_arg Parameter",
    "slug": "seriously-simple-podcasting",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9667",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReviewX – Multi-criteria Rating \u0026 Reviews for WooCommerce \u003c= 1.6.28 - Insufficient Input Validation",
    "slug": "reviewx",
    "type": "plugin",
    "affected_version": "* - 1.6.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43323",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NewStatPress \u003c 1.0.6 - Reflected Cross-Site Scripting",
    "slug": "newstatpress",
    "type": "plugin",
    "affected_version": "[*, 1.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9312",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "translit it! \u003c= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "translit-it",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39416",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mang Board WP \u003c= 1.8.1 - Cross-Site Request Forgery",
    "slug": "mangboard",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44257",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "C9 Blocks \u003c= 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "c9-blocks",
    "type": "plugin",
    "affected_version": "* - 1.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26951",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ni WooCommerce Cost Of Goods \u003c= 3.2.8 - Authenticated (Administrator+) SQL Injection",
    "slug": "ni-woocommerce-cost-of-goods",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53783",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ecwid Ecommerce Shopping Cart \u003c= 6.11.3 - Cross Site Request Forgery",
    "slug": "ecwid-shopping-cart",
    "type": "plugin",
    "affected_version": "* - 6.11.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.11.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24377",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Suki Sites Import \u003c= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "suki-sites-import",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8916",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Shortcode for Google Maps \u003c= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "simple-google-maps-short-code",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10621",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Master Addons for Elementor \u003c= 2.0.5.4.1 - Missing Authorization via get_jltma_save_menuitem_settings()",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35660",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GEO my WordPress \u003c= 4.0.2 - Authenticated(Administrator+) SQL Injection",
    "slug": "geo-my-wp",
    "type": "plugin",
    "affected_version": "[*, 4.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-52134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52134",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Frontend Login and Registration Blocks \u003c= 1.0.8 - Authenticated (Subscriber+) Privilege Escalation via Password Reset",
    "slug": "frontend-login-and-registration-blocks",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3607",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3607",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Fancy Comments \u003c= 1.2.10 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode",
    "slug": "fancy-facebook-comments",
    "type": "plugin",
    "affected_version": "* - 1.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23670",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Five Star Restaurant Reservations \u003c= 2.6.29 - Missing Authorization",
    "slug": "restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 2.6.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30861",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EazyDocs \u003c= 2.3.3 - Authenticated (Subscriber+) SQL Injection",
    "slug": "eazydocs",
    "type": "plugin",
    "affected_version": "[*, 2.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-6035",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6035",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Keap Official Opt-in Forms \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "infusionsoft-official-opt-in-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47642",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47642",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ComparePress \u003c= 2.0.8 - Reflected Cross-Site Scripting",
    "slug": "comparepress",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23726",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "多说社会化评论框 \u003c= 1.2 - Cross-Site Request Forgery to Settings Update",
    "slug": "duoshuo",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48318",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WeChat Subscribers Lite  \u003c= 1.6.6 - Reflected Cross-Site Scripting",
    "slug": "wechat-subscribers-lite",
    "type": "plugin",
    "affected_version": "* - 1.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50522",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ANAC XML Bandi di Gara \u003c= 7.5 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "avcp",
    "type": "plugin",
    "affected_version": "* - 7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47656",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lewe ChordPress \u003c= 3.9.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "chordpress",
    "type": "plugin",
    "affected_version": "* - 3.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52789",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PixTypes \u003c= 1.4.14 - Cross-Site Request Forgery",
    "slug": "pixtypes",
    "type": "plugin",
    "affected_version": "* - 1.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25487",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Geo Content \u003c= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "geo-targetly-geo-content",
    "type": "plugin",
    "affected_version": "* - 6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11887",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export Import Menus \u003c= 1.9.1 - Missing Authorization to Unauthenticated Menu Export",
    "slug": "export-import-menus",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10866",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Accordion \u003c= 2.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-accordion-free",
    "type": "plugin",
    "affected_version": "* - 2.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4487",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Style Manager \u003c= 2.2.7 - Cross-Site Request Forgery to Settings Update",
    "slug": "style-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39425",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Medialist \u003c= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "media-list",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5942",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5942",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Connatix Video Embed \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "connatix-video-embed",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11883",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Alex Reservations: Smart Restaurant Booking \u003c= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "alex-reservations",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13380",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feed Changer \u003c= 0.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "feed-changer",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25795",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Carousel \u003c= 3.4.1 - Contributor+ Stored Cross-Site Scripting",
    "slug": "logo-carousel-free",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24738",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "New Simple Gallery \u003c= 8.0 - Authenticated (Contributor+) SQL Injection",
    "slug": "new-simple-gallery",
    "type": "plugin",
    "affected_version": "* - 8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58881",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ali2Woo Lite \u003c= 3.3.6 - Reflected Cross-Site Scripting",
    "slug": "ali2woo-lite",
    "type": "plugin",
    "affected_version": "* - 3.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37211",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RegistrationMagic \u003c= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "* - 5.2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2548",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pie Calendar \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pie-calendar",
    "type": "plugin",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58618",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Category Widget \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "category-widget",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46515",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MapPress Maps for WordPress \u003c= 2.88.14 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mappress-google-maps-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 2.88.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.88.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0420",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TableGen – Data Table Generator \u003c= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "table-creator",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10053",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Clickbank WordPress Plugin (Niche Storefront) \u003c= 1.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "clickbank-niche-storefronts",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48353",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutenberg Blocks \u003c= 3.3.1 - Unauthenticated Local File Inclusion",
    "slug": "advanced-gutenberg",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48332",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48332",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Yoast SEO \u003c= 9.1.0 - Race Condition to Remote Code Execution",
    "slug": "wordpress-seo",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-19370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19370",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Auto Poster \u003c= 2.1.4 - Cross-Site Request Forgery to Plugin Settings Reset",
    "slug": "accesspress-facebook-auto-post",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26532",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Premium Addons for Elementor  \u003c= 4.10.25 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32791",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Bookings \u003c= 2.0.3 - Cross-Site Request Forgery",
    "slug": "woocommerce-bookings",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47787",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47787",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CampTix Event Ticketing \u003c= 1.4.2 - CSV Injection",
    "slug": "camptix",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10762",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "CURCY - WooCommerce Multi Currency - Currency Switcher \u003c= 2.3.6 - Unauthenticated SQL Injection",
    "slug": "woocommerce-multi-currency",
    "type": "plugin",
    "affected_version": "* - 2.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13320",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots \u003c 6.60 - Authenticated SQL Injection",
    "slug": "stopbadbots",
    "type": "plugin",
    "affected_version": "[*, 6.60)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.60",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24727",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24727",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ChatBot \u003c= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4253",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4253",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Form Builder \u003c= 3.0.3 - Admin+ Stored Cross-Site Scripting",
    "slug": "visual-form-builder",
    "type": "plugin",
    "affected_version": "* - 3.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24514",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSV Importer Improved \u003c= 0.6.1 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "csv-importer-improved",
    "type": "plugin",
    "affected_version": "* - 0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50013",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnPress Export Import – WordPress extension for LearnPress \u003c= 4.0.4 - Reflected Cross-Site Scripting",
    "slug": "learnpress-import-export",
    "type": "plugin",
    "affected_version": "* - 4.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9609",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GS Logo Slider \u003c= 3.5.1 - Cross-Site Request Forgery",
    "slug": "gs-logo-slider",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51530",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple WP Events \u003c= 1.8.17 - Unauthenticated Sensitive Information Exposure",
    "slug": "simple-wp-events",
    "type": "plugin",
    "affected_version": "* - 1.8.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32594",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Awesome Support \u003c= 6.3.4 - Information Exposure",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53340",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Performance Pack \u003c= 2.5.3 - Missing Authorization",
    "slug": "wp-performance-pack",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28938",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Final Tiles Gallery \u003c= 3.4.18 - Authenticated Stored Cross-Site Scripting",
    "slug": "final-tiles-grid-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 3.4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-14962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-14962",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ni Purchase Order(PO) For WooCommerce \u003c= 1.2.1 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "ni-purchase-orderpo-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-5957",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5957",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Visit Site Link enhanced \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "visit-site-link-enhanced",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23470",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS Feed Reader \u003c= 0.1 - Cross-Site Scripting",
    "slug": "rss-feed-reader",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-0740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-0740",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletters \u003c= 4.6.18 - Directory Traversal",
    "slug": "newsletters-lite",
    "type": "plugin",
    "affected_version": "[*, 4.6.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.19",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-14788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14788",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Forms Puzzle Captcha \u003c= 4.1 - Captcha Bypass",
    "slug": "wp-forms-puzzle-captcha",
    "type": "plugin",
    "affected_version": "* - 4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48276",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Testimonial \u003c 2.3 - SQL Injection",
    "slug": "indianic-testimonial",
    "type": "plugin",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-5673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5673",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "XStore Core \u003c= 5.3.8 - Unauthenticated SQL Injection",
    "slug": "et-core-plugin",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33551",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "ProfileGrid  \u003c= 5.8.2 - Bypass Group Members Limit",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32774",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Clone \u003c= 2.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialized_replace'",
    "slug": "wp-clone-by-wp-academy",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10913",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10913",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Innovs HR – Complete Human Resource Management System for Your Business \u003c= 1.0.3.4 - Cross-Site Request Forgery",
    "slug": "innovs-hr-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0858",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AB Categories Search Widget  \u003c= 0.2.5 - Reflected Cross-Site Scripting",
    "slug": "ab-categories-search-widget",
    "type": "plugin",
    "affected_version": "* - 0.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49240",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Like dislike plus counter | Like Dislike Buttons \u003c= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "like-dislike-plus-counter",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25115",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multi-day Booking Calendar \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "multi-day-booking-calendar",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51873",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.0 - Edit/Delete event via IDOR",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "* - 4.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29434",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Ajax WooSearch \u003c= 1.0.0 - Unauthenticated SQL Injection",
    "slug": "ajax-woosearch",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9697",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Salon booking system \u003c= 10.7 - Authenticated (Administrator+) SQL Injection",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 10.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-39658",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39658",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "underConstruction \u003c 1.09 - Cross-Site Request Forgery",
    "slug": "underconstruction",
    "type": "plugin",
    "affected_version": "[*, 1.09)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.09",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-2699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2699",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "This-or-That by André Boekhorst \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "this-or-that",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10138",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10138",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CommentLuv \u003c 2.92.4 - Reflected Cross-Site Scripting",
    "slug": "commentluv",
    "type": "plugin",
    "affected_version": "[*, 2.92.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.92.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-1409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-1409",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spotlight - Social Media Feeds (Premium) \u003c= 1.7.1 - Unauthenticated Information Exposure",
    "slug": "spotlight-social-photo-feeds-premium",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39498",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Theme My Login \u003c= 7.1.12 - Missing Authorization",
    "slug": "theme-my-login",
    "type": "plugin",
    "affected_version": "* - 7.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60098",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Post Type Generator \u003c= 2.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "custom-post-type-generator",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33329",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33329",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Goza - Nonprofit Charity WordPress Theme \u003c= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Deletion",
    "slug": "goza-theme",
    "type": "theme",
    "affected_version": "3.2.2",
    "from_version": "3.2.2",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-10134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10134",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg \u0026 Elementor \u003c= 5.3.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "post-block",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38686",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Share Buttons \u003c= 1.4.5 - Reflected Cross-Site Scripting",
    "slug": "easy-social-share-buttons",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8729",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8729",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin Pro \u003c= 4.5.4 \u0026 Free \u003c= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6158",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "EventON - WordPress Virtual Event Calendar Plugin Pro \u003c= 4.5.4 \u0026 Free \u003c= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta",
    "slug": "eventON",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6158",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WooCommerce Order Status Change Notifier \u003c= 1.1.0 - Authenticated (Subscriber+) Arbitrary Order Status Update",
    "slug": "woocommerce-order-status-change-notifier",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2179",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SP Rental Manager \u003c= 1.5.3 - Unauthenticated SQL Injection",
    "slug": "sp-rental-manager",
    "type": "plugin",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-38324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38324",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L"
  },
  {
    "title": "Photocrati \u003c= 4.8.0 - Cross-Site Scripting",
    "slug": "photocrati-theme",
    "type": "theme",
    "affected_version": "* - 4.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-100016",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-100016",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Music Request Manager \u003c= 1.3 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "music-request-manager",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6019",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.2 - Authenticated (Contributor+) Stored Cross Site Scripting",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "[*, 2.10.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24157",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Prismatic \u003c= 2.7 - Reflected Cross-Site Scripting",
    "slug": "prismatic",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24409",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tawk.To Live Chat \u003c= 0.5.4 - Missing Authorization to Visitor Monitoring \u0026 Chat Removal",
    "slug": "tawkto-live-chat",
    "type": "plugin",
    "affected_version": "[*, 0.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24914",
    "auth_type": "Auth",
    "cvss_score": 8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Subscription Forms \u003c= 1.2.3 - Missing Authorization",
    "slug": "wp-subscription-forms",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39591",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPBookit \u003c= 1.6.0 - Unauthenticated SQL Injection",
    "slug": "wpbookit",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54280",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP TripAdvisor Review Slider \u003c= 10.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-tripadvisor-review-slider",
    "type": "plugin",
    "affected_version": "* - 10.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0261",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.3.97 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.97",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-37484",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37484",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Essential Addons for Elementor \u003c= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 6.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8742",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team Showcase \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "team-showcase",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5639",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Soledad \u003c= 8.2.4 - Reflected Cross-Site Scripting",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3209",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Extended Search \u003c= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-extended-search",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4649",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CE21 Suite \u003c= 2.2.0 - Unauthenticated Privilege Escalation",
    "slug": "ce21-suite",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54293",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54293",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Flat Preloader \u003c= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "flat-preloader",
    "type": "plugin",
    "affected_version": "[*, 1.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24685",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP User Profile Avatar \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-user-profile-avatar",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6067",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Red Art \u003c= 3.7 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "redart",
    "type": "theme",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52828",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mailster \u003c= 4.0.6 - Unauthenticated Local File Inclusion",
    "slug": "mailster",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32523",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Profile Builder – Beautiful User Registration Forms, User Profiles \u0026 User Role Editor \u003c= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "profile-builder",
    "type": "plugin",
    "affected_version": "* - 3.14.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8896",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8896",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Convert Docx2post \u003c= 1.4 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "convert-docx2post",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52397",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Unlimited Addon For Elementor \u003c= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "unlimited-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49267",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tourfic \u003c= 2.11.17 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "tourfic",
    "type": "plugin",
    "affected_version": "* - 2.11.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.11.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-29136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29136",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GutenBee – Gutenberg Blocks \u003c= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gutenbee",
    "type": "plugin",
    "affected_version": "* - 2.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8566",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8566",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HubSpot – CRM, Email Marketing, Live Chat, Forms \u0026 Analytics \u003c= 8.8.13 - Server Side Request Forgery",
    "slug": "leadin",
    "type": "plugin",
    "affected_version": "[*, 8.8.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.15",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1239",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Colibri Page Builder \u003c= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id",
    "slug": "colibri-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.0.227",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.227",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2188",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Paid Member Subscriptions \u003c= 2.15.1 - Unauthenticated SQL Injection",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49870",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Business Directory Pro \u003c 15.6.9 - Unauthenticated Privilege Escalation",
    "slug": "simple-business-directory-pro",
    "type": "plugin",
    "affected_version": "[*, 15.6.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "15.6.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-53580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53580",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Delete Post Copies \u003c= 5.5 - Missing Authorization",
    "slug": "etruel-del-post-copies",
    "type": "plugin",
    "affected_version": "* - 5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22541",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Target Video Easy Publish \u003c= 3.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "brid-video-easy-publish",
    "type": "plugin",
    "affected_version": "* - 3.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12076",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12076",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export and Import Users and Customers \u003c= 2.5.3 - Authenticated (Admin+) PHP Object Injection",
    "slug": "users-customers-import-export-for-wp-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32835",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Eventin \u003c= 4.0.20 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-event-solution",
    "type": "plugin",
    "affected_version": "* - 4.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26964",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Flexible FAQ \u003c= 0.2 - Cross-Site Request Forgery",
    "slug": "flexible-faq",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58200",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Field Template \u003c= 2.5.1 - Cross-Site Request Forgery Bypass",
    "slug": "custom-field-template",
    "type": "plugin",
    "affected_version": "[*, 2.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-36742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36742",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GF Custom Style \u003c= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "gf-custom-style",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9173",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Publish approval \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "publish-approval",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9617",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ELEX WooCommerce Advanced Bulk Edit Products, Prices \u0026 Attributes \u003c= 1.4.9 - Authenticated (Shop manager+) SQL Injection",
    "slug": "elex-bulk-edit-products-prices-attributes-for-woocommerce-basic",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22352",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Elfsight Instagram Widget – Instagram Gallery \u003c 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "instalinker",
    "type": "plugin",
    "affected_version": "[*, 1.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-11005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-11005",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Breadcrumbs by menu \u003c 1.0.3 - Cross-Site Scripting",
    "slug": "breadcrumbs-by-menu",
    "type": "plugin",
    "affected_version": "[*, 1.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15864",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15864",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Garden Gnome Package \u003c= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "garden-gnome-package",
    "type": "plugin",
    "affected_version": "* - 2.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8657",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8657",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Nature FlipBook WordPress Plugin \u003c= 1.7 - Reflected Cross-Site Scripting",
    "slug": "vertical-diamond-flipbook-flash",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23454",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag \u0026 Drop WP Form Builder \u003c= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9528",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LadiApp \u003c= 4.4 - Missing Authorization via save_config()",
    "slug": "ladipage",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4627",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Clio Grow \u003c= 1.0.2 - Reflected Cross-Site Scripting",
    "slug": "clio-grow-form",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49276",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wp chart generator \u003c= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpchart Shortcode",
    "slug": "wp-chart-generator",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8685",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Widget Bundle \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "wp-widget-bundle",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4616",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CRUDLab Like Box \u003c= 2.0.9 - Reflected Cross-Site Scripting",
    "slug": "crudlab-facebook-like-box",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23814",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bitspecter Suite \u003c= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "bitspecter-suite",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2577",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2577",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mobile Address Bar Changer \u003c= 3.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "mobile-address-bar-changer",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38390",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38390",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP DPE-GES \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-dpe-ges",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47515",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Delivery Date for WooCommerce – Lite \u003c= 2.7.0 - Missing Authorization",
    "slug": "product-delivery-date-for-woocommerce-lite",
    "type": "plugin",
    "affected_version": "* - 2.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52210",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52210",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikRentCar \u003c= 1.4.0 - Unauthenticated SQL Injection",
    "slug": "vikrentcar",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-39653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39653",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Custom Admin Page by BestWebSoft \u003c= 0.1.1 - Reflected Cross-Site Scripting",
    "slug": "custom-admin-page",
    "type": "plugin",
    "affected_version": "* - 0.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18493",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feed Them Social \u003c= 1.6.9 - Reflected Cross-Site Scripting",
    "slug": "feed-them-social",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9350",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Icons \u003c= 3.2.0 - Admin+ Stored Cross-Site Scripting",
    "slug": "easy-social-icons",
    "type": "plugin",
    "affected_version": "[*, 3.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0840",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup for CF7 with Sweet Alert \u003c= 1.6.5 - Cross-Site Request Forgery",
    "slug": "cf7-sweet-alert-popup",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48363",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Infility Global \u003c= 2.13.4 - Reflected Cross-Site Scripting",
    "slug": "infility-global",
    "type": "plugin",
    "affected_version": "* - 2.13.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47652",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Link Log – external link click monitor \u003c= 1.4 - HTTP Response Splitting",
    "slug": "link-log",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-9345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9345",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c 2.7.6 - Unauthenticated Admin Account Creation",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 2.7.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0441",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BP Better Messages \u003c= 1.9.9.37 - Reflected Cross-Site Scripting",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "[*, 1.9.9.41)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.41",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24808",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Page Generator Plugin – MPG \u003c= 3.4.0 - Authenticated (Editor+) Remote Code Execution",
    "slug": "multiple-pages-generator-by-porthas",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-27951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27951",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NEX-Forms – Ultimate Form Builder \u003c= 8.4.2 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "nex-forms-express-wp-form-builder",
    "type": "plugin",
    "affected_version": "* - 8.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24705",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booking Calendar \u003c= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "booking",
    "type": "plugin",
    "affected_version": "* - 10.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9346",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Yasr – Yet Another Stars Rating  \u003c= 2.9.9 - Cross-Site Scripting via source",
    "slug": "yet-another-stars-rating",
    "type": "plugin",
    "affected_version": "* - 2.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-23980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23980",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Complete Google Seo Scan \u003c= 3.5.1 - Authenticated (Administrator+) SQL Injection",
    "slug": "complete-google-seo-scan",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26590",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Ajax Search Lite \u003c= 4.11 - Reflected Cross-Site Scripting",
    "slug": "ajax-search-lite",
    "type": "plugin",
    "affected_version": "* - 4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1420",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPSmartContracts \u003c= 2.0.10 - Unauthenticated SQL Injection",
    "slug": "wp-smart-contracts",
    "type": "plugin",
    "affected_version": "* - 2.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31565",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Roles \u0026 Capabilities \u003c= 1.1.9 - Reflected Cross-Site Scripting",
    "slug": "leira-roles",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8732",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewStatPress \u003c= 1.0.0 - SQL Injection",
    "slug": "newstatpress",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-9315",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9315",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom 404 Pro \u003c= 3.10.0 - Unauthenticated Stored Cross-Site Scripting via logging",
    "slug": "custom-404-pro",
    "type": "plugin",
    "affected_version": "* - 3.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-51540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51540",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP DSGVO Tools (GDPR) \u003c= 3.1.23 - Unauthenticated Arbitrary Post Deletion",
    "slug": "shapepress-dsgvo",
    "type": "plugin",
    "affected_version": "* - 3.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.23",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-42359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-42359",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "WP Smiley \u003c= 1.4.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "wp-smiley",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-4140",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4140",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Enable Media Replace \u003c= 4.1.4 - Reflected Cross-Site Scripting",
    "slug": "enable-media-replace",
    "type": "plugin",
    "affected_version": "* - 4.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6737",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CalderaWP License Manager \u003c= 1.2.11 - Cross-Site Request Forgery",
    "slug": "calderawp-license-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36914",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Remote Users Sync \u003c= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery",
    "slug": "wp-remote-users-sync",
    "type": "plugin",
    "affected_version": "* - 1.2.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3958",
    "auth_type": "Auth",
    "cvss_score": 8.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Dezdy \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "dezdy-mcommerce",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23590",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comment Info Detector \u003c= 1.0.5 - Cross-Site Request Forgery to Settings Update",
    "slug": "comment-info-detector",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10311",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.5.4 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-23830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23830",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload – Contact Form 7 \u003c= 1.3.8.5 - Limited Arbitrary File Deletion",
    "slug": "drag-and-drop-multiple-file-upload-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12267",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Newsmatic \u003c= 1.3.1 - Missing Authorization",
    "slug": "newsmatic",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37468",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Sharkdropship for AliExpress Dropshipping and Affiliate \u003c= 2.2.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletion",
    "slug": "wooshark-aliexpress-importer",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1732",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wiki Embed \u003c= 1.4.6 - Cross-Site Request Forgery",
    "slug": "wiki-embed",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47551",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tiempo.com \u003c= 0.1.2 - Reflected Cross-Site Scripting",
    "slug": "tiempocom",
    "type": "plugin",
    "affected_version": "* - 0.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2272",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complianz - GDPR/CCPA Cookie Consent \u003c= 6.4.4 - Cross-Site Request Forgery via ajax_edit_item",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33333",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Google Map Plugin \u003c= 4.4.2 - Cross-Site Request Forgery via delete()",
    "slug": "wp-google-map-plugin",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28172",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Responsive Menu \u003c= 4.1.7 - Missing Authorization Checks",
    "slug": "responsive-menu",
    "type": "plugin",
    "affected_version": "[*, 4.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-25602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25602",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Advanced Database Cleaner \u003c= 3.0.1 - SQL injection",
    "slug": "advanced-database-cleaner",
    "type": "plugin",
    "affected_version": "[*, 3.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24141",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Form To JSON \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "form-to-json",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23736",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPress \u003c= 10.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 10.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30778",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Social AutoConnect \u003c= 4.6.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "wp-fb-autoconnect",
    "type": "plugin",
    "affected_version": "* - 4.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12279",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WANotifier – Send Message Notifications Using WhatsApp API \u003c= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "notifier",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6165",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced WooCommerce Product Sales Reporting \u003c= 4.0.2 - Unauthenticated SQL Injection",
    "slug": "webd-woocommerce-advanced-reporting-statistics",
    "type": "plugin",
    "affected_version": "* - 4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31553",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Kallyas \u003c= 4.21.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "kallyas",
    "type": "theme",
    "affected_version": "* - 4.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6991",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Menu Image, Icons made easy \u003c= 3.0.7 - Authenticated Cross-Site Scripting",
    "slug": "menu-image",
    "type": "plugin",
    "affected_version": "[*, 3.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0450",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Multilingual \u0026 Multicurrency with WPML \u003c= 5.3.7 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-multilingual",
    "type": "plugin",
    "affected_version": "* - 5.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8629",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – FreightQuote Edition \u003c= 2.3.11 - Missing Authorization",
    "slug": "ltl-freight-quotes-freightquote-edition",
    "type": "plugin",
    "affected_version": "* - 2.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22287",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spice Blocks \u003c= 2.0.7.2 - Unauthenticated Arbitrary File Download",
    "slug": "spice-blocks",
    "type": "plugin",
    "affected_version": "* - 2.0.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48130",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "DoLogin Security \u003c= 3.6 - IP Address Spoofing",
    "slug": "dologin",
    "type": "plugin",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-4631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4631",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TRUSTist REVIEWer \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "trustist-reviewer",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22567",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Leartes TRY Exchange Rates \u003c= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "leartes-try-exchange-rates",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31783",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AIO Contact \u003c= 2.8.1 - Missing Authorization",
    "slug": "aio-contact",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54218",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54218",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Go Pricing - WordPress Responsive Pricing Tables \u003c= 3.3.19 - Missing Authorization to Limited Privilege Granting",
    "slug": "go_pricing",
    "type": "plugin",
    "affected_version": "* - 3.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2494",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Font Awesome \u003c= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-font-awesome",
    "type": "plugin",
    "affected_version": "* - 1.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5127",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.2.1 - reCaptcha Protection Bypass",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0085",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tiger \u003c= 2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "tiger",
    "type": "theme",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31407",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ui Slider Filter By Price \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "ui-slider-filter-by-price",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54419",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Maps by Supsystic \u003c= 1.2.15 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ultimate-maps-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6732",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6732",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BigContact \u003c= 1.5.8 - Cross-Site Request Forgery leading to Plugin Settings Updates",
    "slug": "bigcontact",
    "type": "plugin",
    "affected_version": "* - 1.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22694",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Import and export users and customers \u003c= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "import-users-from-csv-with-meta",
    "type": "plugin",
    "affected_version": "* - 1.26.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.26.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4734",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Location Weather \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "location-weather",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0360",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Webpushr \u003c= 4.35.0 - Reflected Cross-Site Scripting",
    "slug": "webpushr-web-push-notifications",
    "type": "plugin",
    "affected_version": "* - 4.35.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.35.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34369",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34369",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7498",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Counter Up – Animated Number Counter \u0026 Milestone Showcase \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-counter-up",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34564",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.107",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.107",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3190",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "SpotBot \u003c= 0.1.8 - Reflected Cross-Site Scripting",
    "slug": "spotbot",
    "type": "plugin",
    "affected_version": "* - 0.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13878",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13878",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-BibTeX \u003c= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-bibtex",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13578",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Twitter Feeds – A Tweets Widget or X Feed Widget \u003c= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update",
    "slug": "custom-twitter-feeds",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0379",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Reservit Hotel \u003c= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "reservit-hotel",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9458",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Demo User DZS – Showcase your admin safely \u003c= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "demo-user-dzs-showcase-your-admin-safely",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23581",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xtreme Locator Dealer Locator Plugin \u003c= 3.0.1 - Authenticated (Admin+) SQL Injection",
    "slug": "xtremelocator",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10939",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Random Featured Post \u003c= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "random-featured-post-plugin",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51650",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "One-Login \u003c= 1.4 - Unauthenticated Privilege Esclation",
    "slug": "one-login",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-23974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23974",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 1.5.2 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2006-1012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2006-1012",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress \u003c= 3.4.27.1 - Stored Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.4.27.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.27.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-36173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36173",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Category and Custom Taxonomy Image \u003c= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_tax_image Shortcode",
    "slug": "advanced-category-and-custom-taxonomy-image",
    "type": "plugin",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9425",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bit Assist \u003c= 1.5.4 - Unauthenticated Path Traversal",
    "slug": "bit-assist",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30834",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Bot Block \u0026#8211; Stop Spam Referrals in Google Analytics \u003c= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "bot-block-stop-spam-google-analytics-referrals",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57935",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Formaloo Form Maker \u0026 Customer Analytics for WordPress \u0026 WooCommerce \u003c= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "formaloo-form-builder",
    "type": "plugin",
    "affected_version": "* - 2.1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11934",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SMS \u003c= 6.0.4 - Information Disclosure via REST API",
    "slug": "wp-sms",
    "type": "plugin",
    "affected_version": "* - 6.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27447",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ultimate Classified Listings \u003c= 1.6 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "ultimate-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52448",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fusion Page Builder : Extension - Gallery \u003c= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fusion-extension-gallery",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58965",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP To Do \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-todo",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37539",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Admin Custom Page \u003c= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-admin-custom-page",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25072",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Bank \u003c= 3.0.30 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "contact-bank",
    "type": "plugin",
    "affected_version": "* - 3.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3350",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Smart Import \u003c= 1.1.3 - Unauthenticated Local File Inclusion",
    "slug": "wp-smart-import",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47453",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Formatted post \u003c= 1.01 - Reflected Cross-Site Scripting",
    "slug": "formatted-post",
    "type": "plugin",
    "affected_version": "* - 1.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23709",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23709",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Hotel Booking System Pro \u003c= 1.1 - Cross-Site Scripting",
    "slug": "bsi-hotel-pro",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-15536",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-15536",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator \u003c= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.38.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.38.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0470",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0691",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0691",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "URL Shortener \u003c= 3.0.7 - Unauthenticated Server-Side Request Forgery",
    "slug": "exact-links",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28963",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress \u0026 WooCommerce \u003c= 5.7.17 - Missing Authorization",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 5.7.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3626",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Page Builder: Pagelayer \u003c= 1.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8426",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ACF Onyx Poll \u003c= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter",
    "slug": "acf-onyx-poll",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5841",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5841",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google XML Sitemap for Images \u003c= 2.1.3 - Cross-Site Request Forgery via image_sitemap_generate",
    "slug": "google-image-sitemap",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28173",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28173",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.8.10 - Reflected Cross-Site Scripting",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "3.8.6 - 3.8.10",
    "from_version": "3.8.6",
    "from_inclusive": true,
    "to_version": "3.8.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7354",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11083",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11083",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Multiple Shipping Address Woocommerce \u003c 2.0 - Unauthenticated SQL Injection",
    "slug": "multiple-shipping-address-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0783",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Integrate Google Drive \u003c= 1.3.2 - Open Redirect via state",
    "slug": "integrate-google-drive",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47548",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Google Org Chart \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "google-org-chart",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23928",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP_DEBUG Toggle \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "enable-wp-debug-toggle",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32561",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chatter \u003c= 1.0.1 - Missing Authorization",
    "slug": "chatter",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53785",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53785",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Master Slider – Responsive Touch Slider \u003c= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode",
    "slug": "master-slider",
    "type": "plugin",
    "affected_version": "* - 3.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4375",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MkRapel Regiones y Ciudades de Chile para WC \u003c= 4.3.0 - Cross-Site Request Forgery via multiple functions",
    "slug": "wc-ciudades-y-regiones-de-chile",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48781",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "ZMSEO \u003c= 1.14.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "zmseo",
    "type": "plugin",
    "affected_version": "* - 1.14.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25126",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Listivo - Classified Ads WordPress Theme \u003c= 2.3.67 - Reflected Cross-Site Scripting",
    "slug": "listivo",
    "type": "theme",
    "affected_version": "* - 2.3.67",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.67",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13867",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CMP - Coming Soon \u0026 Maintenance Plugin \u003c= 4.0.18 - Unauthenticated Arbitrary CSS Update",
    "slug": "cmp-coming-soon-maintenance",
    "type": "plugin",
    "affected_version": "[*, 4.0.19)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.19",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0188",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Google Site Verification plugin using Meta Tag \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "google-site-verification-using-meta-tag",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32514",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Ticket Customer Service Software \u0026 Support Ticket System \u003c= 6.0.2 - Unauthenticated PHP Object Injection",
    "slug": "wp-ticket",
    "type": "plugin",
    "affected_version": "* - 6.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53584",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Grid Combo – 36+ Gutenberg Blocks \u003c= 2.2.68 - Information Exposure via get_posts API Endpoint",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.68",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.68",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-7072",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7072",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Internal Link Building \u003c= 1.2.3 - Cross-Site Request Forgery",
    "slug": "internal-link-building-plugin",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46193",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots \u003c 6.67 - Unauthenticated SQL Injection",
    "slug": "stopbadbots",
    "type": "plugin",
    "affected_version": "[*, 6.67)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.67",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24863",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Events Manager – Calendar, Bookings, Tickets, and more! \u003c= 6.6.4.1 - Missing Authorization",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "* - 6.6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1249",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Universal Analytics \u003c= 1.3.0 - Cross-Site Scripting",
    "slug": "universal-analytics",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10912",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \u003c= 4.89 - Unauthenticated Local File Inclusion",
    "slug": "ap-plugin-scripteo",
    "type": "plugin",
    "affected_version": "* - 4.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.89",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4380",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4380",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Duplicate Page \u003c= 4.4.1 Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "duplicate-page",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24681",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Manager \u003c= 8.45.0 - Missing Authorization",
    "slug": "smart-manager-for-wp-e-commerce",
    "type": "plugin",
    "affected_version": "* - 8.45.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.45.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49687",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Team Members \u003c= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "team-members",
    "type": "plugin",
    "affected_version": "* - 5.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8440",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mega Menu \u003c= 3.0.7 - Reflected Cross-Site Scripting",
    "slug": "ap-mega-menu",
    "type": "plugin",
    "affected_version": "[*, 3.0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0628",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download HTML TinyMCE Button \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "download-html-tinymce-button",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1286",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1286",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder \u003c= 1.38.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "forminator",
    "type": "plugin",
    "affected_version": "* - 1.38.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.38.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7052",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GTranslate Pro and GTranslate Enterprise \u003c= 2.8.64 - Reflected Cross-Site Scripting",
    "slug": "gtranslate",
    "type": "plugin",
    "affected_version": "[*, 2.8.65)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.65",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-34630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34630",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "WP Data Access \u003c= 5.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-data-access",
    "type": "plugin",
    "affected_version": "* - 5.5.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39582",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEO Backlink Monitor \u003c= 1.5.0 - Reflected Cross-Site Scripting",
    "slug": "seo-backlink-monitor",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29907",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tabs \u003c= 4.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "vc-tabs",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37120",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Drag and Drop Multiple File Upload for Contact Form 7 \u003c= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks",
    "slug": "drag-and-drop-multiple-file-upload-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.3.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3515",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Category Tree \u003c= 2.5 - Reflected Cross-Site Scripting",
    "slug": "product-category-tree",
    "type": "plugin",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45054",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c= 10.11 - Authenticated Privilege Escalation",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "* - 10.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31560",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce \u003c= 6.5.1 - Authenticated (Admin+) HTML Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "[*, 6.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2099",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Star Rating with font Awesome \u003c= 1.3 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "contact-form-7-star-rating-with-font-awersome",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27304",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Accordion \u003c= 2.0.21 - Authenticated Stored Cross-Site Scripting",
    "slug": "easy-accordion-free",
    "type": "plugin",
    "affected_version": "* - 2.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24576",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Permalink Manager Lite  \u003c= 2.2.14 Reflected Cross-Site Scripting",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "[*, 2.2.15)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.15",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0201",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Shortcodes Actions And Filters \u003c= 2.0.9 - Cross-Site Request Forgery",
    "slug": "add-actions-and-filters",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44475",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44475",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hide Category by User Role for WooCommerce \u003c= 2.1.1 - Missing Authorization",
    "slug": "hide-category-by-user-role-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56272",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better Messages \u003c= 1.9.9.148 - Cross-Site Request Forgery",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "* - 1.9.9.148",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9.148",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-36389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36389",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "UserPlus \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "userplus",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0824",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accept Stripe Payments \u003c= 2.0.86 - Authenticated (Contributor+) Stored Cross-Site Scripting via accept_stripe_payment_ng Shortcode",
    "slug": "stripe-payments",
    "type": "plugin",
    "affected_version": "* - 2.0.86",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.86",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7353",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7353",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Team 118GROUP Agent \u003c= 1.6.0  - Missing Authorization to Unauthenticated Arbitrary Content Deletion",
    "slug": "team-118group-agent",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23512",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23512",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Min Max Step Quantity Limits Manager for WooCommerce \u003c= 5.1.0 - Cross-Site Request Forgery",
    "slug": "product-quantity-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49510",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Frontend Login and Registration Blocks \u003c= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover",
    "slug": "frontend-login-and-registration-blocks",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3605",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3605",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sirius \u003c= 1.0 - Cross-Site Scripting",
    "slug": "sirius",
    "type": "theme",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-4480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-4480",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Project \u0026 Document Manager  \u003c= 4.71 - Authenticated (Subscriber+) Directory Traversal",
    "slug": "sp-client-document-manager",
    "type": "plugin",
    "affected_version": "* - 4.71",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.71",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37224",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Curtain \u003c= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "curtain",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1558",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Frontend Admin by DynamiApps \u003c= 3.25.1 - Unauthenticated SQL Injection",
    "slug": "acf-frontend-form-element",
    "type": "plugin",
    "affected_version": "* - 3.25.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.25.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11722",
    "auth_type": "Unauth",
    "cvss_score": 5.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Woodmart \u003c= 7.1.1 - Cross-Site Request Forgery to License Update",
    "slug": "woodmart",
    "type": "theme",
    "affected_version": "* - 7.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32500",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Rife Elementor Extensions \u0026 Templates \u003c= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcode",
    "slug": "rife-elementor-extensions",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13564",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy FAQ with Expanding Text \u003c= 3.2.8.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "easy-faq-with-expanding-text",
    "type": "plugin",
    "affected_version": "* - 3.2.8.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1395",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.7.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10312",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10312",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Cerber Security \u003c= 9.0 - User Enumeration Bypass",
    "slug": "wp-cerber",
    "type": "plugin",
    "affected_version": "* - 9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2939",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2939",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Quick Restaurant Reservations \u003c= 1.5.4 - Cross-Site Request Forgery",
    "slug": "quick-restaurant-reservations",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-44739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44739",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads - Cross-Sell and Upsell \u003c= 1.1.2 - Reflected Cross-Site Scripting",
    "slug": "edd-cross-sell-and-upsell",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9510",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9510",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Image Uploader \u003c= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "wp-image-uploader",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13720",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Product Carousel Slider \u0026 Grid Ultimate for WooCommerce \u003c= 1.10.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "woo-product-carousel-slider-and-grid-ultimate",
    "type": "plugin",
    "affected_version": "* - 1.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24681",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CiyaShop - Multipurpose WooCommerce Theme \u003c= 4.19.0 - Unauthenticated PHP Object Injection",
    "slug": "ciyashop",
    "type": "theme",
    "affected_version": "* - 4.19.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.19.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13824",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Social Icons \u003c= 3.0.8 – Reflected Cross-Site Scripting",
    "slug": "easy-social-icons",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-39322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39322",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Dummy Content Generator \u003c= 3.2.1 - Unauthenticated Code Injection",
    "slug": "wp-dummy-content-generator",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32599",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WP JobSearch \u003c= 2.3.3 - Authentication Bypass",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6584",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "InstaWP Connect \u003c= 0.1.0.8 - Missing Authorization to Arbitrary Options Update",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-22145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22145",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Featured Image from URL \u003c= 4.8.2 - Missing Authorization",
    "slug": "featured-image-from-url",
    "type": "plugin",
    "affected_version": "* - 4.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37516",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.43 - Reflected Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2168",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Local Magic \u003c= 2.6.0 - Missing Authorization",
    "slug": "local-magic",
    "type": "plugin",
    "affected_version": "* - 2.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31858",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Prodigy Commerce \u003c= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "prodigy-commerce",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54250",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoices \u0026 Packing Slips \u003c= 2.10.4 - Reflected Cross-Site Scripting via tab and section parameter",
    "slug": "woocommerce-pdf-invoices-packing-slips",
    "type": "plugin",
    "affected_version": "[*, 2.10.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24991",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amazing Hover Effects \u003c= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "amazing-hover-effects",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38741",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38741",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User Toolkit \u003c= 1.2.3 - Authenticated (Subscriber+) Authentication Bypass",
    "slug": "user-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9890",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Envolve Plugin \u003c= 1.0 - Unauthenticated Arbitrary File Upload via language_file and fonts_file",
    "slug": "envolve-plugin",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11617",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Newsletter Manager \u003c 1.0.2 - Cross-Site Scripting via test_mail.php",
    "slug": "newsletter-manager",
    "type": "plugin",
    "affected_version": "[*, 1.0.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2012-6627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-6627",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder Pro \u003c= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "* - 3.20.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.20.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2120",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Zoho CRM Lead Magnet \u003c= 1.6.9.1 - Reflected Cross-Site Scripting",
    "slug": "zoho-crm-forms",
    "type": "plugin",
    "affected_version": "[*, 1.6.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-19306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19306",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP FullCalendar \u003c= 1.4.1 - Missing Authorization to Information Disclosure",
    "slug": "wp-fullcalendar",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3891",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Category and Products Accordion Panel \u003c= 1.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "accordion-panel-for-category-and-products",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-11722",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11722",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "New Adman \u003c= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "new-adman",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27439",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SEUR Oficial \u003c= 1.6.0 - Cross-Site Scripting",
    "slug": "seur",
    "type": "plugin",
    "affected_version": "[*, 1.7.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25005",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c=4.2.7 Contributor+ Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 4.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24257",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24257",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPO365 | MICROSOFT 365 GRAPH MAILER \u003c= 3.2 - Open Redirect via 'redirect_to' Parameter",
    "slug": "wpo365-msgraphmailer",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1488",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCafe \u003c= 2.2.31 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "wp-cafe",
    "type": "plugin",
    "affected_version": "* - 2.2.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.31",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30829",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Timber \u003c= 1.23.0 - Authenticated (Admin+) PHP Object Injection",
    "slug": "timber-library",
    "type": "plugin",
    "affected_version": "* - 1.23.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-29800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29800",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Axle Demo Importer \u003c= 1.0.3 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "axle-demo-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4954",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4954",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Knowledge Base \u003c= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "knowledgebase",
    "type": "plugin",
    "affected_version": "* - 2.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5533",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5533",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVG Captcha \u003c= 1.0.11 - Reflected Cross-Site Scripting",
    "slug": "svg-captcha",
    "type": "plugin",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49648",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz And Survey Master \u003c= 10.2.4 - Authenticated (Contributor+) SQL Injection",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 10.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "10.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-55708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-55708",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "RecipePress Reloaded \u003c= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "recipepress-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11414",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "InstaWP Connect \u003c= 0.1.0.24 - Missing Authorization",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32701",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32701",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LearnPress \u003c= 4.1.3 - Authenticated Stored Cross-Site Scripting",
    "slug": "learnpress",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24702",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24702",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Feed \u003c= 1.5.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode",
    "slug": "add-facebook",
    "type": "plugin",
    "affected_version": "* - 1.5.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5661",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBakery Page Builder \u003c= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 8.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4965",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Social Bar \u003c 1.1.7 - Cross-Site Scripting",
    "slug": "floating-social-bar",
    "type": "plugin",
    "affected_version": "[*, 1.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5528",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11713",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Backup Bolt \u003c= 1.4.1 - Authenticated (Admin+) Arbitrary File Download",
    "slug": "backup-bolt",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-10306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10306",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Wp Maximum Upload File Size \u003c= 1.1.3 - Authenticated (Author+) Full Path Disclosure",
    "slug": "wp-maximum-upload-file-size",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11265",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "NewStatPress \u003c= 1.3.5 - Reflected Cross-Site Scripting",
    "slug": "newstatpress",
    "type": "plugin",
    "affected_version": "[*, 1.3.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0206",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar \u003c= 1.1.23 - SQL Injection",
    "slug": "appointment-booking-calendar",
    "type": "plugin",
    "affected_version": "[*, 1.1.24)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.24",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-10916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10916",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Direct Checkout Button for WooCommerce \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woo-direct-checkout-button",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27347",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Shortcodes Plugin — Shortcodes Ultimate \u003c= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes",
    "slug": "shortcodes-ultimate",
    "type": "plugin",
    "affected_version": "* - 7.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7354",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2.4 - Cross-Site Request Forgery to Question Deletion",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4220",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Ninja Tables – Easiest Data Table Builder \u003c= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "ninja-tables",
    "type": "plugin",
    "affected_version": "* - 5.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7304",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pk Favicon Manager \u003c=2.1 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "phpsword-favicon-manager",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-34416",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34416",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Login with YourMembership - YM SSO Login \u003c= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes'",
    "slug": "login-with-yourmembership",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10648",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Taskbuilder \u003c= 3.0.8 - Authenticated (Admin+) SQL Injection",
    "slug": "taskbuilder",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9831",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Allada T-shirt Designer for Woocommerce \u003c= 1.1 - Missing Authorization",
    "slug": "allada-tshirt-designer-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22363",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Twitter Friends Widget \u003c= 3.1 - Reflected Cross-Site Scripting",
    "slug": "twitter-friends-widget",
    "type": "plugin",
    "affected_version": "* - 3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38322",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38322",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CHP Ads Block Detector \u003c= 3.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "chp-ads-block-detector",
    "type": "plugin",
    "affected_version": "* - 3.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2354",
    "auth_type": "Auth",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Click To Tweet \u003c= 2.0.14 - Missing Authorization",
    "slug": "click-to-tweet",
    "type": "plugin",
    "affected_version": "* - 2.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41857",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41857",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup Builder \u003c= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "* - 4.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2506",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fusion Lite \u003c= 3.37.18 – Cross-Site Request Forgery to Data Deletion",
    "slug": "wp-fusion-lite",
    "type": "plugin",
    "affected_version": "* - 3.37.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.37.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34661",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34661",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L"
  },
  {
    "title": "WooCommerce Product Table Lite \u003c= 3.5.1 - Missing Authorization to (Subscriber+) Stored Cross-Site Scripting",
    "slug": "wc-product-table-lite",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCode \u003c= 2.0.8 - Cross-Site Request Forgery",
    "slug": "insert-headers-and-footers",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1624",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WP Import Export Lite \u0026 WP Import Export \u003c= 3.9.15 - Unauthenticated Sensitive Data Disclosure",
    "slug": "wp-import-export-lite",
    "type": "plugin",
    "affected_version": "* - 3.9.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0236",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Awesome Filterable Portfolio \u003c= 1.9.7 - Missing Authorization to Plugin Settings Change",
    "slug": "awesome-filterable-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-35238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-35238",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "the-monday",
    "type": "theme",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "doko",
    "type": "theme",
    "affected_version": "* - 1.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "eight-sec",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "revolve",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "bingle",
    "type": "theme",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "parallaxsome",
    "type": "theme",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "uncode-lite",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "eightlaw-lite",
    "type": "theme",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "accesspress-lite",
    "type": "theme",
    "affected_version": "* - 2.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.92",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "fotography",
    "type": "theme",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "arrival",
    "type": "theme",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "vmag",
    "type": "theme",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "accesspress-mag",
    "type": "theme",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "sakala",
    "type": "theme",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "vmagazine-lite",
    "type": "theme",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "digital-agency-lite",
    "type": "theme",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "the-launcher",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "zigcy-lite",
    "type": "theme",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "brovy",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "eightmedi-lite",
    "type": "theme",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "wpparallax",
    "type": "theme",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "enlighten",
    "type": "theme",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "eightstore-lite",
    "type": "theme",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "accesspress-store",
    "type": "theme",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "swing-lite",
    "type": "theme",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "ripple",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "access-demo-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "punte",
    "type": "theme",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "accesspress-basic",
    "type": "theme",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "zigcy-baby",
    "type": "theme",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "scrollme",
    "type": "theme",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "zigcy-cosmetics",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "construction-lite",
    "type": "theme",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "vmagazine-news",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "accesspress-parallax-new",
    "type": "theme",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "accesspress-root",
    "type": "theme",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "storevilla",
    "type": "theme",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "ultra-seven",
    "type": "theme",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "the100",
    "type": "theme",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "edict-lite",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "wp-store",
    "type": "theme",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "opstore",
    "type": "theme",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation",
    "slug": "bloger",
    "type": "theme",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-23975",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23975",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "All-in-one Floating Contact Form – My Sticky Elements \u003c= 2.1.3 - Missing Authorization",
    "slug": "mystickyelements",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51362",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gutenberge Blocks \u003c= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "wpdm-gutenberg-blocks",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22713",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "aThemes Addons for Elementor \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "athemes-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22646",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infocob CRM Forms \u003c= 2.4.0 - Authenticated (Editor+) Arbitrary File Download",
    "slug": "infocob-crm-forms",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47513",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47513",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WOLF – WordPress Posts Bulk Editor and Manager Professional \u003c= 1.0.8.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.0.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34558",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pricing Table by Supsystic \u003c= 1.9.4 - Reflected Cross-Site Scripting",
    "slug": "pricing-table-by-supsystic",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-46782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-46782",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Solid Security \u003c= 9.3.1 - IP Address Spoofing to Denial of Service",
    "slug": "better-wp-security",
    "type": "plugin",
    "affected_version": "* - 9.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-44593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44593",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form 7 \u003c= 5.9.4 - Unauthenticated Open Redirect",
    "slug": "contact-form-7",
    "type": "plugin",
    "affected_version": "* - 5.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4704",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4704",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.49 - IP Blocking Bypass",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.49",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.49",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2362",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "W3SPEEDSTER \u003c= 7.25 - Cross-Site Request Forgery",
    "slug": "w3speedster-wp",
    "type": "plugin",
    "affected_version": "* - 7.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52392",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52392",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better Messages \u003c= 1.9.10.57 - Resource Exhaustion",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "* - 1.9.10.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10.57",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-33142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33142",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "WordPress Core \u003c 2.1 - Denial of Service",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2007-0539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-0539",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Creative Mail \u003c= 1.5.4 - Cross-Site Request Forgery",
    "slug": "creative-mail-by-constant-contact",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-44740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44740",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Flynax Bridge \u003c= 2.2.0 - Unauthenticated Limited Privilege Escalation",
    "slug": "flynax-bridge",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4179",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "s2Member Pro \u003c= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode",
    "slug": "s2member-pro",
    "type": "plugin",
    "affected_version": "* - 250214",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "250214",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-12563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12563",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Premium Packages - Sell Digital Products Securely \u003c= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode",
    "slug": "wpdm-premium-packages",
    "type": "plugin",
    "affected_version": "* - 5.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10164",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10164",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fluida \u003c= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fluida",
    "type": "theme",
    "affected_version": "* - 1.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44054",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Mailster \u003c 1.5.5 - Cross-Site Scripting",
    "slug": "wp-mailster",
    "type": "plugin",
    "affected_version": "[*, 1.5.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-17451",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-17451",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy restaurant menu manager \u003c= 1.1.2 - Cross-Site Scripting",
    "slug": "easy-pdf-restaurant-menu-upload",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15842",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15842",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FormFacade \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "formfacade",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25934",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 1.3.39 - Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 1.3.40)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.40",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10872",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10872",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor Lite \u003c= 4.5.3 - Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "[*, 4.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24255",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Jobs for WordPress \u003c= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "job-postings",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10104",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "bbPress Notify \u003c= 2.18.3 - Reflected Cross-Site Scripting",
    "slug": "bbpress-notify-nospam",
    "type": "plugin",
    "affected_version": "* - 2.18.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37485",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "aThemes Starter Sites \u003c= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "athemes-starter-sites",
    "type": "plugin",
    "affected_version": "* - 1.0.53",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.53",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6897",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.3 - Cross Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-20965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20965",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tutor LMS \u003c= 1.9.8 - Admin+ Stored Cross-Site Scripting",
    "slug": "tutor",
    "type": "plugin",
    "affected_version": "[*, 1.9.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24740",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24740",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Funnelforms Free \u003c= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "funnelforms-free",
    "type": "plugin",
    "affected_version": "* - 3.7.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6311",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Flexible Maps \u003c= 1.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flexible Maps Shortcode",
    "slug": "wp-flexible-map",
    "type": "plugin",
    "affected_version": "* - 1.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8622",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Columns Free \u003c 4.3 and Pro \u003c 5.5.1 Stored Cross-Site Scripting",
    "slug": "codepress-admin-columns",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24366",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Admin Columns Free \u003c 4.3 and Pro \u003c 5.5.1 Stored Cross-Site Scripting",
    "slug": "admin-columns-pro",
    "type": "plugin",
    "affected_version": "[*, 5.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24366",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.4.5 - Authenticated (Contributor+) Directory Traversal",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1974",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shield Security \u003c= 13.0.5 - Admin+ Stored Cross-Site Scripting",
    "slug": "wp-simple-firewall",
    "type": "plugin",
    "affected_version": "* - 13.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "13.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0211",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart External Link Click Monitor [Link Log] \u003c= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "link-log",
    "type": "plugin",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49770",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mapster WP Maps \u003c= 1.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mapster-wp-maps",
    "type": "plugin",
    "affected_version": "* - 1.2.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-21744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-21744",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Page Access Restriction \u003c= 1.0.21 - Improper Access Control to Sensitive Information Exposure via REST API",
    "slug": "simple-page-access-restriction",
    "type": "plugin",
    "affected_version": "* - 1.0.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0965",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Export Customers Data \u003c= 1.2.3 - Reflected Cross-Site Scripting",
    "slug": "export-customers-data",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12405",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Image Pro Post Grid \u003c= 5.14 - Reflected Cross-Site Scripting via page",
    "slug": "featured-image-pro",
    "type": "plugin",
    "affected_version": "* - 5.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32598",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blocks \u003c= 1.6.42 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "blocks",
    "type": "plugin",
    "affected_version": "* - 1.6.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-44262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44262",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Spreadsheet (wpSS) \u003c= 0.62 - Cross-Site Scripting",
    "slug": "wpSS",
    "type": "plugin",
    "affected_version": "* - 0.62",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.62",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-8364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8364",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSVPMaker for Toastmasters \u003c= 6.2.4 - Unauthenticated Arbitrary File Upload",
    "slug": "rsvpmaker-for-toastmasters",
    "type": "plugin",
    "affected_version": "* - 6.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50531",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50531",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Seriously Simple Podcasting \u003c= 3.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "seriously-simple-podcasting",
    "type": "plugin",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46261",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Infinite-Scroll \u003c= 2.6.2 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "infinite-scroll",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10040",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10040",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Info Cards – Gutenberg block for creating Beautiful Cards \u003c= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "info-cards",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26945",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BEAR \u003c= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion",
    "slug": "woo-bulk-editor",
    "type": "plugin",
    "affected_version": "* - 1.1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4923",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Plugin \u003c= 3.27.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ml-slider",
    "type": "plugin",
    "affected_version": "3.27.8",
    "from_version": "3.27.8",
    "from_inclusive": true,
    "to_version": "3.27.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2823",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LifterLMS \u003c= 7.5.0 - Cross-Site Request Forgery",
    "slug": "lifterlms",
    "type": "plugin",
    "affected_version": "* - 7.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31363",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Thumbtack Review Slider \u003c= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-thumbtack-review-slider",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58216",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps \u0026 Embed Any Documents in Gutenberg \u0026 Elementor \u003c= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color'",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2688",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2688",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP Config File Editor \u003c= 1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-config-file-editor",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24367",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grey Owl Lightbox \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "grey-owl-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11440",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Forms \u003c= 2.6.84 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "smart-forms",
    "type": "plugin",
    "affected_version": "* - 2.6.84",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.84",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-49856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49856",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Users Media \u003c= 4.2.3 - Missing Authorization via wpusme_save_settings",
    "slug": "wp-users-media",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27428",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "flickrRSS \u003c= 5.3.1 - Cross-Site Scripting via flickrRSS_set",
    "slug": "flickr-rss",
    "type": "plugin",
    "affected_version": "* - 5.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-6466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-6466",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "friends",
    "type": "plugin",
    "affected_version": "3.5.1",
    "from_version": "3.5.1",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7504",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CM Download Manager \u003c= 2.0.3 - Code Injection",
    "slug": "cm-download-manager",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-8877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-8877",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.10.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.10.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10310",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MercadoLibre Integration \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "mercadolibre-integration",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23659",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contus Video Comments \u003c= 1.0 - Remote File Upload",
    "slug": "contus-video-comments",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2016-1000112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000112",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.4.2 - Missing Authorization on REST-API",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2299",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Eyes Only: User Access Shortcode \u003c= 1.8.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "eyes-only-user-access-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25786",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Orbit Fox by ThemeIsle \u003c= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter",
    "slug": "themeisle-companion",
    "type": "plugin",
    "affected_version": "* - 2.10.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13183",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ID-SK Toolkit \u003c= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "idsk-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9853",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9853",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restaurant \u0026 Cafe Addon for Elementor \u003c= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "restaurant-cafe-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44032",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy WP Cleaner \u003c= 1.9 - Cross-Site Request Forgery",
    "slug": "easy-wp-cleaner",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41697",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Premium SEO Pack \u003c= 3.3.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "premium-seo-pack",
    "type": "plugin",
    "affected_version": "* - 3.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31044",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "EZ SQL Reports Shortcode Widget and DB Backup \u003c= 5.21.35 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "elisqlreports",
    "type": "plugin",
    "affected_version": "* - 5.21.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.21.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26887",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetElements \u003c= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion",
    "slug": "jet-elements",
    "type": "plugin",
    "affected_version": "* - 2.6.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.20",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7145",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Falang multilanguage \u003c= 1.3.61 - Cross-Site Request Forgery",
    "slug": "falang",
    "type": "plugin",
    "affected_version": "* - 1.3.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48285",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Custom Post Limits \u003c= 4.4.1 - Unauthenticated Full Path Disclosure",
    "slug": "custom-post-limits",
    "type": "plugin",
    "affected_version": "* - 4.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6544",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress \u003c= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpvr",
    "type": "plugin",
    "affected_version": "* - 8.5.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6350",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SlackSync \u003c= 1.8.5 - Sensitive Information Disclosure",
    "slug": "wpslacksync",
    "type": "plugin",
    "affected_version": "[*, 1.8.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-14366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14366",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Visualizer: Tables and Charts Manager for WordPress \u003c= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File",
    "slug": "visualizer",
    "type": "plugin",
    "affected_version": "* - 3.11.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1065",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.2.7 - Unauthenticated Blind SQL Injection via order_by Parameter",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.2.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-1055",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1055",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 \u003c 3.7.2 - CAPTCHA Bypass",
    "slug": "contact-form-7",
    "type": "plugin",
    "affected_version": "[*, 3.7.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-2265",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2265",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3743",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Review Stars Count For WooCommerce \u003c= 2.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "review-stars-count-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32687",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "YellowPencil Visual CSS Style Editor \u003c= 7.6.4 - Reflected Cross-Site Scripting",
    "slug": "yellow-pencil-visual-theme-customizer",
    "type": "plugin",
    "affected_version": "* - 7.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47348",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47348",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dynamic Visibility for Elementor \u003c= 5.0.5 - Missing Authorization to Authenticated(Subscriber+) Post Visibility Modification",
    "slug": "dynamic-visibility-for-elementor",
    "type": "plugin",
    "affected_version": "[*, 5.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-35046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35046",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Contact Form 7 reCAPTCHA \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "contact-form-7-recaptcha",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23972",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Html5 Audio Player \u003c= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "html5-audio-player",
    "type": "plugin",
    "affected_version": "* - 2.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0170",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hash Form – Drag \u0026 Drop Form Builder \u003c= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution",
    "slug": "hash-form",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-5084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5084",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARMember \u003c= 4.0.5 - Cross-Site Request Forgery",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3011",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "12 Step Meeting List \u003c= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "12-step-meeting-list",
    "type": "plugin",
    "affected_version": "* - 3.18.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.18.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54054",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accordion \u003c= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "accordions-wp",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5666",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Announcement \u003c= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sp-announcement",
    "type": "plugin",
    "affected_version": "* - 2.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38685",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "System Dashboard \u003c= 2.8.7 - Missing Authorization to Information Disclosure (sd_constants)",
    "slug": "system-dashboard",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5710",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5710",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function",
    "slug": "http-https-remover",
    "type": "plugin",
    "affected_version": "* - 3.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function",
    "slug": "copy-delete-posts",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function",
    "slug": "ultimate-social-media-plus",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function",
    "slug": "ultimate-posts-widget",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function",
    "slug": "pop-up-pop-up",
    "type": "plugin",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function",
    "slug": "redirect-redirection",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function",
    "slug": "wp-clone-by-wp-academy",
    "type": "plugin",
    "affected_version": "* - 2.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function",
    "slug": "ultimate-social-media-icons",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function",
    "slug": "feedburner-alternative-and-rss-redirect",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function",
    "slug": "enhanced-text-widget",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0958",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Theme My Ontraport Smartform \u003c= 1.2.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "theme-my-ontraport-smartform",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23717",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cerber Security \u003c= 8.9.5.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-cerber",
    "type": "plugin",
    "affected_version": "* - 8.9.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.9.5.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0429",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Custom Fields Pro \u003c= 6.2.9 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "advanced-custom-fields-pro",
    "type": "plugin",
    "affected_version": "* - 6.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-34762",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34762",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Insert or Embed Articulate Content into WordPress \u003c= 4.3000000023 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "insert-or-embed-articulate-content-into-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.3000000023",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3000000023",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5630",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stencies \u003c= 0.58 - Reflected Cross-Site Scripting",
    "slug": "stencies",
    "type": "plugin",
    "affected_version": "* - 0.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22356",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPCasa \u003c= 1.4.1 - Unauthenticated Code Injection",
    "slug": "wpcasa",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-9321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9321",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Mail Catcher \u003c= 2.1.6 - Cross-Site Request Forgery",
    "slug": "wp-mail-catcher",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32099",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32099",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shk Corporate \u003c= 2.4.1.1 - Missing Authorization",
    "slug": "shk-corporate",
    "type": "theme",
    "affected_version": "* - 2.4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58824",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58824",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "InPost Gallery \u003c= 2.1.4.1 - Reflected Cross-Site Scripting via 'imgurl'",
    "slug": "inpost-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28666",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28666",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Click \u0026 Pledge Connect \u003c= 25.04010101-WP6.8 - Unauthenticated SQL Injection to Privilege Escalation",
    "slug": "click-pledge-connect",
    "type": "plugin",
    "affected_version": "[*, 25.04010101-WP6.8]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "25.04010101-WP6.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-28983",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28983",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cognito Forms \u003c= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter",
    "slug": "cognito-forms",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10182",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Useful Banner Manager \u003c= 1.6.1 - Cross-Site Request Forgery",
    "slug": "useful-banner-manager",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1694",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Len Slider \u003c= 2.0.11 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "len-slider",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23810",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Radio Player \u003c= 2.0.73 - Missing Authorization via get_players",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "* - 2.0.73",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.73",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2906",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "sourceAFRICA \u003c= 0.1.3 - Cross-Site Scripting",
    "slug": "sourceafrica",
    "type": "plugin",
    "affected_version": "* - 0.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-6920",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-6920",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Partners \u003c= 0.2.0 - Reflected Cross-Site Scripting",
    "slug": "partners",
    "type": "plugin",
    "affected_version": "* - 0.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22751",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LatestCheckins \u003c= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "latestcheckins",
    "type": "plugin",
    "affected_version": "* - 1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7683",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Binary MLM Plan \u003c= 3.0 - Unauthenticated SQL Injection",
    "slug": "binary-mlm-plan",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47671",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Frontend File Manager \u003c= 23.2 - Missing Authorization to Authenticated (Subscriber+) Content Injection",
    "slug": "nmedia-user-file-uploader",
    "type": "plugin",
    "affected_version": "* - 23.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "23.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27358",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FormBuilder \u003c= 1.08 - Cross-Site Request Forgery",
    "slug": "formbuilder",
    "type": "plugin",
    "affected_version": "* - 1.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0830",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "LabelGrid Tools \u003c= 1.3.58 - Reflected Cross-Site Scripting",
    "slug": "label-grid-tools",
    "type": "plugin",
    "affected_version": "* - 1.3.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54341",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PixelYourSite \u003c= 9.3.6 and PixelYourSite Pro \u003c= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pixelyoursite-pro",
    "type": "plugin",
    "affected_version": "* - 9.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2584",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PixelYourSite \u003c= 9.3.6 and PixelYourSite Pro \u003c= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "pixelyoursite",
    "type": "plugin",
    "affected_version": "* - 9.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2584",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "What's New Generator \u003c= 2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "whats-new-genarator",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32548",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Xinterio \u003c= 4.2 - Unauthenticated Local File Inclusion",
    "slug": "xinterio",
    "type": "theme",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-54690",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54690",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hive Support – WordPress Help Desk \u003c= 1.1.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "hive-support",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54304",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar \u003c= 2.1.14 - Authenticated (Contributor+) Booking Deletion",
    "slug": "booking-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10124",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JupiterX Core \u003c= 3.3.8 - Unauthenticated Privilege Escalation",
    "slug": "jupiterx-core",
    "type": "plugin",
    "affected_version": "* - 3.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-38389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38389",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Buddybadges \u003c= 1.0.0 - Authenticated (Administrator+) SQL Injection",
    "slug": "buddybadges",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3925",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Tickets \u003c= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "my-tickets",
    "type": "plugin",
    "affected_version": "* - 2.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58988",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social proof testimonials and reviews by Repuso \u003c= 5.01 - Cross-Site Request Forgery",
    "slug": "social-testimonials-and-reviews-widget",
    "type": "plugin",
    "affected_version": "* - 5.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45048",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Media Downloader \u003c= 0.1.992 - Reflected Cross-Site Scripting",
    "slug": "media-downloader",
    "type": "plugin",
    "affected_version": "* - 0.1.992",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.992",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-125090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-125090",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quotes and Tips by BestWebSoft \u003c 1.20 - Cross-Site Scripting",
    "slug": "quotes-and-tips",
    "type": "plugin",
    "affected_version": "[*, 1.20)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9385",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Live2DWebCanvas \u003c= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "live-2d",
    "type": "plugin",
    "affected_version": "* - 1.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13767",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Admin Customization \u003c= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wpp-customization",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54431",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54431",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Hours Pro \u003c= 5.5.0 - Arbitrary File Upload",
    "slug": "iva-business-hours-pro",
    "type": "plugin",
    "affected_version": "* - 5.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24240",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Instant Locations \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "instant-locations",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58886",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NitroPack \u003c= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update",
    "slug": "nitropack",
    "type": "plugin",
    "affected_version": "* - 1.17.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.17.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11848",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements \u0026 Interactive Content \u003c= 0.6.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "brave-popup-builder",
    "type": "plugin",
    "affected_version": "* - 0.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35655",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Perfmatters \u003c 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "perfmatters",
    "type": "plugin",
    "affected_version": "[*, 2.2.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-47877",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47877",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pinpoint Booking System \u003c= 2.9.9.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "booking-system",
    "type": "plugin",
    "affected_version": "* - 2.9.9.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49304",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RomethemeKit For Elementor \u003c= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates",
    "slug": "rometheme-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10324",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Webpushr \u003c= 4.34.0 - Cross-Site Request Forgery to Local File Inclusion via menu",
    "slug": "webpushr-web-push-notifications",
    "type": "plugin",
    "affected_version": "* - 4.34.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.34.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-35041",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35041",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce HTML5 Video \u003c= 1.7.10 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-html5-video",
    "type": "plugin",
    "affected_version": "* - 1.7.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27343",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Masteriyo - LMS \u003c= 1.11.4 - Missing Authorization",
    "slug": "learning-management-system",
    "type": "plugin",
    "affected_version": "* - 1.11.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43158",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43158",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AtomChat \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atomchat Shortcode",
    "slug": "atomchat",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10232",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10232",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP eCommerce \u003c= 3.15.1 - Unauthenticated SQL Injection",
    "slug": "wp-e-commerce",
    "type": "plugin",
    "affected_version": "* - 3.15.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.15.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-1514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1514",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Holding Pattern \u003c= 0.6 - Arbitrary File Upload",
    "slug": "holding_pattern",
    "type": "theme",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-1172",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-1172",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Pipes \u003c= 1.4.3 - Unauthenticated Local File Inclusion",
    "slug": "wp-pipes",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28979",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HREFLANG Tags Lite \u003c= 2.0.0 - Missing Authorization to Data Reset",
    "slug": "hreflang-tags-by-dcgws",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36418",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36418",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Themify Edmin \u003c= 2.0.0 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "edmin",
    "type": "theme",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31047",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form to Any API \u003c= 1.1.6 - Missing Authorization via delete_cf7_records()",
    "slug": "contact-form-to-any-api",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47871",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Easy Forms for Mailchimp \u003c= 6.5.2 - Code Injection",
    "slug": "yikes-inc-easy-mailchimp-extender",
    "type": "plugin",
    "affected_version": "[*, 6.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-15318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15318",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Universal Analytics Injector \u003c= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "universal-analytics-injector",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23483",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mail Masta \u003c= 1.0 - SQL Injection via id parameter",
    "slug": "mail-masta",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-6571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6571",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MaxiBlocks \u003c= 2.1.3 - Missing Authorization",
    "slug": "maxi-blocks",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58968",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AI Image Generator for Your Content \u0026 Featured Images – AI Postpix \u003c= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "ai-postpix",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49671",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49671",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pago por Redsys \u003c= 1.0.12 - Reflected Cross-Site Scripting",
    "slug": "pago-redsys-tpv-grafreak",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12467",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Maintenance Mode \u003c= 1.8.7 - Missing Authorization Checks \u0026 Cross-Site Request Forgery",
    "slug": "wp-maintenance-mode",
    "type": "plugin",
    "affected_version": "[*, 1.8.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-3250",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3250",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Brutal AI \u003c 2.06 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wpbrutalai",
    "type": "plugin",
    "affected_version": "[*, 2.06)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.06",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2606",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2606",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsCSS Addons for Elementor \u003c= 1.0.8.7 - Unauthenticated Server-Side Request Forgery",
    "slug": "css-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31796",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Review Slider \u003c= 11.7 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-google-places-review-slider",
    "type": "plugin",
    "affected_version": "* - 11.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0259",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP User Manager \u003c= 2.6.2 - Arbitrary User Password Reset",
    "slug": "wp-user-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24655",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24655",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kallyas \u003c= 4.21.0 - Authenticated (Contributor+) Arbitrary Folder Deletion",
    "slug": "kallyas",
    "type": "theme",
    "affected_version": "* - 4.21.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.21.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-6989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6989",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "3D Presentation \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "3d-presentation",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51578",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Conferencing with Zoom \u003c= 4.2.1 - Sensitive Information Exposure",
    "slug": "video-conferencing-with-zoom-api",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-3947",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3947",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Flexible Shipping \u003c= 4.24.15 - Missing Authorization",
    "slug": "flexible-shipping",
    "type": "plugin",
    "affected_version": "* - 4.24.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32828",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0659",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "F12-Profiler \u003c= 1.3.9 - Cross-Site Request Forgery",
    "slug": "f12-profiler",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27340",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ImageRecycle pdf \u0026 image compression \u003c= 3.1.16 - Reflected Cross-Site Scripting",
    "slug": "imagerecycle-pdf-image-compression",
    "type": "plugin",
    "affected_version": "* - 3.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54266",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Otter Blocks PRO \u003c= 2.6.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via File Field CSS",
    "slug": "otter-pro",
    "type": "plugin",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1684",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShipDepot for WooCommerce \u003c= 1.2.19 - Missing Authorization",
    "slug": "ship-depot",
    "type": "plugin",
    "affected_version": "* - 1.2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31866",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contest Gallery – Upload, Vote \u0026 Sell with PayPal and Stripe \u003c= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 27.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "27.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10383",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slider Hero \u003c= 8.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "slider-hero",
    "type": "plugin",
    "affected_version": "* - 8.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3074",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3074",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.4.0 - Missing Authorization",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "* - 7.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35049",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35049",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Affiliate Super Assistent \u003c= 1.5.1 - Cross-Site Request Forgery to Settings Update and Cache Clearing",
    "slug": "amazonsimpleadmin",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27417",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ultimate Addons for WPBakery Page Builder \u003c= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "Ultimate_VC_Addons",
    "type": "plugin",
    "affected_version": "* - 3.19.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5255",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elespare – Build Your Blog, News \u0026 Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! \u003c= 2.1.2 - Missing Authorization to Subscriber+ Arbitrary Post Creation",
    "slug": "elespare",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0900",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Review Ratings \u003c= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ratings-shorttags",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8052",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Word Search Puzzles game \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wha-wordsearch",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36383",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Bridge Core \u003c= 3.3 - Missing Authorization",
    "slug": "bridge-core",
    "type": "plugin",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24744",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24744",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Gallery – Image and Video Gallery with Thumbnails \u003c= 2.0.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "gallery-album",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47603",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47603",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Eventer \u003c= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download",
    "slug": "eventer",
    "type": "plugin",
    "affected_version": "* - 3.9.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11133",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "king_IE \u003c= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "king-ie",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9125",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IP2Location Variables \u003c= 2.9.5 - Cross-Site Request Forgery",
    "slug": "ip2location-variables",
    "type": "plugin",
    "affected_version": "* - 2.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39455",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39455",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ninja Forms \u003c= 3.8.6 - Cross-Site Request Forgery",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-39628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-39628",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "3D FlipBook \u003c= 1.12.0 - Subscriber+ Stored Cross-Site Scripting",
    "slug": "interactive-3d-flipbook-powered-physics-engine",
    "type": "plugin",
    "affected_version": "[*, 1.12.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0423",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NS Coupon to Become Customer \u003c= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "ns-coupon-to-become-customer",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27422",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Storely \u003c= 18 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "storely",
    "type": "theme",
    "affected_version": "* - 18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10847",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Golo \u003c= 1.7.0 - Authentication Bypass to Account Takeover",
    "slug": "golo",
    "type": "theme",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4797",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Utilities for MTG \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "utilities-for-mtg",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13433",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13433",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Calendar \u003c= 3.4.23 - Authenticated (Admin+) Stored Cross-Site Scripting via Events",
    "slug": "my-calendar",
    "type": "plugin",
    "affected_version": "* - 3.4.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1274",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1274",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quote me \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "quote-me",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23711",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple:Press \u003c= 6.10.5 - Missing Authorization",
    "slug": "simplepress",
    "type": "plugin",
    "affected_version": "* - 6.11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.11.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31386",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31386",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElementsReady Addons for Elementor \u003c= 5.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "element-ready-lite",
    "type": "plugin",
    "affected_version": "* - 5.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34374",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Art Decoration Shortcode \u003c= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "art-decoration-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37994",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37994",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Network-Favorites \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "network-favorites",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23737",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23737",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smaily for WP \u003c= 3.1.6 - Cross-Site Request Forgery",
    "slug": "smaily-for-wp",
    "type": "plugin",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47684",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47684",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Block Spam By Math Reloaded \u003c= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "block-spam-by-math-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28871",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28871",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form-Maker (twb_form-maker) \u003c= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0667",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0667",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP All Import \u003c= 3.4.6 - Cross-Site Scripting",
    "slug": "wp-all-import",
    "type": "plugin",
    "affected_version": "[*, 3.4.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-0547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-0547",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Question Answer \u003c= 1.2.70 - Missing Authorization",
    "slug": "question-answer",
    "type": "plugin",
    "affected_version": "* - 1.2.70",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.70",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31810",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Kognetiks Chatbot \u003c= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing",
    "slug": "chatbot-chatgpt",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11256",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "코드엠샵 소셜톡 \u003c= 1.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via add_plus_friends and add_plus_talk Shortcodes",
    "slug": "mshop-naver-talktalk",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11229",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11229",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.5.5 - Authenticated SQL Injection",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "[*, 2.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-20678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20678",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.2.42 - Unauthenticated SQL Injection",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "3.2.42",
    "from_version": "3.2.42",
    "from_inclusive": true,
    "to_version": "3.2.42",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-2840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2840",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.2.42 - Unauthenticated SQL Injection",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-2840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2840",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Zephyr Project Manager \u003c= 3.2.42 - Unauthenticated SQL Injection",
    "slug": "zephyr-project-manager",
    "type": "plugin",
    "affected_version": "3.2.41",
    "from_version": "3.2.41",
    "from_inclusive": true,
    "to_version": "3.2.41",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-2840",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2840",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin \u003c 1.5.63 - Cross-Site Scripting",
    "slug": "users-ultra",
    "type": "plugin",
    "affected_version": "[*, 1.5.63)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.63",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9393",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9393",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traveler \u003c= 3.2.0 - Missing Authorization",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26956",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Flex Guten \u003c= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter",
    "slug": "flex-guten",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6256",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6256",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c 3.3.0 - Reflected Cross-Site Scripting",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "[*, 3.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-9420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-9420",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "QR Master \u003c= 1.0.5 - Reflected Cross-Site Scripting",
    "slug": "qr-master",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32116",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download-Mirror-Counter \u003c= 1.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-download-mirror-counter",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51621",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51621",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Custom Field Template \u003c= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via $search_label",
    "slug": "custom-field-template",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25919",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cookie Notice \u0026 Compliance for GDPR / CCPA \u003c= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "cookie-notice",
    "type": "plugin",
    "affected_version": "[*, 2.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24569",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24569",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Subscribe \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "ultimate-subscribe",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23806",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kaswara Modern VC Addons \u003c= 3.0.1 - Missing Authorization",
    "slug": "kaswara",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4448",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4448",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Flexible PDF Invoices for WooCommerce \u0026amp; WordPress \u003c= 6.0.13 - Cross-Site Request Forgery",
    "slug": "flexible-invoices",
    "type": "plugin",
    "affected_version": "* - 6.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57977",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57977",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Backup to Dropbox \u003c 4.1 - Reflected Cross-Site Scripting",
    "slug": "wordpress-backup-to-dropbox",
    "type": "plugin",
    "affected_version": "[*, 4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9310",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "tagDiv Opt-In Builder \u003c= 1.4.4 - Authenticated (Admin+) SQL Injection",
    "slug": "td-subscription",
    "type": "plugin",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3419",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Media Hygiene \u003c= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion",
    "slug": "media-hygiene",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5855",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Ninja Forms \u003c= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.10.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5398",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ImageLinks \u003c= 1.5.4 - Authenticated (Admin+) SQL Injection",
    "slug": "imagelinks-interactive-image-builder-lite",
    "type": "plugin",
    "affected_version": "* - 1.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-46823",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46823",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Minterpress \u003c= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "minterpress",
    "type": "plugin",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54379",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Comments Extra Fields For Post,Pages and CPT \u003c= 5.0 - Missing Authorization",
    "slug": "wp-comment-fields",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0829",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Nextend Social Login and Register \u003c= 3.1.12 - Reflected Self-Based Cross-Site Scripting via error_description",
    "slug": "nextend-facebook-connect",
    "type": "plugin",
    "affected_version": "* - 3.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1775",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Mortgage Calculator Estatik \u003c= 2.0.11 - Reflected Cross-Site Scripting",
    "slug": "estatik-mortgage-calculator",
    "type": "plugin",
    "affected_version": "* - 2.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28490",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZM Ajax Login \u0026 Register \u003c= 1.0.9 - Local File Inclusion",
    "slug": "zm-ajax-login-register",
    "type": "plugin",
    "affected_version": "[*, 1.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-4153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4153",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP \u003c 4.29.5 - Arbitrary File Read/Deletion",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "[*, 4.29.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.29.5",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2014-1907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-1907",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rebuild Permalinks \u003c= 1.6 - Reflected Cross-Site Scripting",
    "slug": "rebuild-permalinks",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27346",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27346",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "List Pages at Depth \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "list-pages-at-depth",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22517",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Push Notification for Post and BuddyPress \u003c= 1.93 - Unauthenticated SQL Injection",
    "slug": "push-notification-for-post-and-buddypress",
    "type": "plugin",
    "affected_version": "* - 1.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.93",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6159",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Simple Banner \u003c= 3.0.10 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "simple-banner",
    "type": "plugin",
    "affected_version": "* - 3.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-12033",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-12033",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LogisticsHub \u003c= 1.1.6 - Unauthenticated Arbitrary File Upload",
    "slug": "logistics-hub",
    "type": "theme",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-30933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30933",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "wp-tmkm-amazon \u003c 1.5.3 - Cross-Site Scripting",
    "slug": "wp-tmkm-amazon",
    "type": "plugin",
    "affected_version": "[*, 1.5.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-4598",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4598",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "ThirstyAffiliates Affiliate Link Manager \u003c= 3.10.4 - Authorization Bypass and Cross-Site Request Forgery",
    "slug": "thirstyaffiliates",
    "type": "plugin",
    "affected_version": "* - 3.10.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0634",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0634",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Simple Header and Footer \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "simple-header-and-footer",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53777",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hotspot by DevVN \u003c= 1.2.5 - Authenticated (Author+) PHP Object Injection",
    "slug": "devvn-image-hotspot",
    "type": "plugin",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7656",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7656",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bulk Edit Post Titles \u003c= 5.0.0 - Missing Authorization",
    "slug": "bulk-edit-post-titles",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49754",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49754",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Theme Tuner \u003c 0.8 - Remote File Inclusion",
    "slug": "theme-tuner",
    "type": "plugin",
    "affected_version": "[*, 0.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2012-0934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-0934",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bulk NoIndex \u0026 NoFollow Toolkit \u003c= 2.16 - Reflected Cross-Site Scripting",
    "slug": "bulk-noindex-nofollow-toolkit-by-mad-fish",
    "type": "plugin",
    "affected_version": "* - 2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31537",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DF Draggable \u003c= 1.13.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "df-draggable",
    "type": "plugin",
    "affected_version": "* - 1.13.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23708",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Betheme \u003c= 27.5.6 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "betheme",
    "type": "theme",
    "affected_version": "* - 27.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "27.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-2694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2694",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Export Post Info \u003c= 1.2.0 - Authenticated (Author+) CSV Injection",
    "slug": "export-post-info",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38061",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 2.7.11 - Cross-Site Request Forgery",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 2.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34178",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34178",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Integrate Google Drive \u003c= 1.3.4 - Cross-Site Request Forgery",
    "slug": "integrate-google-drive",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49769",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49769",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "jQuery Colorbox \u003c= 4.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jquery-colorbox",
    "type": "plugin",
    "affected_version": "* - 4.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3650",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login/Signup Popup \u003c 1.5 - Missing Authorization",
    "slug": "easy-login-woocommerce",
    "type": "plugin",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-36715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36715",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Private Content  \u003c= 8.11.5 - Authenticated (Subscriber+) SQL Injection",
    "slug": "private-content",
    "type": "plugin",
    "affected_version": "* - 8.11.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.11.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26976",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4378",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.9.10 - Contributor+ Stored Cross-Site Scripting via Shortcodes",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "* - 3.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24694",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.12",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.5",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.3",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.15",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.13",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.12",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.9",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.4",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.6.1 - Authenticated Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.15",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-7168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-7168",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy WP SMTP \u003c= 1.2.4 - Cross-Site Scripting",
    "slug": "easy-wp-smtp",
    "type": "plugin",
    "affected_version": "[*, 1.2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-7723",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-7723",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Teaser \u003c= 4.1.5 - Cross-Site Request Forgery",
    "slug": "post-teaser",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-45811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45811",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Contact Form 7 Database Addon – CFDB7 \u003c= 1.2.6.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "contact-form-cfdb7",
    "type": "plugin",
    "affected_version": "* - 1.2.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36885",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Builder \u003c= 7.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themify-builder",
    "type": "plugin",
    "affected_version": "* - 7.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52423",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DeBounce Email Validator \u003c= 5.7 - Unauthenticated Local File Inclusion",
    "slug": "debounce-io-email-validator",
    "type": "plugin",
    "affected_version": "* - 5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31098",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31098",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Mayosis Core \u003c= 5.4.1 - Unauthenticated Arbitrary File Read",
    "slug": "mayosis-core",
    "type": "plugin",
    "affected_version": "* - 5.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1565",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c=1.3.55 - Authenticated (Subscriber+) Arbitrary Post Deletion",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.55",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4102",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Misiek Paypal \u003c= 1.1.20090324 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "misiek-paypal",
    "type": "plugin",
    "affected_version": "* - 1.1.20090324",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.20090324",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7861",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MW Font Changer \u003c= 4.2.5 - Reflected Cross-Site Scripting",
    "slug": "parsi-font",
    "type": "plugin",
    "affected_version": "[*, 4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-1000142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000142",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flex Local Fonts \u003c= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "fsflex-local-fonts",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24782",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PowerPress  \u003c= 6.0.4 - Reflected Cross-Site Scripting",
    "slug": "powerpress",
    "type": "plugin",
    "affected_version": "* - 6.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9410",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AI Engine \u003c= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0699",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0699",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shortlinks by Pretty Links \u003c= 3.4.0 - Cross-Site Request Forgery via route",
    "slug": "pretty-link",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47149",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47149",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Upsell Funnel Builder for WooCommerce \u003c= 3.0.0 - Unauthenticated Order Manipulation",
    "slug": "upsell-order-bump-offer-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3743",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Give – Divi Donation Modules \u003c= 2.0.0 - Sensitive Information Dislcosure",
    "slug": "give-donation-modules-for-divi",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22633",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "AliExpress Dropshipping with AliNext Lite \u003c= 3.3.6 - Missing Authorization via Several Functions",
    "slug": "ali2woo-lite",
    "type": "plugin",
    "affected_version": "* - 3.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4450",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Product Notices for WooCommerce \u003c= 1.3.3 - Cross-Site Request Forgery",
    "slug": "product-notices-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31807",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Event Espresso Free/Lite \u003c= 3.1.37.12.L - Unauthenticated SQL Injection",
    "slug": "event-espresso-free",
    "type": "plugin",
    "affected_version": "* - 3.1.37.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.37.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14760",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Event Espresso Free/Lite \u003c= 3.1.37.12.L - Unauthenticated SQL Injection",
    "slug": "event-espresso-free",
    "type": "plugin",
    "affected_version": "* - 3.1.37.12.L",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.37.12.L",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2017-14760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-14760",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Almera Responsive Portfolio Site Template \u003c 1.1.8 - Sensitive Information Disclosure",
    "slug": "almera",
    "type": "theme",
    "affected_version": "[*, 1.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9487",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Simple Load More \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "simple-load-more",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49662",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49662",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share Icons \u0026 Social Share Buttons \u003c= 3.6.2 - Missing Authorization to Notice Dismissal",
    "slug": "ultimate-social-media-plus",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32820",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iThemes Sync \u003c= 2.1.13 - Cross-Site Request Forgery and Missing Authorization via 'hide_authenticate_notice'",
    "slug": "ithemes-sync",
    "type": "plugin",
    "affected_version": "[*, 2.1.14)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.14",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-40001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40001",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OMGF \u003c= 4.5.3 - Subscriber+ Arbitrary File/Folder Deletion",
    "slug": "host-webfonts-local",
    "type": "plugin",
    "affected_version": "* - 4.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24639",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Easy Digital Downloads Google Sheet Connector \u003c= 1.6.6 - Cross-Site Request Forgery to Access Code Update",
    "slug": "edd-google-sheet-connector-pro",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2334",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads Google Sheet Connector \u003c= 1.6.6 - Cross-Site Request Forgery to Access Code Update",
    "slug": "gsheetconnector-easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2334",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GiveWP – Donation Plugin and Fundraising Platform \u003c= 3.19.4 - Unauthenticated PHP Object Injection",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 3.19.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.19.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-0912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0912",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Publitio \u003c= 2.2.1 - Authenticated (Contributor+) Arbitrary File Read",
    "slug": "publitio",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31800",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.38 - Unauthenticated Brute Force of File Master Key",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "[*, 3.2.39)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.39",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-0828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0828",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Print Page block \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "print-page",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30438",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lafka - Multi Store Burger - Pizza \u0026 Food Delivery WooCommerce Theme \u003c= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import",
    "slug": "lafka",
    "type": "theme",
    "affected_version": "* - 4.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13811",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MapSVG \u003c= 8.5.34 - Authenticated (Contributor+) Privilege Esclation",
    "slug": "mapsvg",
    "type": "plugin",
    "affected_version": "* - 8.5.34",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5.34",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-47561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47561",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TI WooCommerce Wishlist \u003c= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access",
    "slug": "ti-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10567",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10567",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Cart66 Lite :: WordPress Ecommerce \u003c= 1.5.3 - SQL Injection",
    "slug": "cart66-lite",
    "type": "plugin",
    "affected_version": "[*, 1.5.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9442",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9442",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SK WP Settings Backup \u003c= 1.0 - Cross-Site Request Forgery to PHP Object Injection",
    "slug": "sk-wp-settings-backup",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52415",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52415",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "OptinMonster \u003c= 2.6.4 - Unprotected REST-API Endpoints",
    "slug": "optinmonster",
    "type": "plugin",
    "affected_version": "* - 2.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39341",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39341",
    "auth_type": "Unauth",
    "cvss_score": 8.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "404 Solution \u003c= 2.35.17 - Missing Authentication to Sensitive Information Exposure",
    "slug": "404-solution",
    "type": "plugin",
    "affected_version": "* - 2.35.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.35.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11094",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Everest Forms – Contact Forms, Quiz, Survey, Newsletter \u0026 Payment Form Builder for WordPress \u003c= 3.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "everest-forms",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13125",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WebHotelier \u003c= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "webhotelier",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49299",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49299",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Publication Archive  \u003c= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-publication-archive",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58826",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DeBounce Email Validator \u003c= 5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "debounce-io-email-validator",
    "type": "plugin",
    "affected_version": "* - 5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13339",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13339",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CallRail Phone Call Tracking \u003c= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "callrail-phone-call-tracking",
    "type": "plugin",
    "affected_version": "* - 0.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5051",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5051",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quotes llama \u003c= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quotes-llama",
    "type": "plugin",
    "affected_version": "* - 3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traveler \u003c= 3.1.8  - Reflected Cross-Site Scripting",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "* - 3.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1773",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1773",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Front-end login and register \u003c= 2.1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-front-end-login-and-register",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11405",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Social Icons \u003c= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "easy-social-icons",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-2084",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2084",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Fashion - Model Agency One Page Beauty Theme \u003c= 1.4.4 - Unauthenticated PHP Object Injection",
    "slug": "nrgfashion",
    "type": "theme",
    "affected_version": "* - 1.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31052",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31052",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "InWave Jobs \u003c= 3.5.8 - Missing Authorization",
    "slug": "iwjob",
    "type": "plugin",
    "affected_version": "* - 3.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39477",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JetTabs \u003c= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-tabs",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39450",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Hover Effects Block \u003c= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "image-hover-effects-block",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31025",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31025",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Squeeze \u003c= 1.6 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "squeeze",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-31002",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31002",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Link Log – external link click monitor \u003c 2.1 - SQL Injection",
    "slug": "link-log",
    "type": "plugin",
    "affected_version": "[*, 2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9344",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MasterStudy LMS WordPress Plugin – for Online Courses and Education \u003c= 3.2.10 - Basic Information Exposure via REST route",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2106",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2106",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Slash Admin  \u003c= 3.8.1 - Cross-Site Request Forgery",
    "slug": "slash-admin",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32958",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Order Notification for Telegram \u003c= 1.0.1 - Missing Authorization to Unauthenticated Send Telegram Test Message",
    "slug": "order-notification-for-telegram",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9686",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Aparat Video Shortcode \u003c= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "aparat-shortcode",
    "type": "plugin",
    "affected_version": "* - 0.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58876",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SensorPress \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sensorpress-uptime-monitoring",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49409",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Post Carousels with Owl  \u003c= 1.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dd-post-carousel",
    "type": "plugin",
    "affected_version": "* - 1.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5125",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Full Screen Menu for Elementor \u003c= 1.0.7 - Authenticated (Contributor+) Post Disclosure",
    "slug": "full-screen-menu-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10797",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "BadgeOS \u003c= 3.7.1.6 - Missing Authorization",
    "slug": "badgeos",
    "type": "plugin",
    "affected_version": "* - 3.7.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47647",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Accordions – Multiple Accordions or FAQs Builder \u003c= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting in post_oxi_settings function",
    "slug": "accordions-or-faqs",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45082",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45082",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Album Gallery – WordPress Gallery \u003c= 1.4.9 - Cross-Site Request Forgery via album-gallery-column-settings.php",
    "slug": "new-album-gallery",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23646",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion",
    "slug": "melapress-login-security-premium",
    "type": "plugin",
    "affected_version": "2.1.0",
    "from_version": "2.1.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2876",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion",
    "slug": "melapress-login-security",
    "type": "plugin",
    "affected_version": "2.1.0",
    "from_version": "2.1.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2876",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP TFeed \u003c= 1.6.9 - Cross-Site Request Forgery via aptf_delete_cache",
    "slug": "accesspress-twitter-feed",
    "type": "plugin",
    "affected_version": "* - 1.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26518",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26518",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – Unishippers Edition \u003c= 2.5.8 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-unishippers-edition",
    "type": "plugin",
    "affected_version": "* - 2.5.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13477",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13477",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP-Lister Lite for Amazon \u003c= 2.6.16 - Reflected Cross-Site Scripting",
    "slug": "wp-lister-for-amazon",
    "type": "plugin",
    "affected_version": "* - 2.6.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37261",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Submission DOM tracking for Contact Form 7 \u003c= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "cf7-submission-dom-tracking",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47626",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JobSearch \u003c= 2.5.3 - Unauthenticated PHP Object Injection",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 2.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43931",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Save as PDF Plugin by Pdfcrowd \u003c= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "save-as-pdf-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10891",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10891",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Job Board Manager \u003c= 2.1.60 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "job-board-manager",
    "type": "plugin",
    "affected_version": "* - 2.1.60",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.60",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32144",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32144",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TubePress \u003c 1.6.5 - Cross-Site Scripting",
    "slug": "tubepress",
    "type": "plugin",
    "affected_version": "* - 1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2008-7321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2008-7321",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Falang multilanguage \u003c= 1.3.47 - Authenticated (Administrator+) SQL Injection",
    "slug": "falang",
    "type": "plugin",
    "affected_version": "* - 1.3.47",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.47",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-30495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30495",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shop Products Filter \u003c= 1.2 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "trusty-woo-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32585",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32585",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CBI Referral Manager \u003c= 1.2.1 Cross-Site Scripting",
    "slug": "cbi-referral-manager",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4517",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eshop \u003c= 6.3.13 - Cross-Site Forgery Request and Reflected Cross-Site Scripting",
    "slug": "eshop",
    "type": "plugin",
    "affected_version": "* - 6.3.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9413",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Beds24 Online Booking \u003c= 2.0.24 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "beds24-online-booking",
    "type": "plugin",
    "affected_version": "* - 2.0.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52228",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52228",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gold Addons for Elementor \u003c= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gold-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34563",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DW Promobar \u003c= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "dw-promobar",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2423",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UpdraftPlus WordPress Backup Plugin \u003c 1.6.59 - Stored Cross-Site Scripting",
    "slug": "updraftplus",
    "type": "plugin",
    "affected_version": "[*, 1.6.59)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.59",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24423",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Complete Open Graph \u003c= 3.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "complete-open-graph",
    "type": "plugin",
    "affected_version": "* - 3.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45010",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Infinite Scroll – Ajax Load More \u003c= 5.5.3 - Directory Traversal",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 5.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2945",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Elementor Addons, Widgets and Enhancements – Stax \u003c= 1.4.3 - Cross-Site Request Forgery via toggle_widget",
    "slug": "stax-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1807",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Workreap \u003c= 2.6.3 - Insecure Direct Object Reference",
    "slug": "workreap",
    "type": "theme",
    "affected_version": "* - 2.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4239",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "PrivateContent  \u003c= 8.4.3 - Protection Mechanism Bypass",
    "slug": "private-content",
    "type": "plugin",
    "affected_version": "* - 8.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0581",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \u003c= 2.8.7 - Authorization Bypass via type connect-app API",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 2.8.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6875",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6875",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Real Estate Manager \u003c= 7.3 - Unauthenticated Remote Code Execution",
    "slug": "real-estate-manager",
    "type": "plugin",
    "affected_version": "* - 7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32596",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32596",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "JobSearch WP Job Board \u003c = 1.8.1 - Missing Authorization on jobsearch_update_job_import_schedule_call() function",
    "slug": "wp-jobsearch",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4364",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Last Updated Shortcode \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "last-updated-shortcode",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58683",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58683",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Neon - Bootstrap Admin Theme \u003c= 2.0 - Cross-Site Scripting",
    "slug": "neon",
    "type": "theme",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-20141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20141",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My wpdb \u003c= 1.1.12 - Cross-Site Request Forgery to Arbitrary SQL Query Execution",
    "slug": "my-wpdb",
    "type": "plugin",
    "affected_version": "[*, 2.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1578",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sina Extension for Elementor \u003c= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form Shortcodes",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1517",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smallerik File Browser \u003c= 1.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "smallerik-file-browser",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23918",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PhotoCrati Theme \u003c= 4.0 - SQL Injection",
    "slug": "photocrati-theme",
    "type": "theme",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-2216",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2216",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Memberlite Shortcodes \u003c= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "memberlite-shortcodes",
    "type": "plugin",
    "affected_version": "[*, 1.3.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-5237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5237",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Smart Import : Import any XML File to WordPress \u003c= 1.0.7 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wp-smart-import",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32597",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smash Balloon Social Post Feed \u003c= 4.0 - Arbitrary Plugin Settings Update to Stored Cross-Site Scripting",
    "slug": "custom-facebook-feed",
    "type": "plugin",
    "affected_version": "[*, 4.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24918",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quick Paypal Payments \u003c= 5.7.25 - Missing Authorization",
    "slug": "quick-paypal-payments",
    "type": "plugin",
    "affected_version": "* - 5.7.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.25",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-25714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25714",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "CE21 Suite \u003c= 2.2.0 - JWT Token Disclosure",
    "slug": "ce21-suite",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10285",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10285",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPSSO Core \u003c= 18.18.1 - Missing Authorization",
    "slug": "wpsso",
    "type": "plugin",
    "affected_version": "* - 18.18.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "18.18.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56243",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "File Manager Pro \u003c= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-file-manager-pro",
    "type": "plugin",
    "affected_version": "* - 8.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-6846",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6846",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Edit WooCommerce Templates \u003c= 1.1.1 - Unauthenticated Cross-Site Scripting",
    "slug": "woo-edit-templates",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47509",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47509",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Posts via Taxonomies \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "related-posts-via-taxonomies",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46520",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDataTables - Tables \u0026 Table Charts (Premium) \u003c= 6.3.2 - Missing Authorization to DataTable Access \u0026 Modification",
    "slug": "wpdatatables",
    "type": "plugin",
    "affected_version": "* - 6.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3821",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Add Comments \u003c= 1.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "add-comments",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3909",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-CRM – Customer Relations Management for WordPress \u003c= 1.2.1 - CSV injection",
    "slug": "wp-crm",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1202",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1202",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Events Calendar: Eventbrite Tickets \u003c 3.10.2 - Cross-Site Scripting",
    "slug": "the-events-calendar-eventbrite-tickets",
    "type": "plugin",
    "affected_version": "[*, 3.10.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5485",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5485",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Event Aggregator \u003c= 1.7.6 - Cross-Site Request Forgery via wpea_deauthorize_user()",
    "slug": "wp-event-aggregator",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31371",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SearchIQ – The Search Solution \u003c= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "searchiq",
    "type": "plugin",
    "affected_version": "* - 4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10885",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Missing Authorization in 'deleteCssAndJsCacheToolbar'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1931",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1931",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better Notifications for WP \u003c= 1.8.6 - Email Address Disclosure",
    "slug": "bnfw",
    "type": "plugin",
    "affected_version": "[*, 1.8.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0345",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce PDF Invoices \u0026 Packing Slips \u003c= 2.0.12 - Cross-Site Scripting",
    "slug": "woocommerce-pdf-invoices-packing-slips",
    "type": "plugin",
    "affected_version": "[*, 2.0.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18506",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Contact Form Manager \u003c= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "contact-form-manager",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2295",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Multisite User Sync/Unsync (Premium) \u003c= 2.1.1 Reflected Cross-Site Scripting",
    "slug": "wordpress-multisite-user-sync",
    "type": "plugin",
    "affected_version": "* - 2.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-25038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25038",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calendar.online / Kalender.digital \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kalender-digital",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38678",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AP Pricing Tables Lite \u003c= 1.1.6 - Authenticated (Admin+) SQL Injection",
    "slug": "ap-pricing-tables-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-0900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0900",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Slider Revolution \u003c= 6.6.15 - Authenticated (Author+) Arbitrary File Upload",
    "slug": "revslider",
    "type": "plugin",
    "affected_version": "* - 6.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47784",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Better Font Awesome \u003c= 2.0.1 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "better-font-awesome",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-37405",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37405",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FG Drupal to WordPress \u003c= 3.70.3 - Sensitive Information Exposure",
    "slug": "fg-drupal-to-wp",
    "type": "plugin",
    "affected_version": "* - 3.70.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.70.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31247",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "miniorange otp verification \u003c= 4.2.1 - Missing Authorization via dismiss_notice",
    "slug": "miniorange-otp-verification",
    "type": "plugin",
    "affected_version": "* - 4.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47776",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Elementor Addons \u003c= 2.2.8 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "easy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58973",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58973",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Resideo Plugin for Resideo - Real Estate WordPress Theme \u003c= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover",
    "slug": "resideo-plugin",
    "type": "plugin",
    "affected_version": "* - 2.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-7718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7718",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Scroll UP \u003c= 2.0 - Reflected Cross-Site Scripting",
    "slug": "scroll-to-up",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52782",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextGEN Gallery \u003c= 3.37 - Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit",
    "slug": "nextgen-gallery",
    "type": "plugin",
    "affected_version": "* - 3.37",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.37",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3155",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3155",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Registrations for the Events Calendar \u003c= 2.13.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "registrations-for-the-events-calendar",
    "type": "plugin",
    "affected_version": "* - 2.13.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10703",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Security, Antivirus, Firewall – S.A.F \u003c= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypass",
    "slug": "security-antivirus-firewall",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4529",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4529",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Blog2Social \u003c= 6.9.9 - Authenticated (Subscriber+) Server-Side Request Forgery",
    "slug": "blog2social",
    "type": "plugin",
    "affected_version": "* - 6.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3247",
    "auth_type": "Auth",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Academy LMS \u003c= 1.9.25 - Unauthenticated Sensitive Information Exposure",
    "slug": "academy",
    "type": "plugin",
    "affected_version": "* - 1.9.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35171",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Responsive HTML5 Audio Player PRO With Playlist \u003c= 3.5.7 - Authenticated (Contributor+) SQL Injection",
    "slug": "lbg-audio2-html5",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32287",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32287",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Flow Plus \u003c= 5.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-imageflow2",
    "type": "plugin",
    "affected_version": "* - 5.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35651",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fancy Product Designer \u003c= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options",
    "slug": "fancy-product-designer",
    "type": "plugin",
    "affected_version": "* - 4.6.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4334",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Revy \u003c= 1.18 - Unauthenticated Arbitrary File Upload",
    "slug": "revy",
    "type": "plugin",
    "affected_version": "* - 1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54214",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks \u003c= 3.3.1 - Missing Authorization",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24753",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24753",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Ping Optimizer \u003c= 2.35.1.2.3 - Cross-Site Request Forgery",
    "slug": "wordpress-ping-optimizer",
    "type": "plugin",
    "affected_version": "* - 2.35.1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.35.1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1591",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Scratch \u0026 Win – Giveaways and Contests \u003c= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creation",
    "slug": "scratch-win-giveaways-for-website-facebook",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13316",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13316",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "NotificationX \u003c= 2.3.8 - Blind SQL Injection",
    "slug": "notificationx",
    "type": "plugin",
    "affected_version": "* - 2.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0349",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Term Taxonomy Converter \u003c= 1.2 - Reflected Cross-Site Scripting",
    "slug": "term-taxonomy-converter",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24670",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download canvasio3D Light \u003c= 2.5.0 - Reflected Cross-Site Scripting",
    "slug": "canvasio3d-light",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45062",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45062",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP EasyPay – Square for WordPress \u003c= 3.2.0 - Cross-Site Request Forgery Bypass",
    "slug": "wp-easy-pay",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4411",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Developer Loggers for Simple History \u003c= 0.5 - Authenticated (Admin+) Local File Inclusion",
    "slug": "developer-loggers-for-simple-history",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10050",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10050",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment \u003c= 2.2.6 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "booking-and-rental-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26921",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Debug Log Manager \u003c= 2.3.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "debug-log-manager",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32582",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Postie \u003c= 1.9.40 - Cross-Site Scripting",
    "slug": "postie",
    "type": "plugin",
    "affected_version": "[*, 1.9.41)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.41",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-20204",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20204",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads (EDD) Digital Store \u003c 1.3.3 - Cross-Site Scripting",
    "slug": "digital-store",
    "type": "theme",
    "affected_version": "[*, 1.3.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9532",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mailing Group Listserv \u003c= 2.0.9 - Reflected Cross-Site Scripting",
    "slug": "wp-mailing-group",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22595",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-NERD Toolkit \u003c= 1.1 - Unauthenticated Information Exposure",
    "slug": "wp-nerd-toolkit",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54279",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54279",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "123.chat - Video Chat \u003c= 1.3.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "123-chat-videochat",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7869",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7869",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Icons \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "themify-icons",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49395",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49395",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cost Calculator for Elementor \u003c= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cost-calculator-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47476",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery \u003c= 1.4.5 - Missing Authorization",
    "slug": "new-image-gallery",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35721",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Find Your Nearest \u003c= 0.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-find-your-nearest",
    "type": "plugin",
    "affected_version": "* - 0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53757",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slotti Ajanvaraus \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "slotti-ajanvaraus",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12521",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ditty \u003c= 3.1.57 - Unauthenticated Server-Side Request Forgery",
    "slug": "ditty-news-ticker",
    "type": "plugin",
    "affected_version": "* - 3.1.57",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.57",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8085",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8085",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Podlove Podcast Publisher \u003c= 4.0.11 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "podlove-podcasting-plugin-for-wordpress",
    "type": "plugin",
    "affected_version": "* - 4.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32812",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32812",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Drozd – Addons for Elementor \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "drozd-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52425",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AWSOM News Announcement \u003c= 1.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "awsom-news-announcement",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34428",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Shortcode Buttons \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "easy-shortcode-buttons",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23825",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23825",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gravityforms \u003c= 1.9.3.5 - SQL Injection",
    "slug": "gravityforms",
    "type": "plugin",
    "affected_version": "* - 1.9.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-2260",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-2260",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Hotspots Analytics \u003c= 4.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "hotspots",
    "type": "plugin",
    "affected_version": "* - 4.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23848",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CoCart – Headless ecommerce \u003c= 3.11.2 - Missing Authorization",
    "slug": "cart-rest-api-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.11.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.11.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47241",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47241",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Browser and Operating System Finder \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "browser-and-operating-system-finder",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-20851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-20851",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AtomChat \u003c= 1.1.6 - Missing Authorization",
    "slug": "atomchat",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31831",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "XStore Core \u003c= 5.3.8 - Unauthenticated PHP Object Injection",
    "slug": "et-core-plugin",
    "type": "plugin",
    "affected_version": "* - 5.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-33553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33553",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sina Extension for Elementor \u003c= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sina-extension-for-elementor",
    "type": "plugin",
    "affected_version": "* - 3.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29935",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Limit Login Attempts Reloaded \u003c= 2.15.2 - Reflected Cross-Site Scripting",
    "slug": "limit-login-attempts-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.15.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-35589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35589",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SureForms \u003c= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "sureforms",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3514",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Oshine Modules \u003c= 3.3.7 - Reflected Cross-Site Scripting",
    "slug": "oshine-modules",
    "type": "plugin",
    "affected_version": "* - 3.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44044",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments Like Dislike \u003c= 1.1.2 - Add Like/Dislike Bypass",
    "slug": "comments-like-dislike",
    "type": "plugin",
    "affected_version": "[*, 1.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24379",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24379",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Photospace Gallery \u003c= 2.3.5 - Missing Authorization to Plugin Settings Update",
    "slug": "photospace",
    "type": "plugin",
    "affected_version": "* - 2.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38135",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8151",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8151",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Automation By Autonami \u003c= 3.6.0 - Open Redirect",
    "slug": "wp-marketing-automations",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49868",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49868",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Timeline Lite \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "bold-timeline-lite",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4828",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ovic Responsive WPBakery \u003c= 1.3.0 - Missing Authorization",
    "slug": "ovic-vc-addon",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32142",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32142",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Media folder \u003c= 5.7.2 - Missing Authorization to Authenticated(Subscriber+) Plugin settings change",
    "slug": "wp-media-folder",
    "type": "plugin",
    "affected_version": "* - 5.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25907",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25907",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Email Template \u003c= 2.8.3 - Cross-Site Request Forgery",
    "slug": "wp-email-template",
    "type": "plugin",
    "affected_version": "* - 2.8.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58800",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58800",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Reviews \u003c= 3.0.15 - Authenticated Stored Cross-Site Scripting",
    "slug": "ultimate-reviews",
    "type": "plugin",
    "affected_version": "* - 3.0.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-23979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-23979",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "aBlocks \u003c= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ablocks",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47616",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPSection \u003c= 1.3.8 - Authenticated (Contributor+) Local File Inlcusion",
    "slug": "wpsection",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43165",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43165",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Trip Plan \u003c= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "tripplan",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50471",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid, Slider \u0026 Carousel Ultimate \u003c= 1.4.3 - Authenticated (Admin+) Cross-Site Scripting",
    "slug": "post-grid-carousel-ultimate",
    "type": "plugin",
    "affected_version": "[*, 1.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-1266",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1266",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Package \u003c= 1.6.27 - Unauthenticated Price Manipulation",
    "slug": "booking-package",
    "type": "plugin",
    "affected_version": "* - 1.6.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30516",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.0.1 - Missing Authorization to Settings Modification",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41786",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate twitter profile widget \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "ultimate-twitter-profile-widget",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48321",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Admin Menu Manager \u003c= 1.0.3 - Cross-Site Request Forgery",
    "slug": "admin-menu-manager",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26925",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26925",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Bulk Me Now! \u003c= 2.0 - Reflected Cross-Site Scripting via 'status'",
    "slug": "bulk-me-now",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12638",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12638",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slick Contact Forms \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "slick-contact-forms",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5468",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5468",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ZD Scribd iPaper \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "zd-scribd-ipaper",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23757",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Instantio \u003c= 3.3.7 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "instantio",
    "type": "plugin",
    "affected_version": "* - 3.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24581",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24581",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Disable User Login \u003c= 1.0.1 - Missing Authorization to Unauthenticated Settings Update",
    "slug": "wp-users-disable",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2350",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Di Themes Demo Site Importer \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "di-themes-demo-site-importer",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58914",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Youtube Vimeo Video Player and Slider WP Plugin \u003c= 3.8 - Reflected Cross-Site Scripting",
    "slug": "video-player-youtube-vimeo",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48159",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover",
    "slug": "peprodev-ups",
    "type": "plugin",
    "affected_version": "1.9.1 - 7.5.2",
    "from_version": "1.9.1",
    "from_inclusive": true,
    "to_version": "7.5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-3844",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3844",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stop User Enumeration \u003c= 1.7.2 - Protection Mechanism Bypass",
    "slug": "stop-user-enumeration",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4302",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Appsero Helper \u003c= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "appsero-helper",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13436",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13436",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Admin Theme \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-admin-theme",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48325",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Events Calendar \u003c= 4.8.1 - Cross-Site Scripting via tribe_paged Parameter",
    "slug": "the-events-calendar",
    "type": "plugin",
    "affected_version": "[*, 4.8.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15109",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Doneren met Mollie \u003c= 2.10.2 - Unauthenticated Reflected Cross-Site Scripting via search",
    "slug": "doneren-met-mollie",
    "type": "plugin",
    "affected_version": "* - 2.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29767",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UpDownUpDown \u003c= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "updownupdown-postcomment-voting",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23572",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23572",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ads by WPQuads \u003c= 2.0.94 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "quick-adsense-reloaded",
    "type": "plugin",
    "affected_version": "* - 2.0.94",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.94",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53459",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coub \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "coub",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49659",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49659",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Calculated Fields Form \u003c= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "calculated-fields-form",
    "type": "plugin",
    "affected_version": "* - 5.2.61",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.61",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13381",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP FixTag \u003c= v2.0.2 - Reflected Cross-Site Scripting",
    "slug": "wp-fixtag",
    "type": "plugin",
    "affected_version": "* - v2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "v2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23564",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Animated Buttons \u003c= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "animated-buttons",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4221",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4221",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Tabs \u003c= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-expand-tabs-free",
    "type": "plugin",
    "affected_version": "* - 2.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0071",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0071",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kama Click Counter \u003c= 3.4.9 - Blind SQL Injection",
    "slug": "kama-clic-counter",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-18614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18614",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Photo Gallery – Image Gallery \u003c= 1.0.6 - Cross-Site Request Forgery Bypass",
    "slug": "photo-contest",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4384",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "无觅相关文章插件 \u003c= 1.0.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wumii-related-posts",
    "type": "plugin",
    "affected_version": "* - 1.0.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27352",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mass Delete Unused Tags \u003c= 2.0.0 - Cross-Site Request Forgery via plugin_mass_delete_unused_tags_init",
    "slug": "mass-delete-unused-tags",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27430",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "The7 \u003c= 12.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title and data-dt-img-description Attributes",
    "slug": "dt-the7",
    "type": "theme",
    "affected_version": "* - 12.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7726",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AyeCode Connect \u003c= 1.3.8 - Missing Authorization",
    "slug": "ayecode-connect",
    "type": "plugin",
    "affected_version": "* - 1.3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56255",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56255",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Option Tree \u003c= 2.7.2 - Object Injection Bypass",
    "slug": "option-tree",
    "type": "plugin",
    "affected_version": "* - 2.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15320",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15320",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gantry 4 Framework \u003c= 4.1.21 - Reflected Cross-Site Scripting",
    "slug": "gantry",
    "type": "plugin",
    "affected_version": "* - 4.1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9382",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Turisbook Booking System \u003c= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "turisbook-booking-system",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31803",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dialogity Free Live Chat \u003c= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "dialogity-website-chat",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57912",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57912",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.3.5 - Reflected Cross-Site Scripting",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4719",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Homerunner \u003c= 1.0.30 - Cross-Site Request Forgery to Settings Update",
    "slug": "homerunner-smartcheckout",
    "type": "plugin",
    "affected_version": "* - 1.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5932",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "EventPrime – Events Calendar, Bookings and Tickets \u003c= 3.5.0 - Insecure Direct Object Reference to (Subscriber+) Arbitrary Booking Update",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 3.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4665",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "The Moneytizer \u003c= 9.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-moneytizer",
    "type": "plugin",
    "affected_version": "* - 9.5.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27990",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Proof (Testimonial) Slider \u003c= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "social-proof-testimonials-slider",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-24389",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-24389",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Blocks \u003c= 4.0.6 - Cross-Site Request Forgery via save",
    "slug": "essential-blocks",
    "type": "plugin",
    "affected_version": "* - 4.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2087",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Qi Blocks \u003c= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ToC Block",
    "slug": "qi-blocks",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1627",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DB Tables Import/Export \u003c= 1.0.1 - Reflected Cross-Site Scripting",
    "slug": "db-tables-importexport",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27271",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Epeken All Kurir \u003c= 1.4.6.2 -  Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "epeken-all-kurir",
    "type": "plugin",
    "affected_version": "* - 1.4.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32673",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slide Anything \u003c= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "slide-anything",
    "type": "plugin",
    "affected_version": "* - 2.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28499",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads – Software Licensing \u003c 3.2.3 - Cross-Site Scripting",
    "slug": "edd-software-licensing",
    "type": "plugin",
    "affected_version": "[*, 3.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9528",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Job Board \u003c= 2.9.3 - Local File Inclusion",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "* - 2.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35749",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "If-So Dynamic Content Personalization \u003c= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure",
    "slug": "if-so",
    "type": "plugin",
    "affected_version": "* - 1.9.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10796",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10796",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "404 to 301 – Redirect, Log and Notify 404 Errors \u003c= 2.0.2 - SQL Injection",
    "slug": "404-to-301",
    "type": "plugin",
    "affected_version": "[*, 2.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9323",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Capie \u003c= 1.0.40 - Unauthenticated Local File Inclusion",
    "slug": "capie",
    "type": "theme",
    "affected_version": "* - 1.0.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.40",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31060",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Breeze \u003c= 2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via breeze_api_token",
    "slug": "breeze",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27188",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27188",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Membership \u003c= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11088",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 4.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1159",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1159",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BERTHA AI \u003c= 1.12.10.2 - Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "bertha-ai-free",
    "type": "plugin",
    "affected_version": "* - 1.12.10.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.10.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39583",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss \u003c= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "* - 2.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13697",
    "auth_type": "Unauth",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3885",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3885",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Access Manager \u003c= 2.8.2 - Arbitrary File Overwrite",
    "slug": "advanced-access-manager",
    "type": "plugin",
    "affected_version": "[*, 2.8.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-6059",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-6059",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Norse Rune Oracle Plugin \u003c= 1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "norse-runes-oracle",
    "type": "plugin",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22556",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22556",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Metform Elementor Contact Form Builder \u003c= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets",
    "slug": "metform",
    "type": "plugin",
    "affected_version": "* - 3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2791",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Portfolio Responsive Gallery \u003c= 1.1.7 - Blind SQL Injection",
    "slug": "portfolio-responsive-gallery",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24457",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CM Header and Footer \u003c= 1.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "cm-header-footer-script-loader",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31091",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Featured Post Creative \u003c= 1.2.7 - Missing Authorization via wpfp_update_featured_post",
    "slug": "featured-post-creative",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30488",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "My Calendar \u003c= 3.1.9 - Unauthenticated Cross-Site Scripting",
    "slug": "my-calendar",
    "type": "plugin",
    "affected_version": "* - 3.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-15713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15713",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Progress Bar \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-progress-bar",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11883",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11883",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RestroPress \u003c= 3.1.9.1 - Reflected Cross-Site Scripting",
    "slug": "restropress",
    "type": "plugin",
    "affected_version": "* - 3.1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32553",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EleForms – All In One Form Integration including DB for Elementor \u003c= 2.9.9.7 - Missing Authorization to Sensitive Information Exposure",
    "slug": "all-contact-form-integration-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2043",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress File Upload / WordPress File Upload Pro \u003c= 4.16.2 - Authenticated (Contributor+) Path Traversal",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.16.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24962",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress File Upload / WordPress File Upload Pro \u003c= 4.16.2 - Authenticated (Contributor+) Path Traversal",
    "slug": "wordpress-file-upload-pro",
    "type": "plugin",
    "affected_version": "* - 4.16.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.16.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24962",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24962",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "HelloAsso \u003c= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "helloasso",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32697",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Logo Carousel \u003c= 3.4.1 - Unauthorised Private Post Access",
    "slug": "logo-carousel-free",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24739",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24739",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Madara – Responsive and modern WordPress theme for manga sites \u003c= 2.2.2 - Unauthenticated Local File Inclusion",
    "slug": "madara",
    "type": "theme",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-4524",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4524",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Animate \u003c= 0.5 - Authenticated (Contributor+) Server-Side Request Forgery",
    "slug": "animate",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Campaign Monitor for WordPress \u003c= 2.8.12 - Reflected Cross-Site Scripting",
    "slug": "forms-for-campaign-monitor",
    "type": "plugin",
    "affected_version": "* - 2.8.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38474",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38474",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beauty \u003c= 1.1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via tpl_featured_cat_id Parameter",
    "slug": "beauty",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5884",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support \u003c= 6.1.4 - Cross-Site Request Forgery via wpas_edit_reply_ajax()",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48323",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Move Addons for Elementor \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "move-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4695",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Encoder – Protect Email Addresses and Phone Numbers \u003c= 2.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "email-encoder-bundle",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4483",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4483",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FunnelCockpit \u003c= 1.4.3 - Reflected Cross-Site Scripting",
    "slug": "funnelcockpit",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47678",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "dsIDXpress \u003c 2.1.1 - Cross-Site Scripting",
    "slug": "dsidxpress",
    "type": "plugin",
    "affected_version": "[*, 2.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-4521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4521",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Knowledge Base \u0026#8211; Knowledge Base Maker \u003c= 1.1.8 - Cross-Site Request Forgery",
    "slug": "knowledge-base-maker",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52791",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Job Manager \u003c= 2.0.0 - Missing Authorization",
    "slug": "wp-job-manager",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52211",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.5.12 - Cross-Site Request Forgery in exec_admin_widget function",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.5.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25707",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP System Log \u003c 1.0.21 - Cross-Site Scripting",
    "slug": "winterlock",
    "type": "plugin",
    "affected_version": "[*, 1.0.21)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.21",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24756",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24756",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.26",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.23",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.19",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.18",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.17",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.29",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.10",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.27",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.26",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.5",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.2",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.29",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.13",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.13",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.9",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 5.2.3 - Open Redirect",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.1",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-16220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-16220",
    "auth_type": "Auth",
    "cvss_score": 4.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "External Videos \u003c= 2.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "external-videos",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30752",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30752",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gravity Forms: Multiple Form Instances \u003c= 1.1.1 - Unauthenticated Full Path Disclosure",
    "slug": "gravity-forms-multiple-form-instances",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6550",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Hotlink2Watermark \u003c= 0.3.2 - Cross-Site Request Forgery",
    "slug": "hotlink2watermark",
    "type": "plugin",
    "affected_version": "* - 0.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53711",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Spam protection, Anti-Spam, FireWall by CleanTalk \u003c= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation",
    "slug": "cleantalk-spam-protect",
    "type": "plugin",
    "affected_version": "* - 6.43.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.43.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-10542",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10542",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Nav Menu Manager \u003c= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "noakes-menu-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31017",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Buttons Shortcode and Widget \u003c= 1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "buttons-shortcode-and-widget",
    "type": "plugin",
    "affected_version": "* - 1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24930",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 1.2 - HTTP Response Splitting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 1.2.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2004-1584",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2004-1584",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Smart Slider 3 \u003c= 3.5.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-slider-3",
    "type": "plugin",
    "affected_version": "* - 3.5.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0660",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Defender Security \u003c= 4.7.2 - Missing Authorization",
    "slug": "defender-security",
    "type": "plugin",
    "affected_version": "* - 4.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37444",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37444",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ad Inserter Free and Pro \u003c= 2.7.11 - Reflected Cross-Site Scripting",
    "slug": "ad-inserter",
    "type": "plugin",
    "affected_version": "[*, 2.7.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0901",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ad Inserter Free and Pro \u003c= 2.7.11 - Reflected Cross-Site Scripting",
    "slug": "ad-inserter-pro",
    "type": "plugin",
    "affected_version": "[*, 2.7.12)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.12",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0901",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0901",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "W-DALIL \u003c= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "w-dalil",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2340",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Media Library: Media Library Folder \u0026 File Manager \u003c= 4.22.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "real-media-library-lite",
    "type": "plugin",
    "affected_version": "* - 4.22.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.22.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2027",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fast eBay Listings \u003c= 2.12.15 - Open Redirect",
    "slug": "fast-ebay-listings",
    "type": "plugin",
    "affected_version": "* - 2.12.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39597",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Package \u003c= 1.6.01 - Reflected Cross-Site Scripting via 'mode'",
    "slug": "booking-package",
    "type": "plugin",
    "affected_version": "* - 1.6.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-39918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39918",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chatbot with ChatGPT \u003c= 2.4.4 - Unauthenticated SQL Injection",
    "slug": "smartsearchwp",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6847",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Zoho Billing – Embed Payment Form \u003c= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zoho-subscriptions",
    "type": "plugin",
    "affected_version": "* - 4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30900",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple:Press \u003c= 6.8 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Deletion",
    "slug": "simplepress",
    "type": "plugin",
    "affected_version": "* - 6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4030",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WP Blast | SEO \u0026 Performance Booster \u003c= 1.8.6 - Cross-Site Request Forgery to Cache Clearing",
    "slug": "wpblast",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9622",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9622",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Canto \u003c= 1.9.0 - Blind Server-Side Request Forgery via tree.php",
    "slug": "canto",
    "type": "plugin",
    "affected_version": "[*, 2.0.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-28978",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-28978",
    "auth_type": "Unauth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Admin renamer extended \u003c= 3.2.1 - Cross-Site Request Forgery",
    "slug": "admin-renamer-extended",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-14680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-14680",
    "auth_type": "Auth",
    "cvss_score": 5.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Video Embed \u003c= 1.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "video-embed-box",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24337",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FormCraft \u003c= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fcb shortcode",
    "slug": "formcraft-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22717",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22717",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments - wpDiscuz \u003c= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "[*, 7.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24806",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image Export \u003c 1.1.1 - Path Traversal",
    "slug": "image-export",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2015-5609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5609",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
  },
  {
    "title": "Bit Assist \u003c= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function",
    "slug": "bit-assist",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13791",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP SpaceContent \u003c= 0.4.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-spacecontent",
    "type": "plugin",
    "affected_version": "* - 0.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23446",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spark Multipurpose \u003c= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "spark-multipurpose",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50030",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50030",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP FEvents Book \u003c= 0.46 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Manipulation",
    "slug": "wp-fevents-book",
    "type": "plugin",
    "affected_version": "* - 0.46",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.46",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1129",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Easy Accordion Gutenberg Block \u003c= 1.2.3 - Missing Authorization",
    "slug": "easy-accordion-block",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51660",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Porto Theme - Functionality \u003c= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta",
    "slug": "porto-functionality",
    "type": "plugin",
    "affected_version": "* - 3.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-3809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3809",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Sidebar Manager Light \u003c= 1.1.8 - Cross-Site Request Forgery",
    "slug": "sidebar-manager-light",
    "type": "plugin",
    "affected_version": "* - 1.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32112",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ShareThis Dashboard for Google Analytics \u003c= 3.2.1 - Missing Authorization to Unauthenticated Feature Deactivation",
    "slug": "googleanalytics",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1507",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1507",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress SEO Friendly Accordion FAQ with AI assisted content generation \u003c= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "notice-faq",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13458",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ContentMX Content Publisher \u003c= 1.0.6 - Cross-Site Request Forgery",
    "slug": "contentmx-content-publisher",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9889",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SnapWidget Social Photo Feed Widget \u003c= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "snapwidget-wp-instagram-widget",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31760",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.3.1 - Arbitrary Redirect",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1209",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1209",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Events Manager \u003c= 5.5.7.1 - Cross-Site Scripting",
    "slug": "events-manager",
    "type": "plugin",
    "affected_version": "[*, 5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9297",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visitor Traffic Real Time Statistics \u003c= 1.12 - Cross-Site Request Forgery",
    "slug": "visitors-traffic-real-time-statistics",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15831",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15831",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SNS Vicky \u003c= 3.7 - Unauthenticated Local File Inclusion",
    "slug": "snsvicky",
    "type": "theme",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-28990",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28990",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "kk Youtube Video \u003c= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "kk-youtube-video",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6061",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6061",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rezgo Online Booking \u003c= 4.1.7 - Reflected Cross-Site-Scripting",
    "slug": "rezgo",
    "type": "plugin",
    "affected_version": "4.1.7",
    "from_version": "4.1.7",
    "from_inclusive": true,
    "to_version": "4.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1932",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tippy \u003c= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tippy shortcode",
    "slug": "tippy",
    "type": "plugin",
    "affected_version": "* - 6.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31079",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Lightbox \u0026 Gallery \u003c= 1.7.1 - Cross-Site Scripting",
    "slug": "responsive-lightbox",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-2243",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-2243",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Optimize \u003c= 3.2.12 \u0026 SrbTransLatin \u003c= 2.4 - Stored/Reflected Cross-Site Scripting via Third Party Library",
    "slug": "srbtranslatin",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1119",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-Optimize \u003c= 3.2.12 \u0026 SrbTransLatin \u003c= 2.4 - Stored/Reflected Cross-Site Scripting via Third Party Library",
    "slug": "wp-optimize",
    "type": "plugin",
    "affected_version": "[*, 3.2.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.13",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-1119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1119",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.3 - 6.3.1",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.1 - 5.1.16",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.5 - 5.5.12",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.7 - 5.7.9",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.1 - 6.1.3",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.8 - 4.8.22",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.0 - 5.0.19",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.2 - 5.2.18",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.3 - 5.3.15",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.8 - 5.8.7",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.9 - 5.9.7",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.26",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.9 - 4.9.23",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.4 - 5.4.13",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "5.6 - 5.6.11",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.0 - 6.0.5",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "6.2 - 6.2.2",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5561",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c 3.1.0.4 - SQL Injection",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-23489",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23489",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Custom Post RSS Feed \u003c= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-custom-post-rss-feed",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25139",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FeedWordPress \u003c 2015.0514 - Reflected Cross-Site Scripting",
    "slug": "feedwordpress",
    "type": "plugin",
    "affected_version": "[*, 2015.0514)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2015.0514",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9358",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Translitera \u003c= p1.2.5 - Cross-Site Request Forgery",
    "slug": "wp-translitera",
    "type": "plugin",
    "affected_version": "* - p1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "p1.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27438",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27438",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Member Subscriptions \u003c= 2.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "paid-member-subscriptions",
    "type": "plugin",
    "affected_version": "* - 2.14.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.14.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31088",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31088",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IDPay for Contact Form 7 \u003c= 2.1.2 - Reflected Cross-Site Scripting",
    "slug": "idpay-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24996",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24996",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Html5 Audio Player \u003c= 2.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "html5-audio-player",
    "type": "plugin",
    "affected_version": "* - 2.2.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37445",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37445",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Composer Website Builder \u003c= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title'",
    "slug": "visualcomposer",
    "type": "plugin",
    "affected_version": "* - 45.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "45.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2516",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2516",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Depicter Slider \u003c= 3.2.2 - Missing Authorization",
    "slug": "depicter",
    "type": "plugin",
    "affected_version": "* - 3.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47359",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47359",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "M Chart \u003c= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "m-chart",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23892",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23892",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Typebot \u003c= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "typebot",
    "type": "plugin",
    "affected_version": "* - 3.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38757",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Security Optimizer – The All-In-One Protection Plugin \u003c= 1.5.0 - Missing Authorization via hide_notice()",
    "slug": "sg-security",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38774",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38774",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Uji Countdown \u003c= 2.0.6 - Cross-Site Scripting",
    "slug": "uji-countdown",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10900",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10900",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DethemeKit For Elementor \u003c= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets",
    "slug": "dethemekit-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4374",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Accept Payments for PayPal \u003c= 4.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wordpress-easy-paypal-payment-or-donation-accept-plugin",
    "type": "plugin",
    "affected_version": "* - 4.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0275",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ocean Extra \u003c= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode",
    "slug": "ocean-extra",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9499",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Slider for WooCommerce \u003c= 2.5.6 - Missing Authorization",
    "slug": "woo-product-slider",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2382",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2382",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WP Backup+ \u003c= 2018-11-22 - Sensitive Information Disclosure",
    "slug": "wp-backup-plus",
    "type": "plugin",
    "affected_version": "[*, 2018-11-22]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2018-11-22",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2018-19456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-19456",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Video Grid \u003c= 1.21 - Reflected Cross-Site Scripting",
    "slug": "video-grid",
    "type": "plugin",
    "affected_version": "* - 1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7295",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ajax Load More \u003c= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File Read",
    "slug": "ajax-load-more",
    "type": "plugin",
    "affected_version": "* - 7.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1790",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1790",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery \u003c= 3.2.4.2 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "simply-gallery-block",
    "type": "plugin",
    "affected_version": "* - 3.2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10034",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.15",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.8",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.6",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7 - 4.7.2",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.18",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.16",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.12",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.7",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.3",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.18",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.3 - Arbitrary File Deletion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.15",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-6816",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-6816",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "B Blocks \u003c= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "b-blocks",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54708",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54708",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Wish List \u003c 1.4.2 - Cross-Site Scripting",
    "slug": "my-wish-list",
    "type": "plugin",
    "affected_version": "[*, 1.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9493",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Flaming Forms \u003c= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "flaming-forms",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54398",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54398",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Snow Monkey \u003c= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery",
    "slug": "snow-monkey",
    "type": "theme",
    "affected_version": "29.1.5",
    "from_version": "29.1.5",
    "from_inclusive": true,
    "to_version": "29.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10137",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10137",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 3.5.2 - Cross-Site Scripting via Multiple Vectors",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2013-2201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2201",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gmap Point List \u003c= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gmap-point-list",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51594",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Product Frontend for WooCommerce \u003c= 1.0.6 - Missing Authorization to Unauthenticated Arbitrary Content Deletion",
    "slug": "add-product-frontend-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32593",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Everest Backup – WordPress Cloud Backup, Migration, Restore \u0026 Cloning Plugin \u003c= 2.2.13 - Sensitive Invormation Disclosure via procstat Log",
    "slug": "everest-backup",
    "type": "plugin",
    "affected_version": "* - 2.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10028",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10028",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "XPinner Lite \u003c= 2.2 - Cross-Site Scripting",
    "slug": "xpinner-lite",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9407",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9407",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 6.9.4 - Sensitive Information Exposure via Log File",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "* - 6.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-24867",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-24867",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Simple Headline Rotator \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "simple-headline-rotator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7860",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout \u003c= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gs-pinterest-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.8.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11453",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Test Email \u003c= 1.1.7 - Reflected Cross-Site Scripting",
    "slug": "wp-test-email",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8664",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8664",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page and Post Lister \u003c= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion",
    "slug": "page-and-post-lister",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27310",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Zotpress \u003c 6.1.3 - SQL Injection",
    "slug": "zotpress",
    "type": "plugin",
    "affected_version": "[*, 6.1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2016-1000217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000217",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Automatic Plugin \u003c= 3.92.1 Cross-Site Request Forgery",
    "slug": "wp-automatic",
    "type": "plugin",
    "affected_version": "* - 3.92.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.92.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32693",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32693",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Canalplan \u003c= 5.31 - Reflected Cross-Site Scripting",
    "slug": "canalplan-ac",
    "type": "plugin",
    "affected_version": "* - 5.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23616",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup and Restore WordPress – Backup Plugin \u003c= 1.9 - Sensitive Information Disclosure",
    "slug": "wp-backitup",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9012",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9012",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Announce from the Dashboard \u003c= 1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "announce-from-the-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25716",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25716",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Portfolio Post \u003c= 1.1.5 - Authenticated Stored Cross-Site Scripting",
    "slug": "themify-portfolio-post",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24129",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.97",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.97",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6208",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Video Player \u003c= 1.5.22 - Reflected Cross-Site Scripting",
    "slug": "player",
    "type": "plugin",
    "affected_version": "* - 1.5.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45632",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45632",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blogbyte \u003c= 1.1.1 - Unauthenticated Local File Inclusion",
    "slug": "blogbyte",
    "type": "theme",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49275",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49275",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Userpro \u003c= 5.1.9 - Unauthenticated Local File Inclusion",
    "slug": "userpro",
    "type": "plugin",
    "affected_version": "* - 5.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-56214",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56214",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "MyTube PlayList \u003c= 2.0.3 - Reflected Cross-Site Scripting via addplaylistid",
    "slug": "mytube",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-48767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48767",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.4.2 - Reflected Cross-Site Scripting",
    "slug": "meeting-scheduler-by-vcita",
    "type": "plugin",
    "affected_version": "* - 4.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37262",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyMeet \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "buddymeet",
    "type": "plugin",
    "affected_version": "[*, 2.3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-44985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-44985",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MorningTime Lite \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "morningtime-lite",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26736",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26736",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pronamic Google Maps \u003c= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pronamic-google-maps",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9352",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9352",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Simple Dropbox Upload \u003c 1.8.8.1 - Arbitrary File Upload",
    "slug": "simple-dropbox-upload-form",
    "type": "plugin",
    "affected_version": "[*, 1.8.8.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.8.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2013-5963",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-5963",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Qubely \u003c= 1.8.14 - Authenticated (Contributor+) Sensitive Information Exposure",
    "slug": "qubely",
    "type": "plugin",
    "affected_version": "* - 1.8.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58249",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "StatPressCN \u003c= 1.9.0 - Cross-Site Scripting",
    "slug": "statpresscn",
    "type": "plugin",
    "affected_version": "* - 1.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-0641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-0641",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Subscribe To Comments Reloaded \u003c= 211130 - Cross-Site Request Forgery",
    "slug": "subscribe-to-comments-reloaded",
    "type": "plugin",
    "affected_version": "* - 211130",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "211130",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-29414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29414",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 1.5.2 - Full Path Disclosure",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 1.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2005-4463",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2005-4463",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WooCommerce Etsy Integration \u003c= 3.3.1 - Cross-Site Request Forgery Bypass",
    "slug": "exportfeed-for-woocommerce-product-to-etsy",
    "type": "plugin",
    "affected_version": "* - 3.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4409",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4409",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "File Manager \u003c= 6.8 - Arbitrary File Upload/Remote Code Execution",
    "slug": "wp-file-manager",
    "type": "plugin",
    "affected_version": "* - 6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-25213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25213",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Share Buttons \u0026 Analytics Plugin – GetSocial.io \u003c= 4.5 - Missing Authorization",
    "slug": "wp-share-buttons-analytics-by-getsocial",
    "type": "plugin",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32239",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Import External Images \u003c= 1.4 - Cross-Site Request Forgery via external_image_import_all_ajax",
    "slug": "import-external-images",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46866",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46866",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Black-Letterhead \u003c= 1.5 - Cross-Site Scripting",
    "slug": "black-letterhead",
    "type": "theme",
    "affected_version": "[*, 1.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-3865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3865",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FULL - Customer \u003c= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check",
    "slug": "full-customer",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4242",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Protect WP Admin \u003c= 3.8 - Unauthenticated Information Disclosure to Protection Bypass",
    "slug": "protect-wp-admin",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3139",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Torod \u003c= 1.9 - Unauthenticated SQL Injection",
    "slug": "torod",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30936",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Job Portal \u003c= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13428",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13428",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Community by PeepSo \u003c= 6.3.1.1 - Cross-Site Request Forgery to User Post Creation",
    "slug": "peepso-core",
    "type": "plugin",
    "affected_version": "* - 6.3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7125",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7125",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Welcart e-Commerce \u003c= 2.8.10 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "usc-e-shop",
    "type": "plugin",
    "affected_version": "* - 2.8.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-22705",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22705",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Himalayas \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "himalayas",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34571",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads \u003c= 3.2.11 - Unauthenticated Sensitive Information Exposure",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "* - 3.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32100",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Ivory Search – WordPress Search Plugin \u003c= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation",
    "slug": "add-search-to-menu",
    "type": "plugin",
    "affected_version": "* - 5.5.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3233",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3233",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HollerBox \u003c= 2.1.3 - Authenticated (edit_popups+) SQL Injection",
    "slug": "holler-box",
    "type": "plugin",
    "affected_version": "[*, 2.1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2111",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2111",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Library Bookshelves \u003c= 5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "library-bookshelves",
    "type": "plugin",
    "affected_version": "* - 5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57964",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Media Category Library \u003c= 2.7 - Reflected Cross-Site Scripting",
    "slug": "media-category-library",
    "type": "plugin",
    "affected_version": "* - 2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22344",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22344",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Sailthru Triggermail \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "sailthru-triggermail",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4289",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Accept Payments \u003c= 4.9.10 - Missing Authorization",
    "slug": "wordpress-easy-paypal-payment-or-donation-accept-plugin",
    "type": "plugin",
    "affected_version": "* - 4.9.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33591",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SalesKing \u003c= 1.6.15 - Unauthenticated Privilege Escalation",
    "slug": "salesking",
    "type": "plugin",
    "affected_version": "* - 1.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-22157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22157",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Admin Custom Login \u003c= 3.2.7 – Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "admin-custom-login",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-34628",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34628",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Change WP Admin Login \u003c= 1.1.3 - Protection Mechanism Failure to Login Page Disclosure",
    "slug": "change-wp-admin-login",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3604",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AndyBlue Theme \u003c 1.5 - Cross-Site Scripting",
    "slug": "andyblue",
    "type": "theme",
    "affected_version": "[*, 1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2007-3239",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-3239",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Phlox Shop \u003c= 2.0.0 - Unauthenticated Local File Inclusion",
    "slug": "auxin-shop",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-39163",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-39163",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "2.2.85 - 2.3.3",
    "from_version": "2.2.85",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9636",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9636",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Visitor Statistics (Real Time Traffic) \u003c= 7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-stats-manager",
    "type": "plugin",
    "affected_version": "* - 7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24675",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24675",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 1.5.1.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 1.5.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2005-2107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2005-2107",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Integration of Moneybird for WooCommerce \u003c= 2.1.2 - Reflected Cross-Site Scripting",
    "slug": "woo-moneybird",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38349",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38349",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "External Media \u003c= 1.0.33 - Authenticated Arbitrary File Upload",
    "slug": "external-media",
    "type": "plugin",
    "affected_version": "[*, 1.0.34)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.34",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24311",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24311",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Radio Player \u003c= 2.0.83 - Unauthenticated Server-Side Request Forgery",
    "slug": "radio-player",
    "type": "plugin",
    "affected_version": "* - 2.0.83",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.83",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-54385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54385",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Post Type and Taxonomy GUI Manager \u003c= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "custom-post-type-cpt-cusom-taxonomy-ct-manager",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0420",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0420",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "File Gallery \u003c 1.7.9.2 - Remote Code Execution",
    "slug": "file-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.7.9.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.9.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-2558",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2558",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DZS Video Gallery \u003c 7.95 -  Multiple Cross-Site Scripting",
    "slug": "dzs-videogallery",
    "type": "plugin",
    "affected_version": "[*, 7.95)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.95",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9094",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All-in-One Video Gallery 2.5.8 - 2.6.0 - Arbitrary File Download \u0026 Server-Side Request Forgery",
    "slug": "all-in-one-video-gallery",
    "type": "plugin",
    "affected_version": "2.5.8 - 2.6.0",
    "from_version": "2.5.8",
    "from_inclusive": true,
    "to_version": "2.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2633",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2633",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.5.28 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.5.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.28",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32141",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tracking Code Manager \u003c= 2.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tracking-code-manager",
    "type": "plugin",
    "affected_version": "* - 2.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2579",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2579",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "tagDiv Opt-In Builder \u003c= 1.7 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter",
    "slug": "td-subscription",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2890",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2890",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Wp-Insert \u003c= 2.4.2 - Arbitrary File Upload",
    "slug": "wp-insert",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2018-17573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-17573",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ARMember \u003c= 4.0.10 - Authenticated (Subscriber+) Membership Plan Bypass",
    "slug": "armember-membership",
    "type": "plugin",
    "affected_version": "* - 4.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47837",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WIP Custom Login \u003c= 1.2.9 - Cross-Site Request Forgery via save_option",
    "slug": "wip-custom-login",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33313",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Feedweb \u003c 1.9 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "feedweb",
    "type": "plugin",
    "affected_version": "[*, 1.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-3720",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-3720",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Category Excluder \u003c= 1.1 - Cross-Site Request Forgery",
    "slug": "ultimate-category-excluder",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-35135",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-35135",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPGYM \u003c= 65.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "gym-management",
    "type": "plugin",
    "affected_version": "* - 65.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "65.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32574",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32574",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "azurecurve Shortcodes in Comments \u003c= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "azurecurve-shortcodes-in-comments",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2809",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2809",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Email on Publish \u003c= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "email-on-publish",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23673",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23673",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gumlet Video \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gumlet-video",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13576",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swift Performance Lite \u003c= 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export",
    "slug": "swift-performance-lite",
    "type": "plugin",
    "affected_version": "* - 2.3.6.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.6.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6289",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Enhanced Paypal Shortcodes \u003c= 0.5a - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "enhanced-paypal-shortcodes",
    "type": "plugin",
    "affected_version": "* - 0.5a",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5a",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46543",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mihdan: Yandex Turbo Feed \u003c= 1.6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "mihdan-yandex-turbo-feed",
    "type": "plugin",
    "affected_version": "* - 1.6.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4411",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4411",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "myCred \u003c= 2.5 - Cross-Site Request Forgery",
    "slug": "mycred",
    "type": "plugin",
    "affected_version": "[*, 2.5.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-35096",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35096",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "jQuery Tagline Rotator \u003c= 0.1.5 - Reflected Cross-Site Scripting",
    "slug": "jquery-tagline-rotator",
    "type": "plugin",
    "affected_version": "* - 0.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-34663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-34663",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Travel \u003c= 7.7.0 - Missing Authorization via Multiple AJAX Actions",
    "slug": "wp-travel",
    "type": "plugin",
    "affected_version": "* - 7.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47224",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Safe SVG \u003c= 1.9.9 - Content-Type Bypass",
    "slug": "safe-svg",
    "type": "plugin",
    "affected_version": "[*, 1.9.10)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.10",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2022-1091",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1091",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"
  },
  {
    "title": "WP RSS By Publishers \u003c= 0.1 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-rss-by-publishers",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4360",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4360",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Better Notifications for WP \u003c= 1.9.2 - Cross-Site Request Forgery via handle_actions",
    "slug": "bnfw",
    "type": "plugin",
    "affected_version": "* - 1.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-32964",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-32964",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "JetEngine \u003c= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "jet-engine",
    "type": "plugin",
    "affected_version": "* - 3.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53195",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53195",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPBakery Page Builder for WordPress \u003c= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7502",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "moreAds SE \u003c= 1.4.6 - Cross-Site Scripting",
    "slug": "moreads-se",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18526",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18526",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NewStatPress \u003c 1.0.6 - SQL Injection",
    "slug": "newstatpress",
    "type": "plugin",
    "affected_version": "[*, 1.0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9313",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9313",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Satisfaction Reports from Help Scout \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "happiness-reports-for-help-scout",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51778",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51778",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ARI-Adminer \u003c= 1.1.14 - Missing Authorization and No Direct File Access Restrictions",
    "slug": "ari-adminer",
    "type": "plugin",
    "affected_version": "* - 1.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-25215",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25215",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "WP Church Donation \u003c= 1.7 - Cross-Site Request Forgery",
    "slug": "wp-church-donation",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31410",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31410",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP eCommerce Quickpay \u003c= 1.1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-ecommerce-quickpay",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56023",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56023",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pronamic Google Maps \u003c= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pronamic-google-maps",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56240",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fluent Forms \u003c= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title",
    "slug": "fluentform",
    "type": "plugin",
    "affected_version": "* - 5.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0618",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 3.1.7 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "[*, 3.1.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24450",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24450",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP User Frontend Pro \u003c= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-user-frontend-pro",
    "type": "plugin",
    "affected_version": "* - 4.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3054",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3054",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Blogs' Planetarium \u003c= 1.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "wp-blogs-planetarium",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6532",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Passwordless Login \u003c= 1.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "passwordless-login",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29143",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29143",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – R+L Carriers Edition \u003c= 3.3.4 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-rl-edition",
    "type": "plugin",
    "affected_version": "* - 3.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13481",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Save as PDF Plugin by Pdfcrowd \u003c= 3.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "save-as-pdf-by-pdfcrowd",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5971",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5971",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms \u003c= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "buddyforms",
    "type": "plugin",
    "affected_version": "* - 2.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25981",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25981",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Blue Captcha \u003c= 1.7.4 - Reflected Cross-Site Scripting",
    "slug": "blue-captcha",
    "type": "plugin",
    "affected_version": "* - 1.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28880",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Backup Scheduler \u003c= 1.5.13 - Cross-Site Request Forgery",
    "slug": "backup-scheduler",
    "type": "plugin",
    "affected_version": "* - 1.5.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-38079",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38079",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Alert Box Block – Display notice/alerts in the front end \u003c= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Box Block",
    "slug": "alert-box-block",
    "type": "plugin",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13731",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13731",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pay with Contact Form 7 \u003c= 1.0.4 - Authenticated (Administrator+) SQL Injection",
    "slug": "pay-with-contact-form-7",
    "type": "plugin",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32126",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid \u0026 Carousel, Remote Arrows) \u003c= 5.6.3 - Form Submission Admin Email Bypass",
    "slug": "bdthemes-element-pack-lite",
    "type": "plugin",
    "affected_version": "* - 5.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3927",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Table \u0026 Contact Form 7 Database – Tablesome \u003c= 1.0.33 - Unauthenticated Sensitive Information Exposure",
    "slug": "tablesome",
    "type": "plugin",
    "affected_version": "* - 1.0.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37498",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contact Form Email \u003c= 1.3.31 - Missing Authorization to Feedback Submission",
    "slug": "contact-form-to-email",
    "type": "plugin",
    "affected_version": "* - 1.3.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28494",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Pure CSS Circle Progress bar \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pure-css-circle-progress-bar",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11385",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11385",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shortcode for Font Awesome \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "shortcode-for-font-awesome",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0419",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0419",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amelia \u003c= 1.0.95 - Cross-Site Request Forgery",
    "slug": "ameliabooking",
    "type": "plugin",
    "affected_version": "* - 1.0.95",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.95",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31425",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Next-Cart Store to WooCommerce Migration \u003c= 3.9.4 - Unauthenticated SQL Injection",
    "slug": "nextcart-woocommerce-migration",
    "type": "plugin",
    "affected_version": "* - 3.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30807",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Debrandify · Remove or Replace WordPress Branding \u003c= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "debrandify",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9674",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Booking \u003c= 2.4.4 - Authenticated Stored Cross-Site Scripting",
    "slug": "wp-easy-booking",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35297",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UPC/EAN/GTIN Code Generator \u003c= 2.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion",
    "slug": "upc-ean-barcode-generator",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53588",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53588",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Cowidgets – Elementor Addons \u003c= 1.1.2 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "cowidgets-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5179",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5179",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Compact WP Audio Player \u003c= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcode",
    "slug": "compact-wp-audio-player",
    "type": "plugin",
    "affected_version": "* - 1.9.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10176",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10176",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Checkout Files Upload for WooCommerce \u003c= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "checkout-files-upload-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39520",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Permalink Manager \u003c= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.4.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2538",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Nokri \u003c= 1.6.4 - Cross-Site Request Forgery",
    "slug": "nokri",
    "type": "theme",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58259",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58259",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Category Image With Grid and Slider \u003c= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "post-category-image-with-grid-and-slider",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4747",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4747",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Membership For WooCommerce \u003c= 2.9.0 - Missing Authorization",
    "slug": "membership-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54692",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54692",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SMS Alert Order Notifications – WooCommerce \u003c= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation",
    "slug": "sms-alert",
    "type": "plugin",
    "affected_version": "* - 3.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-13553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13553",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BuddyBoss Platform and BuddyBoss Theme \u003c= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'",
    "slug": "buddyboss-platform",
    "type": "plugin",
    "affected_version": "* - 2.8.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13858",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BuddyBoss Platform and BuddyBoss Theme \u003c= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'",
    "slug": "buddyboss-theme",
    "type": "theme",
    "affected_version": "* - 2.8.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13858",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Helpdesk Support Ticket System for WooCommerce \u003c= 2.0.2 - Missing Authorization",
    "slug": "support-ticket-system-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57972",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57972",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Compact Archives \u003c= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "compact-archives",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58001",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58001",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Alt Text AI \u003c= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "alttext-ai",
    "type": "plugin",
    "affected_version": "* - 1.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34366",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34366",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Job Manager \u003c= 2.2.2 - Unauthenticated Information Exposure",
    "slug": "wp-job-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34549",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34549",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Responsive Blocks \u003c= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-block-editor-addons",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22697",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy SCSS Compiler - Compile SCSS to CSS automatically \u003c= 1.3.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "happy-scss-compiler",
    "type": "plugin",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5600",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Backup Migration \u003c= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10932",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10932",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CTX Feed \u003c= 6.5.6 - Authenticated (Shop Manager+) Arbitrary Options Update",
    "slug": "webappick-product-feed-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 6.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-38775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38775",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Cerber Security \u003c= 9.4 - IP Protection Bypass",
    "slug": "wp-cerber",
    "type": "plugin",
    "affected_version": "* - 9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4100",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4100",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Biltorvet Dealer Tools \u003c= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "biltorvet-dealer-tools",
    "type": "plugin",
    "affected_version": "* - 1.0.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22580",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22580",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AWSA Shipping \u003c= 1.3.0 - Reflected Cross-Site Scripting",
    "slug": "awsa-shipping",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32604",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Youzify – BuddyPress Community, User Profile, Social Network \u0026 Membership Plugin for WordPress \u003c= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion",
    "slug": "youzify",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9067",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9067",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Simple Retail Menus \u003c= 4.0.1 - SQL Injection",
    "slug": "simple-retail-menus",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-5183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-5183",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EmbedPress \u003c= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1425",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1425",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PageLayer \u003c= 1.8.1 - Missing Authorization",
    "slug": "pagelayer",
    "type": "plugin",
    "affected_version": "* - 1.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30465",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30465",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Ebook Store \u003c= 5.8009 - Reflected Cross-Site Scripting",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.8009",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8009",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45602",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfileGrid – User Profiles, Memberships, Groups and Communities \u003c= 5.7.9 - Insecure Direct Object Reference",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.7.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32808",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "the-monday",
    "type": "theme",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "doko",
    "type": "theme",
    "affected_version": "* - 1.0.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.27",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "eight-sec",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "revolve",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "bingle",
    "type": "theme",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "parallaxsome",
    "type": "theme",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "uncode-lite",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "eightlaw-lite",
    "type": "theme",
    "affected_version": "* - 2.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "accesspress-lite",
    "type": "theme",
    "affected_version": "* - 2.92",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.92",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "fotography",
    "type": "theme",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "arrival",
    "type": "theme",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "vmag",
    "type": "theme",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "accesspress-mag",
    "type": "theme",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "sakala",
    "type": "theme",
    "affected_version": "* - 1.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "vmagazine-lite",
    "type": "theme",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "digital-agency-lite",
    "type": "theme",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "the-launcher",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "zigcy-lite",
    "type": "theme",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "brovy",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "eightmedi-lite",
    "type": "theme",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wpparallax",
    "type": "theme",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "enlighten",
    "type": "theme",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "eightstore-lite",
    "type": "theme",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "accesspress-store",
    "type": "theme",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "swing-lite",
    "type": "theme",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "ripple",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "access-demo-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "punte",
    "type": "theme",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "accesspress-basic",
    "type": "theme",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "zigcy-baby",
    "type": "theme",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "scrollme",
    "type": "theme",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "zigcy-cosmetics",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "construction-lite",
    "type": "theme",
    "affected_version": "* - 1.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "vmagazine-news",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "accesspress-parallax-new",
    "type": "theme",
    "affected_version": "* - 4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "accesspress-root",
    "type": "theme",
    "affected_version": "* - 2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "accesspress-staple",
    "type": "theme",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "storevilla",
    "type": "theme",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "ultra-seven",
    "type": "theme",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "the100",
    "type": "theme",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "edict-lite",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wp-store",
    "type": "theme",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "opstore",
    "type": "theme",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AccessPress Themes and Plugin \u003c= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "bloger",
    "type": "theme",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-39317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-39317",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Shortlinks by Pretty Links \u003c= 3.6.15 - Missing Authorization",
    "slug": "pretty-link",
    "type": "plugin",
    "affected_version": "* - 3.6.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48247",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Enfold - Responsive Multi-Purpose Theme \u003c 4.8.4 - Reflected Cross-Site Scripting",
    "slug": "enfold",
    "type": "theme",
    "affected_version": "[*, 4.8.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24719",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CGC Maintenance Mode \u003c= 1.2 - IP Spoofing",
    "slug": "cgc-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30480",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30480",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Social Links \u003c= 0.3.1 - Reflected Cross-Site Scripting",
    "slug": "wp-social-links",
    "type": "plugin",
    "affected_version": "* - 0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23570",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23570",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RentPress \u003c= 6.6.4 - Reflected Cross-Site Scripting",
    "slug": "rentpress",
    "type": "plugin",
    "affected_version": "* - 6.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38323",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Elementor \u003c 1.30.0 - Stored Cross-Site Scripting",
    "slug": "ultimate-elementor",
    "type": "plugin",
    "affected_version": "[*, 1.30.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.30.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24271",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce Ship to Multiple Addresses \u003c= 3.8.5 - Cross-Site Request Forgery",
    "slug": "woocommerce-shipping-multiple-addresses",
    "type": "plugin",
    "affected_version": "* - 3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36514",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CWW Companion \u003c= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "cww-companion",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2130",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WpStream – Live Streaming, Video on Demand, Pay Per View \u003c= 4.4.10 - Cross-Site Request Forgery via wpstream_settings",
    "slug": "wpstream",
    "type": "plugin",
    "affected_version": "* - 4.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27458",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Facebook Members \u003c 5.0.5 - Cross-Site Request Forgery",
    "slug": "facebook-members",
    "type": "plugin",
    "affected_version": "[*, 5.0.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.5",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2013-2703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2703",
    "auth_type": "Unauth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L"
  },
  {
    "title": "Debug Log Manager \u003c= 2.3.1 - Missing Authorization via toggle_debugging",
    "slug": "debug-log-manager",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33915",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Docs \u003c= 2.2.6 - Missing Authorization",
    "slug": "wp-docs",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31417",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31417",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Mad Mimi for WordPress \u003c= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mad-mimi",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46262",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LTL Freight Quotes – Estes Edition \u003c= 3.3.7 - Unauthenticated SQL Injection",
    "slug": "ltl-freight-quotes-estes-edition",
    "type": "plugin",
    "affected_version": "* - 3.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13488",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13488",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Jannah - Newspaper Magazine News BuddyPress AMP \u003c 5.4.4 - Reflected Cross-Site Scripting",
    "slug": "jannah",
    "type": "theme",
    "affected_version": "[*, 5.4.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24364",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Pagination by BestWebSoft \u003c= 1.0.6 - Multiple Cross-Site Scripting",
    "slug": "pagination",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2017-18527",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18527",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Absolute Reviews \u003c= 1.0.8 - Cross-Site Request Forgery Bypass",
    "slug": "absolute-reviews",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4426",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "eaSYNC \u003c= 1.3.11 - Reflected Cross-Site Scripting",
    "slug": "easync-booking",
    "type": "plugin",
    "affected_version": "* - 1.3.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38384",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38384",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 6.4.1 - Authenticated (Author+) Path Traversal",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 6.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47637",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Landing Page Builder \u003c= 1.4.9.8.9  - Authenticated (Contributor+) Cross-Site Scripting via Shortcode",
    "slug": "page-builder-add",
    "type": "plugin",
    "affected_version": "* - 1.4.9.8.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4718",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4718",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Newsletter \u0026 Bulk Email Sender \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "newsletter-bulk-email",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45829",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \u003c= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 6.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7646",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7646",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Peertube Playlist \u003c= 1.07 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "embed-peertube-playlist",
    "type": "plugin",
    "affected_version": "* - 1.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.07",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4602",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Aeropage Sync for Airtable \u003c= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion",
    "slug": "aeropage-sync-for-airtable",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3915",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3915",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Scroll post excerpt \u003c= 8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "scroll-post-excerpt",
    "type": "plugin",
    "affected_version": "* - 8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45764",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45764",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPAchievements Free \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpachievements-free",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22362",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22362",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Addons for Elementor \u003c= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter",
    "slug": "happy-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 3.10.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.10.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4865",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4865",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Chained Quiz \u003c= 1.3.2 - Reflected Cross-Site Scripting via emailf",
    "slug": "chained-quiz",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4211",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FW Gallery \u003c= 8.0.0 - Unauthenticated Arbitrary File Upload",
    "slug": "fw-gallery",
    "type": "plugin",
    "affected_version": "* - 8.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.0.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49414",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Dark Mode for WP Dashboard \u003c= 1.2.3 - Cross-Site Request Forgery",
    "slug": "dark-mode-for-wp-dashboard",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43325",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43325",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Review Slider \u003c= 12.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-facebook-reviews",
    "type": "plugin",
    "affected_version": "* - 12.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51685",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited \u003c= 1.45 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "unlimited",
    "type": "theme",
    "affected_version": "* - 1.45",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.45",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31073",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31073",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LoginWP \u003c= 2.9.1 - Multiple Cross-Site Request Forgery vulnerabilities",
    "slug": "peters-login-redirect",
    "type": "plugin",
    "affected_version": "* - 2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-15115",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15115",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Post Grid \u003c= 7.7.4 - Missing Authorization via REST API",
    "slug": "the-post-grid",
    "type": "plugin",
    "affected_version": "* - 7.7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37481",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Hero Mega Menu - Responsive WordPress Menu Plugin \u003c= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion",
    "slug": "hmenu",
    "type": "plugin",
    "affected_version": "* - 1.16.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13780",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "WPB Quick View for WooCommerce \u003c= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woocommerce-lightbox",
    "type": "plugin",
    "affected_version": "* - 2.1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57967",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Child Themes Helper \u003c= 2.2.7 - Cross-Site Request Forgery to Arbitrary File Deletion",
    "slug": "child-themes-helper",
    "type": "plugin",
    "affected_version": "* - 2.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-25093",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25093",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "IvyPrep \u003c= 1.6.0 - Unauthenticated Local File Inclusion",
    "slug": "ivy-school",
    "type": "theme",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39470",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Fortnox Integration \u003c= 4.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "woocommerce-fortnox-integration",
    "type": "plugin",
    "affected_version": "* - 4.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47610",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47610",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Embed Images in Comments \u003c 0.6 - Cross-Site Scripting",
    "slug": "embed-comment-images",
    "type": "plugin",
    "affected_version": "[*, 0.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18561",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "License Manager for WooCommerce \u003c= 3.0.12 - Authenticated (Administrator+) SQL Injection",
    "slug": "license-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58788",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Soledad \u003c= 8.2.5 - Missing Authorization",
    "slug": "soledad",
    "type": "theme",
    "affected_version": "* - 8.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-42479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-42479",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Nuss \u003c= 1.3.3 - Authenticated (Subscriber+) PHP Object Injection",
    "slug": "nuss",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52827",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Adsense Click Fraud Monitoring \u003c= 1.8.6 - Reflected Cross-Site Scripting",
    "slug": "adsense-click-fraud-monitoring",
    "type": "plugin",
    "affected_version": "* - 1.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3998",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LWS Optimize \u003c= 1.9.1 - Cross-Site Request Forgery",
    "slug": "lws-optimize",
    "type": "plugin",
    "affected_version": "* - 1.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30541",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tickera – WordPress Event Ticketing \u003c= 3.5.2.4 - Insecure Direct Object Reference to Information Exposure",
    "slug": "tickera-event-ticketing-system",
    "type": "plugin",
    "affected_version": "* - 3.5.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7252",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "YARPP – Yet Another Related Posts Plugin \u003c= 5.30.9 - Authenticated(Administrator+) Cross-Site Scripting",
    "slug": "yet-another-related-posts-plugin",
    "type": "plugin",
    "affected_version": "* - 5.30.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.30.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6495",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6495",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Cerber Security \u003c 8.9.3 - Multifactor Bypass",
    "slug": "wp-cerber",
    "type": "plugin",
    "affected_version": "[*, 8.9.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.9.3",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-37597",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-37597",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "External Links in New Window / New Tab \u003c= 1.42 - Tabnabbing",
    "slug": "open-external-links-in-a-new-window",
    "type": "plugin",
    "affected_version": "* - 1.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1583",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1583",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Print Invoice \u0026 Delivery Notes for WooCommerce \u003c= 4.7.2 - Cross-Site Request Forgery via ts_reset_tracking_setting",
    "slug": "woocommerce-delivery-notes",
    "type": "plugin",
    "affected_version": "* - 4.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46795",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46795",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Advanced Google reCAPTCHA \u003c= 1.25 - Brute Force Protection IP Unblock",
    "slug": "advanced-google-recaptcha",
    "type": "plugin",
    "affected_version": "* - 1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12034",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12034",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Livemesh Addons for WPBakery Page Builder \u003c= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "addons-for-visual-composer",
    "type": "plugin",
    "affected_version": "* - 3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30183",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share, Social Login and Social Comments \u003c= 7.13.51 - Reflected Cross-Site Scripting",
    "slug": "super-socializer",
    "type": "plugin",
    "affected_version": "[*, 7.13.52)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.13.52",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2779",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twice Commerce \u003c= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "embed-rentle",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31543",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ReFlex Gallery \u003c 1.4.3 - Cross-Site Scripting",
    "slug": "reflex-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-7482",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7482",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Stop Registration Spam \u003c= 1.24 - Reflected Cross-Site Scripting",
    "slug": "stop-registration-spam",
    "type": "plugin",
    "affected_version": "* - 1.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32564",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.15 - Information Exposure",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3733",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP AutoKeyword \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "wp-autokeyword",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32582",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32582",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Responsive Testimonials Slider And Widget \u003c= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-responsive-testimonials-slider-and-widget",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4750",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Lightbox slider – Responsive Lightbox Gallery \u003c= 1.9.9 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "simple-lightbox-gallery",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1858",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Nokia Maps \u0026 Places \u003c 1.6.7 - Open Redirect",
    "slug": "nokia-mapsplaces",
    "type": "plugin",
    "affected_version": "[*, 1.6.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-1750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-1750",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Author Avatars List/Block \u003c= 2.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "author-avatars",
    "type": "plugin",
    "affected_version": "* - 2.1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22804",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22804",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "user files \u003c= 2.4.2 - Unauthenticated Arbitrary File Upload",
    "slug": "user-files",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-23953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23953",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Review Schema \u003c= 2.2.4 - Authenticated (Contributor+) Local File Inclusion via Post Meta",
    "slug": "review-schema",
    "type": "plugin",
    "affected_version": "* - 2.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1707",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1707",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "XmasB Quotes \u003c= 1.6.1 - Reflected Cross-Site Scripting",
    "slug": "xmasb-quotes",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53220",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Search \u0026 Filter Pro \u003c= 2.5.17 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "search-filter-pro",
    "type": "plugin",
    "affected_version": "* - 2.5.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.17",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6481",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Huurkalender WP \u003c= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "huurkalender-wp",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22528",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22528",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP ULike Pro \u003c= 1.9.3 - Unauthenticated Limited Arbitrary File Upload",
    "slug": "wp-ulike-pro",
    "type": "plugin",
    "affected_version": "* - 1.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9648",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Client Dash \u003c= 2.2.1 - Missing Authorization",
    "slug": "client-dash",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33652",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33652",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Shabbos and Yom Tov \u003c= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "shabbos-and-yom-tov",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23694",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "VikBooking Hotel Booking Engine \u0026 PMS \u003c= 1.6.7 - Reflected Cross-Site Scripting",
    "slug": "vikbooking",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32563",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32563",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MWW Disclaimer Buttons \u003c= 3.41 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "mww-disclaimer-buttons",
    "type": "plugin",
    "affected_version": "* - 3.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-60154",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-60154",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Envo Extra \u003c= 1.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "envo-extra",
    "type": "plugin",
    "affected_version": "* - 1.8.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32456",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32456",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "API KEY for Google Maps \u003c= 1.2.1 - Cross-Site Request Forgery",
    "slug": "api-key-for-google-maps",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29453",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Stored Cross-Site Scripting via accessibility-helper Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.9",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5733",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Stored Cross-Site Scripting via accessibility-helper Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.7",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5733",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Stored Cross-Site Scripting via accessibility-helper Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.6",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5733",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Stored Cross-Site Scripting via accessibility-helper Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.6",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5733",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Stored Cross-Site Scripting via accessibility-helper Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.3",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5733",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Stored Cross-Site Scripting via accessibility-helper Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5733",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.4 - Stored Cross-Site Scripting via accessibility-helper Title",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.9",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5733",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Conversios.io \u003c= 6.9.1 - Reflected Cross-Site Scripting",
    "slug": "enhanced-e-commerce-for-woocommerce-store",
    "type": "plugin",
    "affected_version": "* - 6.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29794",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29794",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EmbedPress \u003c= 3.7.3 - Sensitive Information Exposure",
    "slug": "embedpress",
    "type": "plugin",
    "affected_version": "* - 3.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3371",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3371",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Edit Comments \u003c= 0.3 - Unauthenticated SQL Injection",
    "slug": "edit-comments",
    "type": "plugin",
    "affected_version": "* - 0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2021-24551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24551",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Favorites \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "my-favorites",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-49263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49263",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.59 - Refleced Cross-Site Scripting",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.2.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45836",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tournamatch \u003c= 4.6.2 - Reflected Cross-Site Scripting",
    "slug": "tournamatch",
    "type": "plugin",
    "affected_version": "* - 4.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32600",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TimThumb \u003c= 2.8.13 - Remote Code Execution",
    "slug": "wordthumb",
    "type": "plugin",
    "affected_version": "* - 1.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.07",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-4663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4663",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TimThumb \u003c= 2.8.13 - Remote Code Execution",
    "slug": "user-avatar",
    "type": "plugin",
    "affected_version": "* - 1.4.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.12",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-4663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4663",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TimThumb \u003c= 2.8.13 - Remote Code Execution",
    "slug": "timthumb",
    "type": "plugin",
    "affected_version": "* - 2.8.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.13",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2014-4663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4663",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Script Integration \u003c= 2.1 - Cross-Site Request Forgery",
    "slug": "custom-script-integration",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30564",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30564",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Posts Date Ranges \u003c= 2.2 - Reflected Cross-Site Scripting",
    "slug": "posts-date-ranges",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54387",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LearnDash \u003c= 3.1.5 - Unauthenticated SQL Injection",
    "slug": "sfwd-lms",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-6009",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-6009",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Like \u0026 Share My Site \u003c= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "like-share-my-site",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7685",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7685",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Sticky Bar (formerly myStickymenu) \u003c= 2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mystickymenu",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4090",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Scratch \u0026 Win – Giveaways and Contests \u003c= 2.7.1 - Cross-Site Request Forgery via reset_installation Function",
    "slug": "scratch-win-giveaways-for-website-facebook",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12545",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Outdoor \u003c= 1.3.2 - Unauthenticated SQL Injection",
    "slug": "outdoor",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10743",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10743",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "BootStrap Shortcode \u003c= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bootstrap-shortcodes",
    "type": "plugin",
    "affected_version": "* - 3.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4777",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4777",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GS Shots for Dribbble \u003c= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gs-dribbble-portfolio",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56263",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Twitter Feeds \u003c= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function",
    "slug": "custom-twitter-feeds",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1314",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1314",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SendPulse Email Marketing Newsletter \u003c= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sendpulse-email-marketing-newsletter",
    "type": "plugin",
    "affected_version": "* - 2.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47547",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47547",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LockerPress – WordPress Security Plugin \u003c= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "lockerpress-wordpress-security",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9946",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9946",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Photo Sphere \u003c= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-photo-sphere",
    "type": "plugin",
    "affected_version": "* - 3.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23924",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Gallery Metabox \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "wp-gallery-metabox",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41876",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms \u003c= 1.2.3 - Unauthenticated PHP Object Injection via verify_field_val Function",
    "slug": "integration-for-contact-form-7-and-pipedrive",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-7696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7696",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Phlox Portfolio \u003c= 2.3.1 - Unauthenticated Local File Inclusion",
    "slug": "auxin-portfolio",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-38399",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38399",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 2.2 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2007-2627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-2627",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Booking Calendar Contact Form \u003c= 1.2.58 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "booking-calendar-contact-form",
    "type": "plugin",
    "affected_version": "* - 1.2.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48231",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Easy Pay (Free) \u003c= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection",
    "slug": "wp-easy-pay",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5861",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Product Feed PRO for WooCommerce \u003c= 11.2.1 - Reflected Cross-Site Scripting",
    "slug": "woo-product-feed-pro",
    "type": "plugin",
    "affected_version": "[*, 11.2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "11.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0426",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traveler \u003c= 3.1.6 - Missing Authorization in Several AJAX Actions",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "* - 3.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11926",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11926",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Ultimate Store Kit Elementor Addons \u003c= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-store-kit",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31357",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31357",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "audioCase \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "audiocase",
    "type": "plugin",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51909",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51909",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download manager \u003c= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files",
    "slug": "download-manager",
    "type": "plugin",
    "affected_version": "* - 3.3.03",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.03",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11768",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ARI Stream Quiz \u003c= 1.2.32 - Cross-Site Request Forgery",
    "slug": "ari-stream-quiz",
    "type": "plugin",
    "affected_version": "* - 1.2.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51487",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51487",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Crypto \u003c= 2.19 - Authentication Bypass via register",
    "slug": "crypto",
    "type": "plugin",
    "affected_version": "* - 2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.19",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9988",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9988",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Content Views \u003c= 3.6.2 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "content-views-query-and-display-post-page",
    "type": "plugin",
    "affected_version": "* - 3.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0612",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Manager \u003c 0.5.0 - SQL Injection",
    "slug": "broken-link-manager",
    "type": "plugin",
    "affected_version": "[*, 0.5.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2015-9467",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9467",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "My Private Site \u003c= 3.0.7 - Cross-Site Request Forgery",
    "slug": "jonradio-private-site",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1627",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1627",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Affiliate Platform \u003c= 6.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-affiliate-platform",
    "type": "plugin",
    "affected_version": "* - 6.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3897",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3897",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor \u003c= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.142",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.142",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1663",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MultiVendorX \u003c= 4.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dc-woocommerce-multi-vendor",
    "type": "plugin",
    "affected_version": "* - 4.2.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48263",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48263",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SKU Generator for WooCommerce \u003c= 1.6.2 - Reflected Cross-Site Scripting",
    "slug": "sku-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9212",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Favicon by RealFaviconGenerator \u003c= 1.2.12 - Reflected Cross-Site Scripting",
    "slug": "favicon-by-realfavicongenerator",
    "type": "plugin",
    "affected_version": "[*, 1.2.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-10116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10116",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Formality \u003c= 1.5.9 - Unauthenticated Local File Inclusion",
    "slug": "formality",
    "type": "plugin",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-48157",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48157",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "tagDiv Composer \u003c= 5.0 - Reflected Cross-Site Scripting via envato_code[]",
    "slug": "td-composer",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5212",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5212",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DancePress (TRWA) \u003c= 3.1.11 - Cross-Site Request Forgery",
    "slug": "dancepress-trwa",
    "type": "plugin",
    "affected_version": "* - 3.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53775",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53775",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "WP Baidu Map \u003c= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "wp-baidu-map",
    "type": "plugin",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9886",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9886",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid \u003c= 7.6.1 - Missing Authorization",
    "slug": "the-post-grid",
    "type": "plugin",
    "affected_version": "* - 7.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3936",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3936",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Backup and Restore Wordpress \u003c= 1.50 - Cross-Site Request Forgery to Backup Trigger",
    "slug": "wp-backitup",
    "type": "plugin",
    "affected_version": "* - 1.50",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.50",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43269",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43269",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WE – Client Logo Carousel \u003c= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "we-client-logo-carousel",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51821",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Shortcodes Actions And Filters \u003c= 2.10 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "add-actions-and-filters",
    "type": "plugin",
    "affected_version": "* - 2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37342",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37342",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Browser-Update-Notify \u003c= 0.2.1 - Reflected Cross-Site Scripting",
    "slug": "browser-update-notify",
    "type": "plugin",
    "affected_version": "* - 0.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23490",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP MediaTagger \u003c= 4.1.1 - Reflected Cross-Site Scripting",
    "slug": "wp-mediatagger",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13112",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13112",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme File Duplicator \u003c= 1.3 - Authenticated (Subscriber+) Arbitrary File Download",
    "slug": "theme-file-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27283",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Call Now Button \u003c= 1.4.13 - Cross-Site Request Forgery",
    "slug": "call-now-button",
    "type": "plugin",
    "affected_version": "* - 1.4.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24738",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24738",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PegaPoll \u003c= 1.0.2 - Unauthenticated Arbitrary Options Update",
    "slug": "pegapoll",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-50490",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50490",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP \u003c= 4.29.6 - Cross-Site Scripting",
    "slug": "videowhisper-live-streaming-integration",
    "type": "plugin",
    "affected_version": "* - 4.29.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.29.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-2297",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-2297",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow, Image Slider by 2J \u003c= 1.3.54 - Reflected Cross-Site Scripting",
    "slug": "2j-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.3.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.54",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29426",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Marketing Automation by AZEXO \u003c= 1.27.80 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "marketing-automation-by-azexo",
    "type": "plugin",
    "affected_version": "* - 1.27.80",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.27.80",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-50506",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50506",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "LMS \u003c= 9.1 - Reflected Cross-Site Scripting",
    "slug": "lms",
    "type": "theme",
    "affected_version": "* - 9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-52799",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52799",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Popup Builder 2.2.8 - 2.6.7.6 - PHP Object Injection",
    "slug": "popup-builder",
    "type": "plugin",
    "affected_version": "2.2.8 - 2.6.7.6",
    "from_version": "2.2.8",
    "from_inclusive": true,
    "to_version": "2.6.7.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-9006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9006",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Similar Posts \u003c= 3.1.5 - Admin+ Arbitrary PHP Code Execution",
    "slug": "similar-posts",
    "type": "plugin",
    "affected_version": "* - 3.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24537",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DocCheck Login \u003c= 1.1.5 - Unauthorized Post Access",
    "slug": "doccheck-login",
    "type": "plugin",
    "affected_version": "* - 1.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6786",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Portfolio  \u003c= 2.58 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "portfolio",
    "type": "plugin",
    "affected_version": "* - 2.58",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.58",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58245",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58245",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bold Page Builder \u003c= 5.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bold-page-builder",
    "type": "plugin",
    "affected_version": "* - 5.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58194",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Carousel Slider \u003c= 2.2.3 - Cross-Site Request Forgery",
    "slug": "carousel-slider",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-45270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-45270",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Help Desk WP \u003c= 1.2.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "helpdeskwp",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-1019",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1019",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-DBManager \u003c= 2.80.7 - Authenticated (Admin+) Remote Code Execution on Multi-Site",
    "slug": "wp-dbmanager",
    "type": "plugin",
    "affected_version": "* - 2.80.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.80.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2354",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Goods Catalog \u003c= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "goods-catalog",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41687",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41687",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Alpha Price Table For Elementor \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "alpha-price-table-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accordion \u003c= 2.3.15 - Missing Authorization",
    "slug": "accordions",
    "type": "plugin",
    "affected_version": "* - 2.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58678",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58678",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Sydney Toolbox \u003c= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "sydney-toolbox",
    "type": "plugin",
    "affected_version": "* - 1.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1447",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email to Download \u003c= 3.1.0 - Reflected Cross-Site Scripting",
    "slug": "email-to-download",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23786",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23786",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Restrict Taxonomies \u003c= 1.3.3 - Reflected Cross-Site Scripting",
    "slug": "restrict-taxonomies",
    "type": "plugin",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27289",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comments Like Dislike \u003c= 1.2.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset",
    "slug": "comments-like-dislike",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3244",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3244",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MainWP Child \u003c= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation",
    "slug": "mainwp-child",
    "type": "plugin",
    "affected_version": "* - 5.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10783",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "NV Slider \u003c= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "nv-slider",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51887",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51887",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Posts Like Dislike \u003c= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset",
    "slug": "posts-like-dislike",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41849",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.0.39 - Privilege Escalation",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.0.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.39",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-10270",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-10270",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Membership \u003c= 4.1.2 -  Membership Privilege Escalation",
    "slug": "simple-membership",
    "type": "plugin",
    "affected_version": "* - 4.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-2317",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2317",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts \u003c= 4.2 - Cross-Site Request Forgery to Font Assignment Deletion",
    "slug": "cits-support-svg-webp-media-upload",
    "type": "plugin",
    "affected_version": "* - 4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13768",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13768",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Premium Addons for Elementor \u003c= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style'",
    "slug": "premium-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 4.10.28",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.28",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3647",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3647",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Activity Log \u003c= 4.6.1 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-security-audit-log",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-50905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-50905",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Getwid – Gutenberg Blocks \u003c= 2.0.4 - Missing Authorization to Recaptcha API Key Modification",
    "slug": "getwid",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6959",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "All-in-One Video Gallery \u003c= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode",
    "slug": "all-in-one-video-gallery",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-4670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4670",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "HT Mega \u003c= 2.9.0 - Missing Authorization",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54695",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.1.2 - SQL Injection",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2011-3130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3130",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Floating Menu \u003c= 1.4.0 - Cross-Site Scripting via id Parameter",
    "slug": "wp-floating-menu",
    "type": "plugin",
    "affected_version": "[*, 1.4.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-25378",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-25378",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Forget About Shortcode Buttons \u003c= 1.1.1 - Reflected Cross-Site Scripting",
    "slug": "forget-about-shortcode-buttons",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-1000133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-1000133",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Groundhogg \u003c= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function",
    "slug": "groundhogg",
    "type": "plugin",
    "affected_version": "* - 3.7.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0394",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0394",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Social Share Boost \u003c= 4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "social-share-boost",
    "type": "plugin",
    "affected_version": "* - 4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25044",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpDiscuz \u003c= 7.6.3 - Missing Authorization via AJAX actions",
    "slug": "wpdiscuz",
    "type": "plugin",
    "affected_version": "* - 7.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45760",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45760",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Motor – Cars, Parts, Service, Equipments and Accessories WooCommerce Store \u003c 3.1.0 - Local File Inclusion",
    "slug": "motor",
    "type": "theme",
    "affected_version": "[*, 3.1.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-24375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24375",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Activity Log \u003c= 5.3.2 - Authenticated (Admin+) PHP Object Injection",
    "slug": "wp-security-audit-log",
    "type": "plugin",
    "affected_version": "* - 5.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0767",
    "auth_type": "Privileged",
    "cvss_score": 6.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "TI WooCommerce Wishlist \u003c= 2.8.2 - Unauthenticated SQL Injection",
    "slug": "ti-woocommerce-wishlist",
    "type": "plugin",
    "affected_version": "* - 2.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43917",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43917",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Motors – Car Dealership \u0026 Classified Listings Plugin \u003c= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation",
    "slug": "motors-car-dealership-classified-listings",
    "type": "plugin",
    "affected_version": "* - 1.4.64",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.64",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2807",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2807",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Member Access \u003c= 1.1.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure",
    "slug": "member-access",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11290",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "NanoSupport \u003c= 0.6.0 - Reflected Cross-Site Scripting",
    "slug": "nanosupport",
    "type": "plugin",
    "affected_version": "* - 0.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31461",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31461",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Broken Link Manager \u003c 0.6.0 - Cross-Site Scripting",
    "slug": "broken-link-manager",
    "type": "plugin",
    "affected_version": "[*, 0.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9453",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9453",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Floating Action Buttons \u003c= 0.9.1 - Missing Authorization",
    "slug": "floating-action-buttons",
    "type": "plugin",
    "affected_version": "* - 0.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56238",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56238",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress \u003c= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "dracula-dark-mode",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29771",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29771",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 4.3.6 - Authenticated (Admin+) Server-Side Request Forgery",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35637",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Captchelfie – Captcha by Selfie \u003c= 1.0.7 - Reflected Cross-Site Scripting",
    "slug": "captchelfie-captcha-by-selfie",
    "type": "plugin",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23620",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23620",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "all-in-one-box-login \u003c= 2.0.1 - Reflected Cross-Site Scripting",
    "slug": "all-in-one-login",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23587",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Kodex Posts likes \u003c= 2.4.3 - Cross-Site Request Forgery",
    "slug": "kodex-posts-likes",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46814",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46814",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Featured Image from URL \u003c= 4.8.1 - Missing Authorization",
    "slug": "featured-image-from-url",
    "type": "plugin",
    "affected_version": "* - 4.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37276",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "2 Click Social Media Buttons \u003c= 0.33 - Multiple Cross-Site Scripting",
    "slug": "2-click-socialmedia-buttons",
    "type": "plugin",
    "affected_version": "* - 0.33",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.33",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2012-4272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4272",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SureTriggers \u003c= 1.0.23 - Cross-Site Request Forgery",
    "slug": "suretriggers",
    "type": "plugin",
    "affected_version": "* - 1.0.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49749",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49749",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "OAuth Single Sign On – SSO (OAuth Client) \u003c= 6.22.5 - Authentication Bypass",
    "slug": "miniorange-login-with-eve-online-google-facebook",
    "type": "plugin",
    "affected_version": "* - 6.22.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.22.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2133",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2133",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Fluent Support – Helpdesk \u0026 Customer Support Ticket System \u003c= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory",
    "slug": "fluent-support",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13568",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13568",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Paytm – Donation Plugin \u003c= 1.3.2 - Authenticated (Admin+) SQL Injection",
    "slug": "wp-paytm-pay",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24554",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The FOX – Currency Switcher Professional for WooCommerce \u003c= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "woocommerce-currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10640",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10640",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "miniOrange’s Malware Scanner \u003c= 4.5.5 - Cross-Site Scripting",
    "slug": "miniorange-malware-protection",
    "type": "plugin",
    "affected_version": "* - 4.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1995",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "GI-Media Library \u003c 3.0 - Directory Traversal",
    "slug": "gi-media-library",
    "type": "plugin",
    "affected_version": "[*, 3.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-10136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10136",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Maia \u003c= 1.1.15 - Unauthenticated Local File Inclusion",
    "slug": "maia",
    "type": "theme",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-49258",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49258",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "DriCub \u003c= 2.9 - Unauthenticated Server-Side Request Forgery",
    "slug": "dricub-driving-school",
    "type": "theme",
    "affected_version": "* - 2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-58005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58005",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Style It \u003c= 1.0 - Cross-Site Scripting",
    "slug": "style-it",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4555",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wibiya Toolbar \u003c= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wibiya",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26571",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Botnet Attack Blocker \u003c= 2.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "botnet-attack-blocker",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31893",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 2.8.6 - Cross-Site Request Forgery to Membership Status Change",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8520",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ElementsReady Addons for Elementor \u003c= 6.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "element-ready-lite",
    "type": "plugin",
    "affected_version": "* - 6.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54224",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54224",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Coming Soon Page – Responsive Coming Soon \u0026 Maintenance Mode \u003c= 1.1.18 - Cross-Site Scripting via logo_height parameter",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5665",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Subscription Forms \u003c= 1.2.3 - Authenticated (Contributor+) SQL Injection",
    "slug": "wp-subscription-forms",
    "type": "plugin",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30784",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30784",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Elementor Pro \u003c= 2.9.3 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "elementor-pro",
    "type": "plugin",
    "affected_version": "[*, 2.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2020-13126",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-13126",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "ShrinkTheWeb (STW) Website Previews \u003c= 2.8.5 - Cross-Site Request Forgery",
    "slug": "shrinktheweb-website-preview-plugin",
    "type": "plugin",
    "affected_version": "* - 2.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58677",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58677",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Support Helpdesk Ticket System Lite \u003c= 4.5.2 - Reflected Cross-Site Scripting",
    "slug": "ticket-help-desk-system-lite",
    "type": "plugin",
    "affected_version": "* - 4.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31626",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31626",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "NextScripts: Social Networks Auto-Poster \u003c= 4.3.20 - Reflected Cross-Site Scripting",
    "slug": "social-networks-auto-poster-facebook-twitter-g",
    "type": "plugin",
    "affected_version": "* - 4.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38356",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Builder (Lite Version) \u003c= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter",
    "slug": "beaver-builder-lite-version",
    "type": "plugin",
    "affected_version": "* - 2.8.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7895",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7895",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Church Admin \u003c= 4.4.4 - Missing Authorization",
    "slug": "church-admin",
    "type": "plugin",
    "affected_version": "* - 4.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37440",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Social Sharing Plugin – Sassy Social Share \u003c= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter",
    "slug": "sassy-social-share",
    "type": "plugin",
    "affected_version": "* - 3.3.69",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.69",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11252",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11252",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ni WooCommerce Cost Of Goods \u003c= 3.2.8 - Missing Authorization",
    "slug": "ni-woocommerce-cost-of-goods",
    "type": "plugin",
    "affected_version": "* - 3.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31826",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "VM Menu Reorder plugin \u003c= 1.0.0 - Cross-Site Request Forgery to Settings Update",
    "slug": "vm-menu-reorder",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9893",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9893",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Automatic \u003c= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter",
    "slug": "wp-automatic",
    "type": "plugin",
    "affected_version": "* - 3.94.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.94.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4849",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4849",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SiteGround Optimizer \u003c= 5.0.12 - Missing Authorization",
    "slug": "sg-cachepress",
    "type": "plugin",
    "affected_version": "[*, 5.0.13)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.13",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2019-25217",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25217",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Arielbrailovsky-Viralad \u003c= 1.0.8 - Unauthenticated SQL Injection",
    "slug": "arielbrailovsky-viralad",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2107",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2107",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Front End Users \u003c= 3.2.24 - Cross-Site Request Forgery",
    "slug": "front-end-only-users",
    "type": "plugin",
    "affected_version": "* - 3.2.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34005",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34005",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SC Simple Zazzle \u003c= 1.1.6 - Reflected Cross-Site Scripting",
    "slug": "sc-simple-zazzle",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23733",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23733",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dokan \u003c= 3.6.3 - Authenticated (Vendor+) Stored Cross-Site Scripting",
    "slug": "dokan-lite",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3194",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3194",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Actionwear products sync \u003c= 2.3.2 - Unauthenticated Full Patch Disclosure",
    "slug": "actionwear-products-sync",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13535",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13535",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "SMS Alert Order Notifications – WooCommerce \u003c= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function",
    "slug": "sms-alert",
    "type": "plugin",
    "affected_version": "* - 3.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3876",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3876",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Linet ERP-Woocommerce Integration \u003c= 3.5.7 - Cross-Site Request Forgery",
    "slug": "linet-erp-woocommerce-integration",
    "type": "plugin",
    "affected_version": "* - 3.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24594",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24594",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wordapp \u003c= 1.7.0 - Missing Authorization",
    "slug": "wordapp",
    "type": "plugin",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30927",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tickera \u003c= 3.5.5.2 - Missing Authorization",
    "slug": "tickera-event-ticketing-system",
    "type": "plugin",
    "affected_version": "* - 3.5.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30851",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Delete Custom Fields \u003c= 0.3.1 - Cross-Site Request Forgery to Post Meta Deletion",
    "slug": "delete-custom-fields",
    "type": "plugin",
    "affected_version": "* - 0.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0613",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0613",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Sharing Toolkit \u003c 2.1.2 - Cross-Site Scripting",
    "slug": "social-sharing-toolkit",
    "type": "plugin",
    "affected_version": "[*, 2.1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-6280",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-6280",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventPrime \u003c= 2.8.6 - Sensitive Information Exposure",
    "slug": "eventprime-event-calendar-management",
    "type": "plugin",
    "affected_version": "* - 2.8.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33321",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33321",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Gutenberg Blocks by Kadence Blocks – Page Builder Features \u003c= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter",
    "slug": "kadence-blocks",
    "type": "plugin",
    "affected_version": "* - 3.2.38",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.38",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4863",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4863",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AppExperts \u003c= 1.4.3 - Unauthenticated Sensitive Information Exposure",
    "slug": "appexperts",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30609",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Editor \u003c= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read",
    "slug": "wp-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3295",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3295",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "RegistrationMagic – Custom Registration Forms and User Login \u003c= 4.6.0.3 - Authenticated Settings and User Data Export",
    "slug": "custom-registration-form-builder-with-submission-manager",
    "type": "plugin",
    "affected_version": "[*, 4.6.0.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.0.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-9458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9458",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Advanced Product Information for WooCommerce \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "woo-advanced-product-information",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22803",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22803",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DOP Shortcodes \u003c= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "dop-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4377",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4377",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Event Booking \u003c= 2.7.1 - Reflected Cross-Site Scripting",
    "slug": "awesome-event-booking",
    "type": "plugin",
    "affected_version": "* - 2.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24560",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24560",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Essential Addons For Elementor \u003c=5.8.1 - Unauthenticated MailChimp API Key Disclosure",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-3779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3779",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Qi Addons For Elementor \u003c= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget",
    "slug": "qi-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.7.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4364",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4364",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Spiffy Calendar \u003c= 4.9.7 - Reflected Cross-Site Scripting",
    "slug": "spiffy-calendar",
    "type": "plugin",
    "affected_version": "* - 4.9.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30427",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PlayerJS \u003c= 2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "playerjs",
    "type": "plugin",
    "affected_version": "* - 2.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58651",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Boostify Header Footer Builder for Elementor \u003c= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameter",
    "slug": "boostify-header-footer-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5006",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5006",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CTHthemes CityBook \u003c= 2.3.3, TownHub \u003c= 1.0.5, and EasyBook \u003c= 1.2.1 - Stored Cross-Site Scripting",
    "slug": "easybook",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-20211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20211",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CTHthemes CityBook \u003c= 2.3.3, TownHub \u003c= 1.0.5, and EasyBook \u003c= 1.2.1 - Stored Cross-Site Scripting",
    "slug": "townhub",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-20211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20211",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CTHthemes CityBook \u003c= 2.3.3, TownHub \u003c= 1.0.5, and EasyBook \u003c= 1.2.1 - Stored Cross-Site Scripting",
    "slug": "citybook",
    "type": "theme",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-20211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-20211",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quote Tweet \u003c= 0.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "quote-tweet",
    "type": "plugin",
    "affected_version": "* - 0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22589",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Square Thumbnails \u003c= 1.1.0 - Missing Authorization",
    "slug": "square-thumbnails",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49851",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49851",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Recall \u003c= 16.26.14 - Missing Authorization",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49991",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49991",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Digiseller \u003c= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "digiseller",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10141",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10141",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP DSGVO Tools (GDPR) \u003c= 3.1.23 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "shapepress-dsgvo",
    "type": "plugin",
    "affected_version": "[*, 3.1.24)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.24",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-4358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4358",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Related Products for WooCommerce \u003c= 3.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "woo-related-products-refresh-on-reload",
    "type": "plugin",
    "affected_version": "* - 3.3.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5234",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OoohBoi Steroids for Elementor \u003c= 2.1.4 - Missing Authorization leading to Authenticated (Subscriber+) Image Upload",
    "slug": "ooohboi-steroids-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1169",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass",
    "slug": "easy-digital-downloads",
    "type": "plugin",
    "affected_version": "3.1 - 3.3.4",
    "from_version": "3.1",
    "from_inclusive": true,
    "to_version": "3.3.4",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2024-9654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9654",
    "auth_type": "Unauth",
    "cvss_score": 3.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Coming Soon Page – Responsive Coming Soon \u0026 Maintenance Mode \u003c= 1.1.18 - Cross-Site Scripting via coming-soon_sub_title parameter",
    "slug": "responsive-coming-soon-page",
    "type": "plugin",
    "affected_version": "* - 1.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-5660",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-5660",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gutentor \u003c= 3.5.1 - Missing Authorization",
    "slug": "gutentor",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58783",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits \u0026 WooCommerce Builders \u003c= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "essential-addons-for-elementor-lite",
    "type": "plugin",
    "affected_version": "* - 5.9.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.9.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4003",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4003",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Click \u0026 Pledge Connect Plugin \u003c= 2.24080000-WP6.6.1 - Unauthenticated SQL Injection",
    "slug": "click-pledge-connect",
    "type": "plugin",
    "affected_version": "[*, 2.24080000-WP6.6.1]",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.24080000-WP6.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32550",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Piotnet Forms \u003c= 1.0.25 - Missing Authorization via multiple AJAX actions",
    "slug": "piotnetforms",
    "type": "plugin",
    "affected_version": "* - 1.0.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51413",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GD bbPress Attachments \u003c 2.3 - Reflected Cross-Site Scripting",
    "slug": "gd-bbpress-attachments",
    "type": "plugin",
    "affected_version": "[*, 2.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-5481",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5481",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Swim Team \u003c 1.45.1085 - Directory Traversal",
    "slug": "wp-swimteam",
    "type": "plugin",
    "affected_version": "* - 1.44.1077",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.44.1077",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-5471",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-5471",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Pz-LinkCard \u003c= 2.5.2 - Reflected Cross-Site Scripting",
    "slug": "pz-linkcard",
    "type": "plugin",
    "affected_version": "* - 2.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0672",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0672",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Active Directory Integration / LDAP Integration \u003c= 4.1.5 - Authenticated (Subscriber+) LDAP Injection",
    "slug": "ldap-login-for-intranet-sites",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3447",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3447",
    "auth_type": "Auth",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
  },
  {
    "title": "Uncanny Automator \u003c= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update",
    "slug": "uncanny-automator",
    "type": "plugin",
    "affected_version": "* - 6.4.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4520",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4520",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Premium Addons PRO \u003c= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Global Badge Module",
    "slug": "premium-addons-pro",
    "type": "plugin",
    "affected_version": "* - 2.9.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2237",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz and Survey Master (QSM) \u003c= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "quiz-master-next",
    "type": "plugin",
    "affected_version": "* - 9.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6879",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6879",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Z Companion \u003c= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "z-companion",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-2575",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2575",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls \u0026 Member Access Subscriptions \u003c= 241216 - Reflected Cross-Site Scripting",
    "slug": "s2member",
    "type": "plugin",
    "affected_version": "* - 241216",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "241216",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11376",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11376",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "eaSYNC \u003c= 1.3.19 - Missing Authorization",
    "slug": "easync-booking",
    "type": "plugin",
    "affected_version": "* - 1.3.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32219",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.25.2 - Cross-Site Request Forgery in wfu_file_details",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.25.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.25.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13494",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1017",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1017",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12120",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Shortcodes Ultimate Pro \u003c= 7.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "shortcodes-ultimate-pro",
    "type": "plugin",
    "affected_version": "* - 7.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6766",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woocommerce OpenPos \u003c= 6.4.4 - Unauthenticated SQL Injection",
    "slug": "woocommerce-openpos",
    "type": "plugin",
    "affected_version": "* - 6.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37933",
    "auth_type": "Unauth",
    "cvss_score": 10,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WowStore \u003c= 4.2.4 - Missing Authorization",
    "slug": "product-blocks",
    "type": "plugin",
    "affected_version": "* - 4.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-39571",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39571",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Geo Mashup \u003c= 1.13.12 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "geo-mashup",
    "type": "plugin",
    "affected_version": "* - 1.13.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-44008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-44008",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Simple Download Monitor \u003c= 3.9.8 - Multiple Cross-Site Request Forgery vulnerabilities",
    "slug": "simple-download-monitor",
    "type": "plugin",
    "affected_version": "* - 3.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24696",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset",
    "slug": "themegrill-demo-importer",
    "type": "plugin",
    "affected_version": "1.3.4 - 1.6.1",
    "from_version": "1.3.4",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36837",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Page Visit Counter \u003c= 6.4.2 - Authenticated (Contributor+) SQL Injection",
    "slug": "advanced-page-visit-counter",
    "type": "plugin",
    "affected_version": "* - 6.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-28788",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28788",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "FV Flowplayer Video Player \u003c= 7.5.32.7212 - Reflected Cross-Site Scripting via id",
    "slug": "fv-wordpress-flowplayer",
    "type": "plugin",
    "affected_version": "* - 7.5.32.7212",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.32.7212",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-30499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-30499",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Share, Social Login and Social Comments \u003c 7.13.30 - Reflected Cross-Site Scripting",
    "slug": "super-socializer",
    "type": "plugin",
    "affected_version": "[*, 7.13.30)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.13.30",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24987",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24987",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slimstat Analytics \u003c= 5.2.6 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "wp-slimstat",
    "type": "plugin",
    "affected_version": "* - 5.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9548",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "iChart – Easy Charts and Graphs \u003c= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter",
    "slug": "ichart",
    "type": "plugin",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11928",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11928",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Oboxmedia Ads \u003c= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "oboxmedia-ads",
    "type": "plugin",
    "affected_version": "* - 1.9.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11827",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11827",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ElementsKit Lite \u003c= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget",
    "slug": "elementskit-lite",
    "type": "plugin",
    "affected_version": "* - 3.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4479",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Siteimprove \u003c= 2.0.6 - Cross-Site Request Forgery",
    "slug": "siteimprove",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32103",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Scraper \u003c= 5.7 - Missing Authorization to Arbitrary Page/Post Creation",
    "slug": "wp-scraper",
    "type": "plugin",
    "affected_version": "* - 5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3663",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3663",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \u003c= 1.5.109 - Authenticated (Contributor+) Information Exposure",
    "slug": "unlimited-elements-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.5.109",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.109",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35674",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35674",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP All Import Pro \u003c= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import",
    "slug": "wp-all-import-pro",
    "type": "plugin",
    "affected_version": "* - 4.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-9624",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9624",
    "auth_type": "Privileged",
    "cvss_score": 7.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N"
  },
  {
    "title": "Mimoos \u003c= 1.2 - Authenticated (Subscriber+) SQL Injection",
    "slug": "devoluciones-packback",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-55974",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-55974",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy WP SMTP \u003c= 1.5.1 - Authenticated (Admin+) Arbitrary File Deletion",
    "slug": "easy-wp-smtp",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45829",
    "auth_type": "Privileged",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "SetMore Theme – Custom Post Types \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "service-provider-profile-cpt",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22748",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22748",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Listeo - Directory \u0026 Listings With Booking - WordPress Theme \u003c 1.6.11 - Insecure Direct Object Reference",
    "slug": "listeo",
    "type": "theme",
    "affected_version": "[*, 1.6.11)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.11",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24318",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Digits \u003c 8.4.6.1 - Authentication Bypass via Weak OTP",
    "slug": "digits",
    "type": "plugin",
    "affected_version": "[*, 8.4.6.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.4.6.1",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2025-4094",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4094",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Stockholm \u003c= 9.6 - Unauthenticated Local File Inclusion",
    "slug": "stockholm",
    "type": "theme",
    "affected_version": "* - 9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-34551",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34551",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI WP Writer \u003c= 3.6.5 - Missing Authorization",
    "slug": "ai-wp-writer",
    "type": "plugin",
    "affected_version": "* - 3.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30459",
    "auth_type": "Unauth",
    "cvss_score": 5.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "AForms \u003c= 2.2.6 - Unauthenticated Full Path Disclosure",
    "slug": "aforms-form-builder-for-price-calculator-cost-estimation",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6565",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Schema Lite \u003c= 1.2.2 - Cross-Site Request Forgery",
    "slug": "schema-lite",
    "type": "theme",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37452",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37452",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "BackWPup \u003c= 4.0.1 - Authenticated (Administrator+) Directory Traversal",
    "slug": "backwpup",
    "type": "plugin",
    "affected_version": "* - 4.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5505",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5505",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H"
  },
  {
    "title": "SMTP for Amazon SES \u003c= 1.9 - Authenticated (Administrator+) SQL Injection",
    "slug": "smtp-amazon-ses",
    "type": "plugin",
    "affected_version": "* - 1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54043",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Export Users to CSV \u003c 1.4 - CSV Injection",
    "slug": "export-users",
    "type": "plugin",
    "affected_version": "[*, 1.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-9466",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-9466",
    "auth_type": "Auth",
    "cvss_score": 7.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
  },
  {
    "title": "Go To Top \u003c= 0.0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "go-to-top",
    "type": "plugin",
    "affected_version": "* - 0.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28922",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28922",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Automatic \u003c= 3.92.0 - Cross-Site Request Forgery to Privilege Escalation",
    "slug": "wp-automatic",
    "type": "plugin",
    "affected_version": "* - 3.92.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.92.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-27955",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27955",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Clicface Trombi \u003c= 2.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via nom Parameter",
    "slug": "clicface-trombi",
    "type": "plugin",
    "affected_version": "* - 2.08",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.08",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0820",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Long Form \u003c= 2.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "simple-long-form",
    "type": "plugin",
    "affected_version": "* - 2.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41136",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce \u003c= 9.0.2 - Unauthenticated HTML Injection",
    "slug": "woocommerce",
    "type": "plugin",
    "affected_version": "* - 9.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9944",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9944",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Chat App \u003c= 3.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-whatsapp",
    "type": "plugin",
    "affected_version": "* - 3.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2837",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2837",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Revy \u003c= 2.1 - Authenticated (Subscriber+) SQL Injection",
    "slug": "revy",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32924",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "CartFlows Pro \u003c= 1.11.11 - Reflected Cross-Site Scripting",
    "slug": "cartflows-pro",
    "type": "plugin",
    "affected_version": "* - 1.11.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36686",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ebook Store \u003c= 5.8001 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "ebook-store",
    "type": "plugin",
    "affected_version": "* - 5.8001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8001",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-23501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-23501",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Target Video Easy Publish \u003c= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter",
    "slug": "brid-video-easy-publish",
    "type": "plugin",
    "affected_version": "* - 3.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5237",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5237",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPUpper Share Buttons \u003c= 3.42 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wpupper-share-buttons",
    "type": "plugin",
    "affected_version": "* - 3.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.42",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3838",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3838",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Business Directory Plugin – Easy Listing Directories for WordPress \u003c= 5.11.1 - Cross-Site Request Forgery to Arbitrary Listing Export",
    "slug": "business-directory-plugin",
    "type": "plugin",
    "affected_version": "* - 5.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24249",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24249",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "teachPress \u003c= 9.0.2 - Reflected Cross-Site Scripting via meta_field_id  and cite_id",
    "slug": "teachpress",
    "type": "plugin",
    "affected_version": "[*, 9.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-36501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36501",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[6.8, 6.8.3)",
    "from_version": "6.8",
    "from_inclusive": true,
    "to_version": "6.8.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[8.6, 8.6.2)",
    "from_version": "8.6",
    "from_inclusive": true,
    "to_version": "8.6.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[4.6, 4.6.1)",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[5.2, 5.2.3)",
    "from_version": "5.2",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[7.0, 7.0.3)",
    "from_version": "7.0",
    "from_inclusive": true,
    "to_version": "7.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[8.5, 8.5.1)",
    "from_version": "8.5",
    "from_inclusive": true,
    "to_version": "8.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[8.7, 8.7.2)",
    "from_version": "8.7",
    "from_inclusive": true,
    "to_version": "8.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[3.3, 3.3.5)",
    "from_version": "3.3",
    "from_inclusive": true,
    "to_version": "3.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[4.7, 4.7.2)",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[7.8, 7.8.2)",
    "from_version": "7.8",
    "from_inclusive": true,
    "to_version": "7.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[8.0, 8.0.1)",
    "from_version": "8.0",
    "from_inclusive": true,
    "to_version": "8.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[9.3, 9.3.3)",
    "from_version": "9.3",
    "from_inclusive": true,
    "to_version": "9.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[4.5, 4.5.1)",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[2.3, 2.3.9)",
    "from_version": "2.3",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[4.3, 4.3.3)",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[6.5, 6.5.2)",
    "from_version": "6.5",
    "from_inclusive": true,
    "to_version": "6.5.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[6.6, 6.6.3)",
    "from_version": "6.6",
    "from_inclusive": true,
    "to_version": "6.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[7.4, 7.4.3)",
    "from_version": "7.4",
    "from_inclusive": true,
    "to_version": "7.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[8.2, 8.2.4)",
    "from_version": "8.2",
    "from_inclusive": true,
    "to_version": "8.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[8.4, 8.4.3)",
    "from_version": "8.4",
    "from_inclusive": true,
    "to_version": "8.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[4.4, 4.4.3)",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[5.1, 5.1.2)",
    "from_version": "5.1",
    "from_inclusive": true,
    "to_version": "5.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[6.3, 6.3.5)",
    "from_version": "6.3",
    "from_inclusive": true,
    "to_version": "6.3.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[7.5, 7.5.5)",
    "from_version": "7.5",
    "from_inclusive": true,
    "to_version": "7.5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[9.4, 9.4.2)",
    "from_version": "9.4",
    "from_inclusive": true,
    "to_version": "9.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[2.6, 2.6.5)",
    "from_version": "2.6",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[6.1, 6.1.3)",
    "from_version": "6.1",
    "from_inclusive": true,
    "to_version": "6.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[6.2, 6.2.3)",
    "from_version": "6.2",
    "from_inclusive": true,
    "to_version": "6.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[8.1, 8.1.2)",
    "from_version": "8.1",
    "from_inclusive": true,
    "to_version": "8.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[8.9, 8.9.2)",
    "from_version": "8.9",
    "from_inclusive": true,
    "to_version": "8.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[2.7, 2.7.4)",
    "from_version": "2.7",
    "from_inclusive": true,
    "to_version": "2.7.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[4.1, 4.1.2)",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[4.9, 4.9.1)",
    "from_version": "4.9",
    "from_inclusive": true,
    "to_version": "4.9.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[6.9, 6.9.2)",
    "from_version": "6.9",
    "from_inclusive": true,
    "to_version": "6.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[9.6, 9.6.2)",
    "from_version": "9.6",
    "from_inclusive": true,
    "to_version": "9.6.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[2.5, 2.5.4)",
    "from_version": "2.5",
    "from_inclusive": true,
    "to_version": "2.5.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[3.1, 3.1.4)",
    "from_version": "3.1",
    "from_inclusive": true,
    "to_version": "3.1.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[3.5, 3.5.5)",
    "from_version": "3.5",
    "from_inclusive": true,
    "to_version": "3.5.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[3.7, 3.7.4)",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[4.2, 4.2.3)",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[7.1, 7.1.3)",
    "from_version": "7.1",
    "from_inclusive": true,
    "to_version": "7.1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[2.0, 2.0.8)",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[3.4, 3.4.5)",
    "from_version": "3.4",
    "from_inclusive": true,
    "to_version": "3.4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[7.7, 7.7.4)",
    "from_version": "7.7",
    "from_inclusive": true,
    "to_version": "7.7.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[7.9, 7.9.2)",
    "from_version": "7.9",
    "from_inclusive": true,
    "to_version": "7.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[9.5, 9.5.3)",
    "from_version": "9.5",
    "from_inclusive": true,
    "to_version": "9.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[3.0, 3.0.5)",
    "from_version": "3.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[3.9, 3.9.8)",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[5.4, 5.4.2)",
    "from_version": "5.4",
    "from_inclusive": true,
    "to_version": "5.4.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[5.8, 5.8.2)",
    "from_version": "5.8",
    "from_inclusive": true,
    "to_version": "5.8.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[9.0, 9.0.3)",
    "from_version": "9.0",
    "from_inclusive": true,
    "to_version": "9.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[2.8, 2.8.4)",
    "from_version": "2.8",
    "from_inclusive": true,
    "to_version": "2.8.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[2.9, 2.9.5)",
    "from_version": "2.9",
    "from_inclusive": true,
    "to_version": "2.9.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[4.8, 4.8.3)",
    "from_version": "4.8",
    "from_inclusive": true,
    "to_version": "4.8.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[5.7, 5.7.3)",
    "from_version": "5.7",
    "from_inclusive": true,
    "to_version": "5.7.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[2.1, 2.1.6)",
    "from_version": "2.1",
    "from_inclusive": true,
    "to_version": "2.1.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[3.6, 3.6.3)",
    "from_version": "3.6",
    "from_inclusive": true,
    "to_version": "3.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[5.6, 5.6.3)",
    "from_version": "5.6",
    "from_inclusive": true,
    "to_version": "5.6.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[6.7, 6.7.2)",
    "from_version": "6.7",
    "from_inclusive": true,
    "to_version": "6.7.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[3.2, 3.2.4)",
    "from_version": "3.2",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[5.0, 5.0.1)",
    "from_version": "5.0",
    "from_inclusive": true,
    "to_version": "5.0.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[8.8, 8.8.3)",
    "from_version": "8.8",
    "from_inclusive": true,
    "to_version": "8.8.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[9.7, 9.7.1)",
    "from_version": "9.7",
    "from_inclusive": true,
    "to_version": "9.7.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[5.9, 5.9.2)",
    "from_version": "5.9",
    "from_inclusive": true,
    "to_version": "5.9.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[6.4, 6.4.4)",
    "from_version": "6.4",
    "from_inclusive": true,
    "to_version": "6.4.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[7.2, 7.2.3)",
    "from_version": "7.2",
    "from_inclusive": true,
    "to_version": "7.2.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[7.3, 7.3.3)",
    "from_version": "7.3",
    "from_inclusive": true,
    "to_version": "7.3.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[7.6, 7.6.2)",
    "from_version": "7.6",
    "from_inclusive": true,
    "to_version": "7.6.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[8.3, 8.3.1)",
    "from_version": "8.3",
    "from_inclusive": true,
    "to_version": "8.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[9.1, 9.1.1)",
    "from_version": "9.1",
    "from_inclusive": true,
    "to_version": "9.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[9.2, 9.2.2)",
    "from_version": "9.2",
    "from_inclusive": true,
    "to_version": "9.2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[2.4, 2.4.6)",
    "from_version": "2.4",
    "from_inclusive": true,
    "to_version": "2.4.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[5.5, 5.5.3)",
    "from_version": "5.5",
    "from_inclusive": true,
    "to_version": "5.5.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[6.0, 6.0.2)",
    "from_version": "6.0",
    "from_inclusive": true,
    "to_version": "6.0.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[2.2, 2.2.9)",
    "from_version": "2.2",
    "from_inclusive": true,
    "to_version": "2.2.9",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[3.8, 3.8.4)",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[4.0, 4.0.5)",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "JetPack \u003c= 9.7 - Information Disclosure",
    "slug": "jetpack",
    "type": "plugin",
    "affected_version": "[5.3, 5.3.2)",
    "from_version": "5.3",
    "from_inclusive": true,
    "to_version": "5.3.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24374",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24374",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Secure Copy Content Protection and Content Locking \u003c= 4.2.3 - Reflected Cross-Site Scripting",
    "slug": "secure-copy-content-protection",
    "type": "plugin",
    "affected_version": "* - 4.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47306",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47306",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SP Blog Designer \u003c= 1.0.0 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "sp-blog-designer",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-52498",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52498",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Job Portal \u003c= 2.3.2 - Unauthenticated Arbitrary File Download",
    "slug": "wp-job-portal",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-48273",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48273",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ElementsReady Addons for Elementor \u003c= 6.4.8 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates",
    "slug": "element-ready-lite",
    "type": "plugin",
    "affected_version": "* - 6.4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10356",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10356",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Intelligence \u003c= 1.4.0 - Unauthenticated Full Path Disclosure",
    "slug": "intelligence",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6573",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6573",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Quick Page/Post Redirect \u003c= 5.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings",
    "slug": "quick-pagepost-redirect-plugin",
    "type": "plugin",
    "affected_version": "* - 5.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25063",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ACF: Yandex Maps Field \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "acf-yandex-maps-field",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30930",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30930",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OneElements – Best Elementor Addons \u003c= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "oneelements-ultimate-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.3.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9068",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AliNext \u003c= 3.5.1 - Open Redirect",
    "slug": "ali2woo-lite",
    "type": "plugin",
    "affected_version": "* - 3.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-30859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30859",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Connect Contact Form 7 to Constant Contact \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "connect-contact-form-7-to-constant-contact-v3",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54343",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54343",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "JetWooBuilder \u003c= 2.1.20 - Authenticated (Subscriber+) Information Exposure",
    "slug": "jet-woo-builder",
    "type": "plugin",
    "affected_version": "* - 2.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53998",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "XPlainer - WooCommerce Product FAQ \u003c= 1.6.3 - Reflected Cross-Site Scripting",
    "slug": "faq-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37515",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37515",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Affiliates Manager \u003c= 2.9.20 - Cross-Site Request Forgery via process_bulk_action()",
    "slug": "affiliates-manager",
    "type": "plugin",
    "affected_version": "* - 2.9.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28986",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Category Post Shortcode \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "category-post-shortcode",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56021",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "10Web AI Assistant – AI content writing assistant \u003c= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation",
    "slug": "ai-assistant-by-10web",
    "type": "plugin",
    "affected_version": "* - 1.0.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6985",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Basticom Framework \u003c= 1.5.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload",
    "slug": "basticom-framework",
    "type": "plugin",
    "affected_version": "* - 1.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9443",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9443",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Qi Addons For Elementor \u003c= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "qi-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0826",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Time Tracker \u003c= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion",
    "slug": "time-tracker",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-9018",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9018",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Loyal Customers \u003c= 2.6 - Missing Authorization",
    "slug": "woocommerce-loyal-customer",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32544",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer \u003c= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "3d-flipbook-dflip-lite",
    "type": "plugin",
    "affected_version": "* - 2.3.52",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.52",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11830",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11830",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Links Page \u003c= 4.9.6 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wp-links-page",
    "type": "plugin",
    "affected_version": "* - 4.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30998",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30998",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Animated Counters \u003c= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "animated-counters",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11905",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11905",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce - PDF Vouchers \u003c= 4.9.3 - Authentication Bypass to Voucher Vendor",
    "slug": "woocommerce-pdf-vouchers",
    "type": "plugin",
    "affected_version": "* - 4.9.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7027",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Structured Content (JSON-LD) #wpsc \u003c= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via FAQ Block",
    "slug": "structured-content",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-3414",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3414",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "One Click Plugin Updater \u003c= 2.4.14 - Cross-Site Request Forgery to Settings Update",
    "slug": "one-click-plugin-updater",
    "type": "plugin",
    "affected_version": "* - 2.4.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.14",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-1791",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1791",
    "auth_type": "Unauth",
    "cvss_score": 9.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WPQA - Builder forms Addon For WordPress \u003c 5.7 - Information Disclosure",
    "slug": "wpqa",
    "type": "plugin",
    "affected_version": "[*, 5.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-2198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2198",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Pretty Link Lite \u003c 1.5.6 - Cross-Site Scripting",
    "slug": "pretty-link-lite",
    "type": "plugin",
    "affected_version": "[*, 1.5.6)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2011-5192",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-5192",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Responsive Owl Carousel for Elementor \u003c= 1.2.0 - Local File Inclusion",
    "slug": "responsive-owl-carousel-elementor",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-5345",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5345",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "N360 | Splash Screen \u003c= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "n360-splash-screen",
    "type": "plugin",
    "affected_version": "* - 1.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-47665",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47665",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Table of Contents Plus \u003c= 2411 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "table-of-contents-plus",
    "type": "plugin",
    "affected_version": "* - 2411",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2411",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5578",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5578",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Prayer \u003c= 1.6.5 - Cross-Site Request Forgery Bypass",
    "slug": "wp-prayer",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-4412",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4412",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WPC Smart Wishlist for WooCommerce \u003c= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure",
    "slug": "woo-smart-wishlist",
    "type": "plugin",
    "affected_version": "* - 5.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-11742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-11742",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WPCS – WordPress Currency Switcher Professional \u003c= 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution",
    "slug": "currency-switcher",
    "type": "plugin",
    "affected_version": "* - 1.2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-2169",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-2169",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Role Includer \u003c= 1.6 - Reflected Cross-Site Scripting via user_id Parameter",
    "slug": "role-includer",
    "type": "plugin",
    "affected_version": "* - 1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54290",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Participants Database \u003c= 2.7.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "participants-database",
    "type": "plugin",
    "affected_version": "* - 2.7.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58008",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58008",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "All In One WP Security \u0026 Firewall \u003c= 3.9.4 - Reflected Cross-Site Scripting",
    "slug": "all-in-one-wp-security-and-firewall",
    "type": "plugin",
    "affected_version": "[*, 3.9.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9294",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crazy Bone \u003c 0.6.0 - Stored Cross-Site Scripting",
    "slug": "crazy-bone",
    "type": "plugin",
    "affected_version": "[*, 0.6.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-9430",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9430",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Import Export For WooCommerce \u003c= 1.6.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "import-export-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-54262",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54262",
    "auth_type": "Auth",
    "cvss_score": 9.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "RateMyAgent Official \u003c= 1.4.0 - Cross-Site Request Forgery to API Key Update",
    "slug": "ratemyagent-official",
    "type": "plugin",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0801",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0801",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSVPmaker Excel \u003c= 1.1 - Reflected Cross-Site Scripting",
    "slug": "rsvpmaker-excel",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-38337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-38337",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Add Posts to Pages \u003c= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "add-posts-to-pages",
    "type": "plugin",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23826",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23826",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "User meta shortcodes \u003c= 0.5 - Improper Access Control",
    "slug": "user-meta-shortcodes",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24859",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24859",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Extensions For CF7 \u003c= 3.2.0 - Authenticated (Admin+) Sever-Side Request Forgery",
    "slug": "extensions-for-cf7",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2025-24695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24695",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Interactive Geo Maps \u003c= 1.6.24 - Reflected Cross-Site Scripting",
    "slug": "interactive-geo-maps",
    "type": "plugin",
    "affected_version": "* - 1.6.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.24",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32525",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32525",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.6 - 4.6.1",
    "from_version": "4.6",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.16",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.13",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.3 - 4.3.6",
    "from_version": "4.3",
    "from_inclusive": true,
    "to_version": "4.3.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.4 - 4.4.5",
    "from_version": "4.4",
    "from_inclusive": true,
    "to_version": "4.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.5 - 4.5.4",
    "from_version": "4.5",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.7",
    "from_version": "4.7",
    "from_inclusive": true,
    "to_version": "4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.16",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.14",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.13",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c 4.7.1 - Cross-Site Request Forgery via Widget Editing",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.10",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-5492",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-5492",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
  },
  {
    "title": "iubenda \u003c 2.3.5 - Failure to Restrict URL Protocol",
    "slug": "iubenda-cookie-law-solution",
    "type": "plugin",
    "affected_version": "* - 2.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2020-12742",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-12742",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Automatically Hierarchic Categories in Menu \u003c= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "automatically-hierarchic-categories-in-menu",
    "type": "plugin",
    "affected_version": "* - 2.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47365",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47365",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Platform 4 \u003c= 1.1.4 - Cross-Site Request Forgery",
    "slug": "platform",
    "type": "theme",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10945",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AffiliateWP \u003c= 2.14.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation",
    "slug": "affiliate-wp",
    "type": "plugin",
    "affected_version": "2.14.0",
    "from_version": "2.14.0",
    "from_inclusive": true,
    "to_version": "2.14.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4600",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Unite Gallery Lite \u003c= 1.7.59 - Authenticated(Administrator+) Local File Inclusion via 'view' parameter",
    "slug": "unite-gallery-lite",
    "type": "plugin",
    "affected_version": "* - 1.7.59",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.59",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-33310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-33310",
    "auth_type": "Privileged",
    "cvss_score": 5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N"
  },
  {
    "title": "Elegant Pink \u003c= 1.3.0 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "elegant-pink",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37426",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37426",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "FoxyShop \u003c= 4.8.1 - Reflected Cross-Site Scripting",
    "slug": "foxyshop",
    "type": "plugin",
    "affected_version": "* - 4.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1220",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1220",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Woo Slider Pro \u003c= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion",
    "slug": "woo-slider-pro-drag-drop-slider-builder-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48334",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48334",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form Builder CP \u003c= 1.2.41 - Authenticated (Contributor+) SQL Injection",
    "slug": "cp-easy-form-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13680",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links \u0026 Link Pages \u003c= 2.4.1 - Authenticated (Contributor+) SQL Injection",
    "slug": "clickwhale",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51715",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP Time Slots Booking Form \u003c= 1.2.11 - Missing Authorization",
    "slug": "wp-time-slots-booking-form",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35735",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP SEO Structured Data Schema \u003c= 2.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Settings",
    "slug": "wp-seo-structured-data-schema",
    "type": "plugin",
    "affected_version": "* - 2.7.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-4127",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4127",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "EventON \u003c= 2.4.1 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "eventon-lite",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-32160",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32160",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Primary Addon for Elementor \u003c= 1.6.2 - Authenticated (Contributor+) Post Disclosure",
    "slug": "primary-addon-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10670",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10670",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Bit Assist \u003c= 1.5.2 - Authenticated (Subscriber+) SQL Injection via id Parameter",
    "slug": "bit-assist",
    "type": "plugin",
    "affected_version": "* - 1.5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-0821",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0821",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "NOO Timetable \u003c= 2.1.3 - Cross-Site Request Forgery",
    "slug": "noo-timetable",
    "type": "plugin",
    "affected_version": "* - 2.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-45828",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-45828",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership \u003c= 1.9.5 - Cross-Site Request Forgery",
    "slug": "paid-membership",
    "type": "plugin",
    "affected_version": "* - 1.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27629",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Simple add pages or posts \u003c= 2.0.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting",
    "slug": "simple-add-pages-or-posts",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12288",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12288",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OneTone \u003c= 3.0.6 \u0026 OneTone Companion \u003c= 1.1.1 - Stored Cross-Site Scripting",
    "slug": "onetone",
    "type": "theme",
    "affected_version": "* - 3.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17231",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OneTone \u003c= 3.0.6 \u0026 OneTone Companion \u003c= 1.1.1 - Stored Cross-Site Scripting",
    "slug": "onetone-companion",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2019-17231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-17231",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Dashboard Widgets Suite \u003c= 3.4.3 - Reflected Cross-Site Scripting",
    "slug": "dashboard-widgets-suite",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0979",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Device Detector \u003c= 4.2.0 - Reflected Cross-Site Scripting via id",
    "slug": "device-detector",
    "type": "plugin",
    "affected_version": "* - 4.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56010",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56010",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Printcart Web to Print Product Designer for WooCommerce \u003c= 2.3.9 - Unauthenticated Arbitrary File Upload",
    "slug": "printcart-integration",
    "type": "plugin",
    "affected_version": "* - 2.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47641",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47641",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User profile \u003c= 2.0.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "user-profile",
    "type": "plugin",
    "affected_version": "* - 2.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29097",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29097",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 3.0.4 - Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-0700",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-0700",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smoove connector for Elementor forms \u003c= 4.1.0 - Reflected Cross-Site Scripting",
    "slug": "smoove-elementor",
    "type": "plugin",
    "affected_version": "* - 4.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11367",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11367",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Terillion Reviews \u003c 1.2 - Stored Cross-Site Scripting",
    "slug": "terillion-reviews",
    "type": "plugin",
    "affected_version": "[*, 1.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2013-2501",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-2501",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Tag Miner (Automatic Tag Extraction) \u003c 1.1.5 - Cross-Site Scripting",
    "slug": "fossura-tag-miner",
    "type": "plugin",
    "affected_version": "[*, 1.1.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2016-10979",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10979",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Beaver Themer \u003c= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode",
    "slug": "beaver-themer",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6695",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WP JobHunt \u003c= 7.1 - Authentication Bypass to Candidate",
    "slug": "wp-jobhunt",
    "type": "plugin",
    "affected_version": "* - 7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11283",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11283",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Slideshow, Image Slider by 2J \u003c= 1.3.54 - Reflected Cross-Site Scripting via 'post'",
    "slug": "2j-slideshow",
    "type": "plugin",
    "affected_version": "* - 1.3.54",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.54",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4604",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Random Quotes \u003c= 1.3 - Reflected Cross-Site Scripting",
    "slug": "random-quotes",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27267",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Fastest Cache \u003c= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_callback'",
    "slug": "wp-fastest-cache",
    "type": "plugin",
    "affected_version": "* - 1.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1918",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1918",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Optimize images ALT Text \u003c= 2.0.7 - Cross-Site Request Forgery",
    "slug": "imageseo",
    "type": "plugin",
    "affected_version": "* - 2.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4548",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elementor Header \u0026 Footer Builder \u003c= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget",
    "slug": "header-footer-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5757",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5757",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WDesignkit \u003c= 1.0.40 - Authenticated (Administrator+) Arbitrary File Upload",
    "slug": "wdesignkit",
    "type": "plugin",
    "affected_version": "* - 1.0.40",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.40",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-53811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53811",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Bamazoo – Button Generator \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dgs Shortcode",
    "slug": "bamazoo-button-generator",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10150",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10150",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Donations \u003c= 1.8 - Unauthenticated SQL Injection",
    "slug": "nd-donations",
    "type": "plugin",
    "affected_version": "* - 1.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-0782",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0782",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPBakery Page Builder for WordPress \u003c= 6.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "js_composer",
    "type": "plugin",
    "affected_version": "* - 6.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-31213",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-31213",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Templately \u003c= 2.2.5 - Improper Authorization to Arbitrary Post Deletion",
    "slug": "templately",
    "type": "plugin",
    "affected_version": "* - 2.2.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-5454",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-5454",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Master Addons for Elementor \u003c= 2.0.5.3 - Missing Authorization",
    "slug": "master-addons",
    "type": "plugin",
    "affected_version": "* - 2.0.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-40679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40679",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "miniOrange's Google Authenticator \u003c= 5.6.1 - Sensitive Data Exposure of Multifactor Backup Codes",
    "slug": "miniorange-2-factor-authentication",
    "type": "plugin",
    "affected_version": "* - 5.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.6.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-44589",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-44589",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Real3D Flipbook \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "real3d-flipbook",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2016-10967",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10967",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Countdown, Coming Soon, Maintenance – Countdown \u0026 Clock \u003c= 2.7.8 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injection",
    "slug": "countdown-builder",
    "type": "plugin",
    "affected_version": "* - 2.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2017",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2017",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Parcel Pro \u003c= 1.8.4 - Reflected Cross-Site Scripting",
    "slug": "woo-parcel-pro",
    "type": "plugin",
    "affected_version": "* - 1.8.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9383",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom Field List Widget \u003c= 1.5.1 - Unauthenticated Local File Inclusion",
    "slug": "custom-field-list-widget",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-23952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23952",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "(dp) AddThis \u003c= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "dp-addthis",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50540",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50540",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Real Estate \u003c= 2.2.6 - Unauthenticated Privilege Escalation",
    "slug": "easy-real-estate",
    "type": "plugin",
    "affected_version": "* - 2.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-32555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32555",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Simple Local Avatars \u003c= 2.7.10 - Cross-Site Request Forgery via save_default_avatar_file_id()",
    "slug": "simple-local-avatars",
    "type": "plugin",
    "affected_version": "* - 2.7.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43116",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43116",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Auto Affiliate Links \u003c= 6.4.3 - Missing Authorization via aalAddLink",
    "slug": "wp-auto-affiliate-links",
    "type": "plugin",
    "affected_version": "* - 6.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1843",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1843",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "GiveWP \u003c= 2.33.1 - Missing Authorization via handleBeforeGateway",
    "slug": "give",
    "type": "plugin",
    "affected_version": "* - 2.33.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.33.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47183",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Proposals \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wp-proposals",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-57965",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57965",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Meks Video Importer \u003c= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification",
    "slug": "meks-video-importer",
    "type": "plugin",
    "affected_version": "* - 1.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6599",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6599",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Paid Memberships Pro \u003c= 2.12.5 - Missing Authorization via API",
    "slug": "paid-memberships-pro",
    "type": "plugin",
    "affected_version": "* - 2.12.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6855",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6855",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "SKT Skill Bar \u003c= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "skt-skill-bar",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26880",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26880",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Member \u003c= 1.3.28 - Reflected Cross-Site Scripting",
    "slug": "ultimate-member",
    "type": "plugin",
    "affected_version": "[*, 1.3.29)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.29",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-8354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-8354",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ninja Forms – The Contact Form Builder That Grows With You \u003c= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update",
    "slug": "ninja-forms",
    "type": "plugin",
    "affected_version": "* - 3.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10499",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10499",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.55 - Cross-Site Request Forgery",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.55",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.55",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4102",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Ultimate Accordion \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "ultimate-accordion",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51797",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "UiPress lite | Effortless custom dashboards, admin themes and pages \u003c= 3.5.07 - Authenticated (Subscriber+) Remote Code Execution",
    "slug": "uipress-lite",
    "type": "plugin",
    "affected_version": "* - 3.5.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.07",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3053",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "CDI – Collect and Deliver Interface for Woocommerce \u003c= 5.1.9 - Multiple Cross-Site Scripting",
    "slug": "collect-and-deliver-interface-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 5.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1933",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1933",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Photo Gallery by 10Web \u003c= 1.8.14 - Authenticated (Administrator+) Directory Traversal",
    "slug": "photo-gallery",
    "type": "plugin",
    "affected_version": "* - 1.8.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.14",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1427",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Zip Attachments \u003c= 1.5 - Directory Traversal",
    "slug": "zip-attachments",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-4694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-4694",
    "auth_type": "Unauth",
    "cvss_score": 8.6,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Posterity \u003c= 3.3 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "posterity",
    "type": "theme",
    "affected_version": "* - 3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37493",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37493",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Preview E-mails for WooCommerce \u003c= 2.2.1 - Reflected Cross-Site Scripting",
    "slug": "woo-preview-emails",
    "type": "plugin",
    "affected_version": "* - 2.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-27999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-27999",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress \u003c= 1.1.21 - Authenticated (Contributor+) SQL Injection",
    "slug": "bookingpress-appointment-booking",
    "type": "plugin",
    "affected_version": "* - 1.1.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11726",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11726",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Webinar Plugin – WebinarPress \u003c= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Webinar Updates",
    "slug": "wp-webinarsystem",
    "type": "plugin",
    "affected_version": "* - 1.33.24",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.33.24",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-11271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11271",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Tapfiliate \u003c= 3.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "tapfiliate",
    "type": "plugin",
    "affected_version": "* - 3.0.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25789",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25789",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Amazon Product Price \u003c= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "amazon-product-price",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54439",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54439",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "demon image annotation \u003c= 5.0 - Improper Input Restriction Validation",
    "slug": "demon-image-annotation",
    "type": "plugin",
    "affected_version": "* - 5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4171",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4171",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Infusionsoft Web Form JavaScript \u003c= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "infusionsoft-web-form-javascript",
    "type": "plugin",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31629",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31629",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow Gallery \u003c 1.7.4 - Cross-Site Scripting",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.7.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24882",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HL Twitter \u003c= 2014.1.18 - Cross-Site Request Forgery to Twitter Account Unlink",
    "slug": "hl-twitter",
    "type": "plugin",
    "affected_version": "* - 2014.1.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2014.1.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3631",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3631",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Easy WordPress Subscribe – Optin Hound \u003c= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter",
    "slug": "opt-in-hound",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9267",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9267",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Bulk Post Duplicator \u003c= 1.2 - Cross-Site Request Forgery",
    "slug": "wp-bulk-post-duplicator",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28884",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28884",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Elegant Grunge \u003c= 1.0.3 - Cross-Site Scripting",
    "slug": "elegant-grunge",
    "type": "theme",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2011-3856",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2011-3856",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Smart Custom Fields \u003c= 5.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "smart-custom-fields",
    "type": "plugin",
    "affected_version": "* - 5.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22308",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22308",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Crypto \u003c= 2.18 - Authentication Bypass via log_in",
    "slug": "crypto",
    "type": "plugin",
    "affected_version": "* - 2.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-9989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9989",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Valen - Sport, Fashion WooCommerce WordPress Theme \u003c= 2.4 - Unauthenticated Local File Inclusion",
    "slug": "valen",
    "type": "theme",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-28945",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28945",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cryptocurrency Widgets Pack \u003c= 2.0.1 - Missing Authorization",
    "slug": "cryptocurrency-widgets-pack",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31539",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31539",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP User Manager – User Profile Builder \u0026 Membership \u003c= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration",
    "slug": "wp-user-manager",
    "type": "plugin",
    "affected_version": "* - 2.9.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10537",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Flexmls® IDX Plugin \u003c= 3.14.22 - Reflected Cross-Site Scripting",
    "slug": "flexmls-idx",
    "type": "plugin",
    "affected_version": "* - 3.14.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.14.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8719",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Slideshow Gallery LITE \u003c= 1.7.6 - Cross-Site Request Forgery via admin_galleries",
    "slug": "slideshow-gallery",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28497",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28497",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "Simple Job Board \u003c= 2.10.6 - Cross-Site Request Forgery",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "* - 2.10.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-52122",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-52122",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Clone \u003c= 2.4.2 - Sensitive Information Exposure",
    "slug": "wp-clone-by-wp-academy",
    "type": "plugin",
    "affected_version": "* - 2.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-6750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6750",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Power Stats \u003c= 2.2.3 - Cross-Site Request Forgery",
    "slug": "wp-power-stats",
    "type": "plugin",
    "affected_version": "* - 2.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-45011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-45011",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Automatically Hierarchic Categories in Menu \u003c= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "automatically-hierarchic-categories-in-menu",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-50048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-50048",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts \u003c= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass",
    "slug": "wedevs-project-manager",
    "type": "plugin",
    "affected_version": "* - 2.6.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10174",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Smash Balloon Social Post Feed \u003c= 4.1 - Reflected Cross-Site Scripting",
    "slug": "custom-facebook-feed",
    "type": "plugin",
    "affected_version": "[*, 4.1.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-25065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-25065",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Assistant – Every Day Productivity Apps \u003c= 1.4.9.1 - Unauthenticated Sensitive Information Exposure",
    "slug": "assistant",
    "type": "plugin",
    "affected_version": "* - 1.4.9.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-33538",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-33538",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Elementor Addons by Livemesh \u003c= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Slider Widget",
    "slug": "addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 8.3.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.3.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1464",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1464",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Total Upkeep by BoldGrid \u003c= 1.14.9 - Unauthenticated Backup Download",
    "slug": "boldgrid-backup",
    "type": "plugin",
    "affected_version": "* - 1.14.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2020-36848",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36848",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "RSVP ME \u003c= 1.9.9 - Authenticated (Contributor+) SQL Injection",
    "slug": "rsvp-me",
    "type": "plugin",
    "affected_version": "* - 1.9.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50544",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50544",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Compare Products for WooCommerce \u003c= 3.2.1 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-compare-products",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-12435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-12435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FoodMenu \u003c= 1.20 - Reflected Cross-Site Scripting",
    "slug": "dzs-restaurantmenu",
    "type": "plugin",
    "affected_version": "* - 1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-29014",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-29014",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "We’re Open! \u003c= 1.41 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "opening-hours",
    "type": "plugin",
    "affected_version": "* - 1.41",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.41",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-3139",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3139",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FormLift for Infusionsoft Web Forms \u003c= 7.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "formlift",
    "type": "plugin",
    "affected_version": "* - 7.5.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31434",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31434",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Google Maps \u003c= 6.0.26 - Reflected Cross-Site Scripting",
    "slug": "wp-google-maps",
    "type": "plugin",
    "affected_version": "[*, 6.0.27)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.27",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-7182",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7182",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPUpper Share Buttons \u003c= 3.43 - Missing Authorization",
    "slug": "wpupper-share-buttons",
    "type": "plugin",
    "affected_version": "* - 3.43",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.43",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4997",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4997",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "LatePoint \u003c= 5.1.93 - Unauthenticated Local File Inclusion",
    "slug": "latepoint",
    "type": "plugin",
    "affected_version": "* - 5.1.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.93",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6715",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Twitter Cards Meta \u003c= 2.4.5 - Cross-Site Request Forgery",
    "slug": "twitter-cards-meta",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2017-18504",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18504",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Classified Listing \u003c= 2.4.5 - Cross-Site Request Forgery via rtcl_ajax_thumbnail_delete",
    "slug": "classified-listing",
    "type": "plugin",
    "affected_version": "* - 2.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-37387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-37387",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP AutoKeyword \u003c= 1.0 - Missing Authorization to Arbitrary Content Deletion",
    "slug": "wp-autokeyword",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31870",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31870",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "AJAX Thumbnail Rebuild \u003c= 1.13 - Missing Authorization",
    "slug": "ajax-thumbnail-rebuild",
    "type": "plugin",
    "affected_version": "* - 1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-47604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47604",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PickPlugins Product Slider for WooCommerce \u003c= 1.13.21 - Reflected Cross-Site Scripting",
    "slug": "woocommerce-products-slider",
    "type": "plugin",
    "affected_version": "* - 1.13.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24300",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IMGspider \u003c= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file'",
    "slug": "imgspider",
    "type": "plugin",
    "affected_version": "* - 2.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6318",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP YouTube Live \u003c= 1.10.0 - Cross-Site Request Forgery",
    "slug": "wp-youtube-live",
    "type": "plugin",
    "affected_version": "* - 1.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53261",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53261",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Tabs \u003c= 4.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "gt-tabs",
    "type": "plugin",
    "affected_version": "* - 4.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-46522",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-46522",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ResponsiveVoice Text To Speech \u003c= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "responsivevoice-text-to-speech",
    "type": "plugin",
    "affected_version": "* - 1.7.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0070",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0070",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "DK White Label \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "dk-white-label",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24541",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24541",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Email Subscribers \u0026 Newsletters \u003c= 4.2.2 - Unauthenticated File Download w/ Information Disclosure",
    "slug": "email-subscribers",
    "type": "plugin",
    "affected_version": "* - 4.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-19985",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-19985",
    "auth_type": "Unauth",
    "cvss_score": 5.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
  },
  {
    "title": "Affiliate For WooCommerce \u003c= 4.7.0 - Missing Authorization",
    "slug": "affiliate-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-25649",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-25649",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WP-LESS \u003c= 1.9.6 - Unauthenticated Sensitive Information Disclosure",
    "slug": "wp-less",
    "type": "plugin",
    "affected_version": "* - 1.9.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31550",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31550",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Tickera \u003c= 3.4.8.2 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "tickera-event-ticketing-system",
    "type": "plugin",
    "affected_version": "* - 3.4.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-24797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24797",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Security Audit Log \u003c= 3.1.1 - Sensitive Information Disclosure",
    "slug": "wp-security-audit-log",
    "type": "plugin",
    "affected_version": "* - 3.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2018-8719",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-8719",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "NewsBlogger \u003c= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "newsblogger",
    "type": "theme",
    "affected_version": "* - 0.2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-1304",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1304",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Rife Free \u003c= 2.4.18 - Cross-Site Request Forgery to Notice Dismissal",
    "slug": "rife-free",
    "type": "theme",
    "affected_version": "* - 2.4.18",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.18",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37491",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37491",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Vouchers \u003c 4.9.9 - Authentication Bypass",
    "slug": "woocommerce-pdf-vouchers",
    "type": "plugin",
    "affected_version": "[*, 4.9.9)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.9.9",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2024-54383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54383",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cookie Notice \u0026 Consent \u003c= 1.6.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "cookie-notice-consent",
    "type": "plugin",
    "affected_version": "* - 1.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-10496",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10496",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "If-So Dynamic Content Personalization \u003c= 1.8.0.3 - Reflected Cross-Site Scripting",
    "slug": "if-so",
    "type": "plugin",
    "affected_version": "* - 1.8.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5713",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Directory Free \u003c= 1.6.8 - Authenticated (Contributor+) SQL Injection via post_id",
    "slug": "web-directory-free",
    "type": "plugin",
    "affected_version": "* - 1.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2201",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "AI Engine \u003c= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions",
    "slug": "ai-engine",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-7780",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-7780",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Heateor Social Login WordPress \u003c= 1.1.35 - Authentication Bypass via Disqus OAuth provider",
    "slug": "heateor-social-login",
    "type": "plugin",
    "affected_version": "* - 1.1.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.35",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10020",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10020",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "zBench \u003c= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "zbench",
    "type": "theme",
    "affected_version": "* - 1.4.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37521",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37521",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Cost Calculator \u003c= 7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting",
    "slug": "ql-cost-calculator",
    "type": "plugin",
    "affected_version": "* - 7.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54046",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54046",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify PTB Search Addon \u003c= 1.3.9 - Reflected Cross-Site Scripting",
    "slug": "themify-ptb-search",
    "type": "plugin",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-1047",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1047",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Accordions – Multiple Accordions or FAQs Builder \u003c= 2.0.2 - Unauthenticated Arbitrary Options Update",
    "slug": "accordions-or-faqs",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-33198",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-33198",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Upload File Type Settings Plugin \u003c= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "upload-file-type-settings-plugin",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-25781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-25781",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advance Food Menu \u003c= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "advance-food-menu",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48323",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48323",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2861",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2861",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Helper Premium \u003c= 4.6.1 - Missing Authorization in whp_smtp_send_mail_test",
    "slug": "wp-helper-lite",
    "type": "plugin",
    "affected_version": "* - 4.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9065",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Awesome Support – WordPress HelpDesk \u0026 Support Plugin \u003c= 6.1.7 - Missing Authorization via wpas_get_users()",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "* - 6.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0595",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Piotnet Addons For Elementor \u003c= 2.4.29 - Unauthenticated Sensitive Information Exposure",
    "slug": "piotnet-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.29",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.29",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5614",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5614",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "HT Team Member \u003c= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode",
    "slug": "ht-team-member",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10223",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10223",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export All URLs \u003c= 4.2 - Cross-Site Request Forgery to Sensitive Data Export",
    "slug": "export-all-urls",
    "type": "plugin",
    "affected_version": "[*, 4.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2022-0914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0914",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Download Monitor \u003c= 4.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "download-monitor",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-23174",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-23174",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Good Old Gallery \u003c= 2.1.2 - Reflected Cross-Site Scripting",
    "slug": "good-old-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23959",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23959",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Related Posts \u003c= 3.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wordpress-23-related-posts-plugin",
    "type": "plugin",
    "affected_version": "* - 3.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24211",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24211",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Happy Elementor Addons Pro \u003c= 2.8.0 - Reflected Cross-Site Scripting",
    "slug": "happy-elementor-addons-pro",
    "type": "plugin",
    "affected_version": "* - 2.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-41236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-41236",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elessi \u003c= 6.3.9 - Reflected Cross-Site Scripting",
    "slug": "elessi-theme",
    "type": "theme",
    "affected_version": "* - 6.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49873",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49873",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Mapster WP Maps \u003c= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "mapster-wp-maps",
    "type": "plugin",
    "affected_version": "* - 1.20.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9044",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9044",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \u003c= 1.6.7.42 - Authenticated (Admin+) Remote Code Execution",
    "slug": "simply-schedule-appointments",
    "type": "plugin",
    "affected_version": "* - 1.6.7.42",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.7.42",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7129",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7129",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "oik \u003c= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode",
    "slug": "oik",
    "type": "plugin",
    "affected_version": "* - 4.10.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.10.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6391",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6391",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AdFoxly – Ad Manager, AdSense Ads \u0026 Ads.txt \u003c= 1.8.5 - Missing Authorization to Unauthenticated Ad Status Update",
    "slug": "adfoxly",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-34802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-34802",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Theme My Login \u003c= 7.1.7 - Cross-Site Request Forgery to Settings Update",
    "slug": "theme-my-login",
    "type": "plugin",
    "affected_version": "* - 7.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-7422",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7422",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Post Type Converter \u003c= 0.6 - Cross-Site Request Forgery",
    "slug": "post-type-converter",
    "type": "plugin",
    "affected_version": "* - 0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48303",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "TheCartPress eCommerce Shopping Cart \u003c= 1.5.3.6 - Directory Traversal",
    "slug": "thecartpress",
    "type": "plugin",
    "affected_version": "* - 1.5.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-3301",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-3301",
    "auth_type": "Privileged",
    "cvss_score": 4.9,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Popup Box \u003c= 3.2.4 - Cross-Site Request Forgery",
    "slug": "popup-box",
    "type": "plugin",
    "affected_version": "* - 3.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24711",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24711",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CRM 2go \u003c= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "crm2go",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-52350",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-52350",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "YaySMTP – Simple WP SMTP Mail \u003c= 2.2 - Missing Authorization to Sensitive Information Exposure",
    "slug": "yaysmtp",
    "type": "plugin",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2370",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2370",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Client Portal : SuiteDash Direct Login \u003c= 1.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "client-portal-suitedash-login",
    "type": "plugin",
    "affected_version": "* - 1.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-38476",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-38476",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Website Builder \u003c= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag",
    "slug": "elementor",
    "type": "plugin",
    "affected_version": "0.1.0 - 3.1.3",
    "from_version": "0.1.0",
    "from_inclusive": true,
    "to_version": "3.1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24201",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24201",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium Packages \u003c= 5.8.2 - Reflected Cross-Site Scripting",
    "slug": "wpdm-premium-packages",
    "type": "plugin",
    "affected_version": "* - 5.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.8.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29924",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29924",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Parallax Image \u003c= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "parallax-image",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47854",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47854",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Triberr \u003c= 4.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "triberr-wordpress-plugin",
    "type": "plugin",
    "affected_version": "* - 4.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46199",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46199",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel  \u003c= 2.2.74 - Information Exposure",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.74",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.74",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0881",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0881",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Popup | Custom Popup Builder \u003c= 1.3.1 - Missing Capabilities Check",
    "slug": "m-wp-popup",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-28612",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-28612",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Video Player \u003c= 1.2.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-video-player",
    "type": "plugin",
    "affected_version": "* - 1.2.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51689",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51689",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "wise-move",
    "type": "theme",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "mediaflex",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "alhambra",
    "type": "theme",
    "affected_version": "* - 1.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "booklovers",
    "type": "theme",
    "affected_version": "* - 2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "ann",
    "type": "theme",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "oldstory-whisky-bar",
    "type": "theme",
    "affected_version": "* - 2.15.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.15.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "playhockey",
    "type": "theme",
    "affected_version": "* - 1.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "birdily",
    "type": "theme",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "prorange",
    "type": "theme",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "childy",
    "type": "theme",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "def",
    "type": "theme",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "podium",
    "type": "theme",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "anesta",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "belicia",
    "type": "theme",
    "affected_version": "* - 1.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "chakra",
    "type": "theme",
    "affected_version": "* - 1.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "corredo",
    "type": "theme",
    "affected_version": "* - 1.1.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "beyoga",
    "type": "theme",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "hogwords",
    "type": "theme",
    "affected_version": "* - 1.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "clothing69",
    "type": "theme",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "alanzo",
    "type": "theme",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "pathwell",
    "type": "theme",
    "affected_version": "* - 1.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "hampton",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "carlax",
    "type": "theme",
    "affected_version": "* - 1.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "hotlock",
    "type": "theme",
    "affected_version": "* - 1.3.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "elementra",
    "type": "theme",
    "affected_version": "* - 1.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "softic",
    "type": "theme",
    "affected_version": "* - 1.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "juno",
    "type": "theme",
    "affected_version": "* - 2.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.19",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "solio",
    "type": "theme",
    "affected_version": "* - 1.7.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "heaven11",
    "type": "theme",
    "affected_version": "* - 1.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "gravity",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "agora",
    "type": "theme",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "insurance-ancora",
    "type": "theme",
    "affected_version": "* - 2.10.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "chrimson",
    "type": "theme",
    "affected_version": "* - 2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "hello-summer",
    "type": "theme",
    "affected_version": "* - 1.1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "gutentype",
    "type": "theme",
    "affected_version": "* - 2.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "chainpress",
    "type": "theme",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "albertino",
    "type": "theme",
    "affected_version": "* - 2.17.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "planet-shakers",
    "type": "theme",
    "affected_version": "* - 1.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "samadhi",
    "type": "theme",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "callie-britt",
    "type": "theme",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "vagabonds",
    "type": "theme",
    "affected_version": "* - 1.3.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "plastica",
    "type": "theme",
    "affected_version": "* - 1.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "credit-card",
    "type": "theme",
    "affected_version": "* - 1.2.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "laundrycity",
    "type": "theme",
    "affected_version": "* - 1.2.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "smart-casa",
    "type": "theme",
    "affected_version": "* - 1.0.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "tax-help",
    "type": "theme",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "chardonnay",
    "type": "theme",
    "affected_version": "* - 1.19.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "angela",
    "type": "theme",
    "affected_version": "* - 1.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "advice",
    "type": "theme",
    "affected_version": "* - 1.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.13.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "anubia",
    "type": "theme",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "abogado",
    "type": "theme",
    "affected_version": "* - 1.14.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.14.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "artesia",
    "type": "theme",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "edema",
    "type": "theme",
    "affected_version": "* - 1.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "accalia",
    "type": "theme",
    "affected_version": "* - 1.5.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "healthy-blog",
    "type": "theme",
    "affected_version": "* - 1.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "custom-made",
    "type": "theme",
    "affected_version": "* - 1.1.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.17",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "partiso",
    "type": "theme",
    "affected_version": "* - 1.1.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "camelia",
    "type": "theme",
    "affected_version": "* - 1.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "stratego",
    "type": "theme",
    "affected_version": "* - 1.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "alisha-williams",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "stevenwatkins",
    "type": "theme",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "inset",
    "type": "theme",
    "affected_version": "* - 1.18.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.18.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "crework",
    "type": "theme",
    "affected_version": "* - 1.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "wine-house",
    "type": "theme",
    "affected_version": "* - 3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "happy-rider",
    "type": "theme",
    "affected_version": "* - 2.12.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.12.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "kargo",
    "type": "theme",
    "affected_version": "* - 1.1.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "drone-media",
    "type": "theme",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "adrena",
    "type": "theme",
    "affected_version": "* - 1.2.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.13",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "carz",
    "type": "theme",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "alpha-color",
    "type": "theme",
    "affected_version": "* - 1.4.11.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.11.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "qwery",
    "type": "theme",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "wotahub",
    "type": "theme",
    "affected_version": "* - 1.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "soccerclub",
    "type": "theme",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "asclepius",
    "type": "theme",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "fortunio",
    "type": "theme",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "good-wine",
    "type": "theme",
    "affected_version": "* - 1.1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "lab",
    "type": "theme",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "nazareth",
    "type": "theme",
    "affected_version": "* - 1.0.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "city-hostel",
    "type": "theme",
    "affected_version": "* - 1.2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "travesia",
    "type": "theme",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "proguards",
    "type": "theme",
    "affected_version": "* - 2.13.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.13.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "studeon",
    "type": "theme",
    "affected_version": "* - 1.1.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.15",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "bonko",
    "type": "theme",
    "affected_version": "* - 1.0.14",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.14",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "tantra",
    "type": "theme",
    "affected_version": "* - 2.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "preston",
    "type": "theme",
    "affected_version": "* - 1.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "translang",
    "type": "theme",
    "affected_version": "* - 1.1.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.16",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes \u003c= 1.18.0 - Unauthenticated Local File Inclusion",
    "slug": "prodent",
    "type": "theme",
    "affected_version": "* - 1.5.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-26592",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26592",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Webcraftic Clearfy – WordPress optimization plugin \u003c= 2.3.1 - Cross-Site Request Forgery to Clear Cache",
    "slug": "clearfy",
    "type": "plugin",
    "affected_version": "* - 2.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13338",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13338",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Photo Album Plus \u003c= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay",
    "slug": "wp-photo-album-plus",
    "type": "plugin",
    "affected_version": "* - 8.8.08.007",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "8.8.08.007",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10958",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10958",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "HK Exif Tags \u003c= 1.11 - Cross-Site Scripting",
    "slug": "hk-exif-tags",
    "type": "plugin",
    "affected_version": "* - 1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-100007",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-100007",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Gallery Lightbox \u003c= 1.0.0.39 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "gallery-lightbox-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.0.39",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0.39",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47623",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47623",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Premium WordPress Form Builder \u003c= 3.2.31 - Authenticated Stored Cross-Site Scripting",
    "slug": "formcraft3",
    "type": "plugin",
    "affected_version": "[*, 3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-18600",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-18600",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Theme Demo Bar \u003c= 1.6.3 - Reflected Cross-Site Scripting",
    "slug": "wordpress-theme-demo-bar",
    "type": "plugin",
    "affected_version": "* - 1.6.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25134",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25134",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Piotnet Addons For Elementor \u003c= 2.4.25 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "piotnet-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.25",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.25",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29934",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29934",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced iFrame \u003c= 2024.5 - Unauthenticated Settings Update",
    "slug": "advanced-iframe",
    "type": "plugin",
    "affected_version": "* - 2024.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2024.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-1440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-1440",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Stop Spammers Security \u003c= 2021.17 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "stop-spammer-registrations-plugin",
    "type": "plugin",
    "affected_version": "[*, 2021.18)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2021.18",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24517",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24517",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Arrival \u003c= 1.4.5 - Unauthenticated Local File Inclusion",
    "slug": "arrival",
    "type": "theme",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32921",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32921",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "InPost Gallery \u003c= 2.1.4.5 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "inpost-gallery",
    "type": "plugin",
    "affected_version": "* - 2.1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.4.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-57889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-57889",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Image Resizer On The Fly \u003c= 1.1 - Unauthenticated Arbitrary File Deletion",
    "slug": "image-resizer-on-the-fly",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-6065",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6065",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Clever Addons for Elementor \u003c= 2.2.0 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "cafe-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43324",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43324",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "TablePress \u003c= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_debug Parameter",
    "slug": "tablepress",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9500",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9500",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Google Map Shortcode \u003c= 3.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "google-map-shortcode",
    "type": "plugin",
    "affected_version": "* - 3.1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2899",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2899",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce TBC Credit Card Payment Gateway (Free) \u003c= 2.0.0 - Reflected Cross-Site Scripting",
    "slug": "woo-tbc-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32611",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.2 - Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.2 - 4.2.1",
    "from_version": "4.2",
    "from_inclusive": true,
    "to_version": "4.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-8834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-8834",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.2 - Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2015-8834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-8834",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.2 - Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.7",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-8834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-8834",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.2 - Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.7",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-8834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-8834",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.2 - Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.5",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-8834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-8834",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.2 - Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0 - 4.0.4",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-8834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-8834",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.2.2 - Cross-Site Scripting via Comments",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.1 - 4.1.4",
    "from_version": "4.1",
    "from_inclusive": true,
    "to_version": "4.1.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-8834",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-8834",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RealtyElite \u003c= 1.0.0 - Unauthenticated Local File Inclusion",
    "slug": "realtyelite",
    "type": "theme",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-52808",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52808",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Lockets \u003c= 0.999 - Reflected Cross-Site Scripting",
    "slug": "lockets",
    "type": "plugin",
    "affected_version": "* - 0.999",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.999",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23923",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23923",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid and Gutenberg Blocks \u003c= 2.2.89 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "* - 2.2.89",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.89",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-47340",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-47340",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login As Users \u003c= 1.4.3 - Missing Authorization to Privielge Escalation via Account Takeover",
    "slug": "login-as-users",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43982",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43982",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PowerPack Lite for Beaver Builder \u003c= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via element link",
    "slug": "powerpack-addon-for-beaver-builder",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2289",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2289",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "LiteSpeed Cache \u003c= 6.3.0.1 - Unauthenticated Privilege Escalation",
    "slug": "litespeed-cache",
    "type": "plugin",
    "affected_version": "* - 6.3.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-28000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-28000",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "GoCodes \u003c= 1.3.5 - Cross-Site Scripting",
    "slug": "gocodes",
    "type": "plugin",
    "affected_version": "* - 1.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2015-9397",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9397",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Manage Notification E-mails \u003c= 1.8.2 - Cross-Site Request Forgery to Plugin Options Update",
    "slug": "manage-notification-emails",
    "type": "plugin",
    "affected_version": "* - 1.8.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-34654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-34654",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Dewplayer \u003c 1.3 - Directory Traversal",
    "slug": "advanced-dewplayer",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2013-7240",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2013-7240",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Awesome Progress Bar \u003c= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "awesome-progess-bar",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-50548",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-50548",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rate Own Post \u003c= 1.0 - Authenticated (Subscriber+) SQL Injection",
    "slug": "rate-own-post",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-49616",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49616",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "SMTP Mail Plugin \u003c= 1.3.20 - Cross Site Request Forgery",
    "slug": "smtp-mail",
    "type": "plugin",
    "affected_version": "* - 1.3.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25914",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25914",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Exclusive Addons Elementor \u003c= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30177",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30177",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Elementor Addon Elements \u003c= 1.12.12 - Directory Traversal to Local File Inclusion",
    "slug": "addon-elements-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 1.12.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1358",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Login And Signup Widget \u003c= 1.0 - Authenticated (Administrator+) Remote Code Execution",
    "slug": "custom-login-and-signup-widget",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49029",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49029",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Core \u003c= 1.5 - Stored Cross-Site Scripting",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2005-1102",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2005-1102",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paypal Donation \u003c= 1.3.1 - Admin+ Stored Cross-Site Scripting",
    "slug": "easy-paypal-donation",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24815",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24815",
    "auth_type": "Privileged",
    "cvss_score": 4.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Carousel \u0026 Slider \u003c= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "post-types-carousel-slider",
    "type": "plugin",
    "affected_version": "* - 1.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11770",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11770",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MaxButtons \u003c= 9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "* - 9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-38703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-38703",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Enquiry for WooCommerce \u003c= 3.0 - Cross-Site Request Forgery",
    "slug": "gm-woocommerce-quote-popup",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49761",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49761",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Salon booking system \u003c 6.3.1 - Stored Cross-Site Scripting",
    "slug": "salon-booking-system",
    "type": "plugin",
    "affected_version": "[*, 6.3.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24429",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24429",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Korea for WooCommerce \u003c= 1.1.11 - Authenticated (Subscriber+) Sensitive Information Exposure",
    "slug": "korea-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.1.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-24639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24639",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "ExportFeed \u003c= 2.0.1.0 - SQL Injection",
    "slug": "exportfeed-list-woocommerce-products-on-ebay-store",
    "type": "plugin",
    "affected_version": "* - 2.0.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4208",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4208",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Uptime Robot Plugin for WordPress \u003c= 2.3 - Cross-Site Request Forgery",
    "slug": "uptime-robot-monitor",
    "type": "plugin",
    "affected_version": "* - 2.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31776",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.31 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.31",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.31",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10680",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "QR Code Tag for WC order emails \u003c= 1.9.36 - Cross-Site Request Forgery",
    "slug": "qr-code-tag-for-wc-from-goaskle-com",
    "type": "plugin",
    "affected_version": "* - 1.9.36",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.36",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32268",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32268",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "iPhone Webclip Manager \u003c= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "iphone-webclip-manager",
    "type": "plugin",
    "affected_version": "* - 0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-53735",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-53735",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Feather Login Page 1.0.7 - 1.1.1 - Missing Authorization to Authentication Bypass and Privilege Escalation",
    "slug": "feather-login-page",
    "type": "plugin",
    "affected_version": "1.0.7 - 1.1.1",
    "from_version": "1.0.7",
    "from_inclusive": true,
    "to_version": "1.1.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-2545",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2545",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
  },
  {
    "title": "BookPress – For Book Authors \u003c= 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "book-press",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-25168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-25168",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Hostel \u003c= 1.1.5.7 - Reflected Cross-Site Scripting",
    "slug": "hostel",
    "type": "plugin",
    "affected_version": "* - 1.1.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6234",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6234",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Omnify \u003c= 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "omnify-widget",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28882",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28882",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Product Vendors \u003c= 2.0.35 - Reflected Cross Site Scripting",
    "slug": "woocommerce-product-vendors",
    "type": "plugin",
    "affected_version": "[*, 2.0.36)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.36",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2017-20193",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-20193",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Esotera \u003c= 1.2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "esotera",
    "type": "theme",
    "affected_version": "* - 1.2.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43952",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43952",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post Grid \u003c= 2.1.15 - Cross-Site Scripting",
    "slug": "post-grid",
    "type": "plugin",
    "affected_version": "[*, 2.1.16)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.16",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24986",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP SuperBackup \u003c= 2.3.3 - Reflected Cross-Site Scripting",
    "slug": "indeed-wp-superbackup",
    "type": "plugin",
    "affected_version": "* - 2.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56069",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56069",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Wishlist \u003c= 1.0.44 - Authenticated (Subscriber+) SQL Injection",
    "slug": "wishlist",
    "type": "plugin",
    "affected_version": "* - 1.0.44",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.44",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32618",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32618",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "WooCommerce JazzCash Gateway Plugin \u003c= 2.0 - Unauthenticated Cross-Site Scripting",
    "slug": "jazzcash-woocommerce-gateway",
    "type": "plugin",
    "affected_version": "* - 2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-46822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-46822",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WPKoi Templates for Elementor \u003c= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget",
    "slug": "wpkoi-templates-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2136",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2136",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PPOM for WooCommerce \u003c= 32.0.20 - Unauthenticated Content Injection Vulnerability",
    "slug": "woocommerce-product-addon",
    "type": "plugin",
    "affected_version": "* - 32.0.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "32.0.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-35728",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-35728",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Disable Right Click For WP \u003c= 1.1.6 - Cross-Site Request Forgery",
    "slug": "disable-right-click-for-wp",
    "type": "plugin",
    "affected_version": "* - 1.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-29427",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29427",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "InstaWP Connect \u003c= 0.1.0.82 - Unauthenticated Local File Inclusion",
    "slug": "instawp-connect",
    "type": "plugin",
    "affected_version": "* - 0.1.0.82",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1.0.82",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31387",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31387",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Oxpitan \u003c= 1.3.1 - Unauthenticated Local File Inclusion",
    "slug": "oxpitan",
    "type": "theme",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32294",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32294",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "cForms – Light speed fast Form Builder \u003c= 3.0.0 - Cross-Site Request Forgery",
    "slug": "cforms-plugin",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9898",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Alpine PhotoTile for Pinterest \u003c= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "alpine-photo-tile-for-pinterest",
    "type": "plugin",
    "affected_version": "* - 1.3.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-36347",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-36347",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "OSM - OpenStreetMap \u003c= 6.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via 'osm_map' Shortcode",
    "slug": "osm",
    "type": "plugin",
    "affected_version": "* - 6.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4676",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4676",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Page Builder Sandwich – Front End WordPress Page Builder Plugin \u003c= 5.1.0 - Sensitive Information Exposure",
    "slug": "page-builder-sandwich",
    "type": "plugin",
    "affected_version": "* - 5.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1381",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Piotnet Forms \u003c= 1.0.30 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "piotnetforms",
    "type": "plugin",
    "affected_version": "* - 1.0.30",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.30",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31792",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31792",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Grand Conference \u003c= 5.2 - Unauthenticated PHP Object Injection",
    "slug": "grandconference",
    "type": "plugin",
    "affected_version": "* - 5.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-39354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39354",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Extra Block Design, Style, CSS for ANY Gutenberg Blocks \u003c= 0.2.6 - Cross-Site Request Forgery",
    "slug": "stylist",
    "type": "plugin",
    "affected_version": "* - 0.2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-47183",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-47183",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP ERP | Complete HR solution with recruitment \u0026 job listings | WooCommerce CRM \u0026 Accounting \u003c= 1.12.9 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "erp",
    "type": "plugin",
    "affected_version": "* - 1.12.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-0609",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0609",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress WP-Advanced-Search \u003c= 3.3.9.2 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-advanced-search",
    "type": "plugin",
    "affected_version": "* - 3.3.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.3.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-10554",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10554",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \u003c= 4.3.0 - Missing Authorization to Order Export",
    "slug": "print-invoices-packing-slip-labels-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7068",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7068",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Kanban Boards for WordPress \u003c= 2.5.20 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "kanban",
    "type": "plugin",
    "affected_version": "* - 2.5.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-34368",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-34368",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Splash Header \u003c 1.20.8 - Stored Cross-Site Scripting",
    "slug": "splash-header",
    "type": "plugin",
    "affected_version": "[*, 1.20.8)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.20.8",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24587",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24587",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Library Management System \u003c= 3.0.0 - Authenticated (Admin+) SQL Injection",
    "slug": "library-management-system",
    "type": "plugin",
    "affected_version": "* - 3.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8679",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8679",
    "auth_type": "Privileged",
    "cvss_score": 6.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer \u003c= 1.1.0 - Missing Authorization",
    "slug": "promolayer-popup-builder",
    "type": "plugin",
    "affected_version": "* - 1.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3602",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress Button Plugin MaxButtons \u003c= 9.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Color",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "* - 9.8.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.8.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8968",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Updraft \u003c= 0.6.1 - Reflected Cross-Site Scripting via 'backup_timestamp'",
    "slug": "updraft",
    "type": "plugin",
    "affected_version": "* - 0.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-26530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-26530",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Permalink Manager Lite \u003c= 2.2.20.1 - Cross-Site Request Forgery",
    "slug": "permalink-manager",
    "type": "plugin",
    "affected_version": "* - 2.2.20.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.20.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-4021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4021",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Oi Yandex.Maps for WordPress \u003c= 3.2.7 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode",
    "slug": "oi-yamaps",
    "type": "plugin",
    "affected_version": "* - 3.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-22721",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-22721",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Speed Optimizer  \u003c= 7.4.6 - Missing Authorization via purge_on_other_events()",
    "slug": "sg-cachepress",
    "type": "plugin",
    "affected_version": "* - 7.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32532",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Recall – Registration, Profile, Commerce \u0026 More  \u003c= 16.26.5 - Insecure Direct Object Reference",
    "slug": "wp-recall",
    "type": "plugin",
    "affected_version": "* - 16.26.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "16.26.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32604",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32604",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Biteship \u003c= 2.2.27 - Authenticated (Shop manager+) Stored Cross-Site Scripting",
    "slug": "biteship",
    "type": "plugin",
    "affected_version": "* - 2.2.27",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.27",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49767",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49767",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple LDAP Login \u003c= 1.6.0 - Reflected Cross-Site Scripting",
    "slug": "simple-ldap-login",
    "type": "plugin",
    "affected_version": "* - 1.6.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-8715",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8715",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Appmaker – Convert WooCommerce to Android \u0026 iOS Native Mobile Apps \u003c= 1.36.12 - Reflected Cross-Site Scripting",
    "slug": "appmaker-woocommerce-mobile-app-manager",
    "type": "plugin",
    "affected_version": "* - 1.36.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.36.12",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-38680",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-38680",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "BlogMarks \u003c= 1.0.8 - Unauthenticated Local File Inclusion",
    "slug": "blogmarks",
    "type": "theme",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53247",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53247",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "EO4WP \u003c= 1.0.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "fw-integration-for-emailoctopus",
    "type": "plugin",
    "affected_version": "* - 1.0.8.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22327",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Profitshare \u003c= 1.4.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "wp-profitshare",
    "type": "plugin",
    "affected_version": "* - 1.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31906",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31906",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.9 - 3.9.2",
    "from_version": "3.9",
    "from_inclusive": true,
    "to_version": "3.9.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9038",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "4.0",
    "from_version": "4.0",
    "from_inclusive": true,
    "to_version": "4.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9038",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "[*, 3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.7",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2014-9038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9038",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.7 - 3.7.4",
    "from_version": "3.7",
    "from_inclusive": true,
    "to_version": "3.7.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9038",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WordPress Core \u003c 4.0.1 - Server-Side Request Forgery",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "3.8 - 3.8.4",
    "from_version": "3.8",
    "from_inclusive": true,
    "to_version": "3.8.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2014-9038",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9038",
    "auth_type": "Auth",
    "cvss_score": 7.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  },
  {
    "title": "WP Editor \u003c= 1.2.7 - Sensitive Information Exposure via log file",
    "slug": "wp-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-25591",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-25591",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP Compiler \u003c= 1.0.0 - Cross-Site Request Forgery",
    "slug": "wp-compiler",
    "type": "plugin",
    "affected_version": "* - 1.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58032",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking Ultra Pro \u003c= 1.1.20 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "booking-ultra-pro",
    "type": "plugin",
    "affected_version": "* - 1.1.20",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.20",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30637",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress Core \u003c= 5.0.3 - Path Traversal and Local File Inclusion",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "* - 5.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2019-8943",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-8943",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Reusable Blocks Extended \u003c= 0.9 - Cross-Site Request Forgery via reblex_reusable_screen_block_pattern_registration",
    "slug": "reusable-blocks-extended",
    "type": "plugin",
    "affected_version": "* - 0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-27611",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27611",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  },
  {
    "title": "USPS Shipping for WooCommerce – Live Rates \u003c= 1.9.4 - Sensitive Information Exposure",
    "slug": "flexible-shipping-usps",
    "type": "plugin",
    "affected_version": "* - 1.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32811",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32811",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Advanced AJAX Page Loader \u003c= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload",
    "slug": "advanced-ajax-page-loader",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-6310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6310",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Add User \u003c= 2.0.2 - Reflected Cross-Site Scripting",
    "slug": "custom-add-user",
    "type": "plugin",
    "affected_version": "* - 2.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0043",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0043",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Ultimate Addons for Contact Form 7 \u003c= 3.1.28 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "ultimate-addons-for-contact-form-7",
    "type": "plugin",
    "affected_version": "[*, 3.1.29)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.29",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-2802",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2802",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Comment Engine Pro \u003c= 1.0 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "comment-engine-pro",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36911",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36911",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Crontrol \u003c= 1.16.1 - Remote Code Execution",
    "slug": "wp-crontrol",
    "type": "plugin",
    "affected_version": "* - 1.16.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.16.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-28850",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-28850",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Giveaways and Contests by RafflePress \u003c= 1.12.5 - Unauthenticated Stored Cross-Site Scripting",
    "slug": "rafflepress",
    "type": "plugin",
    "affected_version": "* - 1.12.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.12.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-1935",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1935",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "IgniteUp – Coming Soon and Maintenance Mode \u003c= 3.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "igniteup",
    "type": "plugin",
    "affected_version": "* - 3.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-0898",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0898",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-ab-page-testing",
    "type": "plugin",
    "affected_version": "[*, 1.4.13.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.13.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-dashboard",
    "type": "plugin",
    "affected_version": "[*, 2.3.9.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-leads",
    "type": "plugin",
    "affected_version": "[*, 2.3.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-clever-widgets",
    "type": "plugin",
    "affected_version": "[*, 1.57.1)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.57.1",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-theme",
    "type": "theme",
    "affected_version": "[*, 2.2.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-ultimatum",
    "type": "plugin",
    "affected_version": "[*, 2.3.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "ignition",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "storied",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-apprentice",
    "type": "plugin",
    "affected_version": "[*, 2.3.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "luxe",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-comments",
    "type": "plugin",
    "affected_version": "[*, 1.4.15.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.15.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "voice",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-visual-editor",
    "type": "plugin",
    "affected_version": "[*, 2.6.7.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.7.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-ovation",
    "type": "plugin",
    "affected_version": "[*, 2.4.5)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.5",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "squared",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "performag",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "minus",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-quiz-builder",
    "type": "plugin",
    "affected_version": "[*, 2.3.9.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.9.4",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "pressive",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "rise",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "focusblog",
    "type": "theme",
    "affected_version": "[*, 2.0.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update",
    "slug": "thrive-headline-optimizer",
    "type": "plugin",
    "affected_version": "[*, 1.3.7.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2021-24219",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24219",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form 7 Star Rating \u003c= 1.10 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "contact-form-7-star-rating",
    "type": "plugin",
    "affected_version": "* - 1.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-27303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27303",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Awesome Support – WordPress HelpDesk \u0026 Support Plugin \u003c=  3.1.6 - Arbitrary Shortcode Execution",
    "slug": "awesome-support",
    "type": "plugin",
    "affected_version": "[*, 3.1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.7",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-9318",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-9318",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Blog, Posts and Category Filter for Elementor \u003c= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "blog-posts-and-category-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22648",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22648",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Icon Widget \u003c= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "icon-widget",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1993",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1993",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Royal Elementor Addons and Templates \u003c= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.7.1001",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1001",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9682",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "FV Descriptions \u003c= 1.4 - Reflected Cross-Site Scripting",
    "slug": "fv-descriptions",
    "type": "plugin",
    "affected_version": "* - 1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56032",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "XCloner \u003c= 4.7.3 - Unauthenticated Full Path Disclosure",
    "slug": "xcloner-backup-and-restore",
    "type": "plugin",
    "affected_version": "* - 4.7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6559",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6559",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Winnex \u003c= 1.3.2 - Unauthenticated Local File Inclusion",
    "slug": "winnex",
    "type": "theme",
    "affected_version": "* - 1.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-32302",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32302",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Custom Searchable Data Entry System \u003c= 1.7.1 - Unauthenticated Database Wiping",
    "slug": "custom-searchable-data-entry-system",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2020-36852",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-36852",
    "auth_type": "Unauth",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "WordPress Core 1.5 - 2.3.1 - Authorization Bypass",
    "slug": "wordpress",
    "type": "core",
    "affected_version": "1.5 - 2.3.1",
    "from_version": "1.5",
    "from_inclusive": true,
    "to_version": "2.3.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2007-6013",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2007-6013",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Music Press Pro \u003c= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "music-press-pro",
    "type": "plugin",
    "affected_version": "* - 1.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22653",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22653",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Snow Monkey Forms \u003c= 5.1.1 - Directory Traversal via 'view' REST endpiont",
    "slug": "snow-monkey-forms",
    "type": "plugin",
    "affected_version": "* - 5.1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-28413",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-28413",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RapidLoad Power-Up for Autoptimize \u003c= 1.7.1 - Missing Authorization in 'ajax_deactivate'",
    "slug": "unusedcss",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1336",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1336",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CF7 Google Sheets Connector \u003c= 5.0.9 - Missing Authorization to Limited Site Configuration Update",
    "slug": "cf7-google-sheets-connector",
    "type": "plugin",
    "affected_version": "* - 5.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.0.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5654",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5654",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Oxygen Builder \u003c= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field",
    "slug": "oxygenbuilder",
    "type": "plugin",
    "affected_version": "* - 4.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-6938",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-6938",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Zero Spam \u003c= 5.2.10 - Admin+ SQL Injection",
    "slug": "zero-spam",
    "type": "plugin",
    "affected_version": "* - 5.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.2.10",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-0254",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-0254",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hide Shipping Method For WooCommerce \u003c= 1.5.1 - Missing Authorization",
    "slug": "hide-shipping-method-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22694",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Void Elementor Post Grid Addon for Elementor Page builder \u003c= 2.1.10 - Missing Authorization to Review Notice Dismissal",
    "slug": "void-elementor-post-grid-addon-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "[*, 2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-48750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48750",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Image News Slider \u003c= 3.2 - Unspecified Vulnerability",
    "slug": "wp-image-news-slider",
    "type": "plugin",
    "affected_version": "* - 3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2012-4327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2012-4327",
    "auth_type": "Unauth",
    "cvss_score": 7.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Mhr Post Ticker \u003c= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "mhr-post-ticker",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3021",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3021",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging \u003c= 4.23.8 - Reflected Cross-Site Scripting",
    "slug": "wp-rss-aggregator",
    "type": "plugin",
    "affected_version": "* - 4.23.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.23.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4860",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Poll, Survey \u0026 Quiz Maker Plugin by Opinion Stage \u003c= 19.11.0 - Unauthenticated Local File Inclusion",
    "slug": "social-polls-by-opinionstage",
    "type": "plugin",
    "affected_version": "* - 19.11.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.11.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-53328",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53328",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP-Lister Lite for eBay \u003c= 3.5.11 - Authenticated (Shop Manager+) Arbitrary File Upload",
    "slug": "wp-lister-for-ebay",
    "type": "plugin",
    "affected_version": "* - 3.5.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.11",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-32836",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32836",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery PhotoBlocks \u003c= 1.1.42 - Reflected Cross-Site Scripting",
    "slug": "photoblocks-grid-gallery",
    "type": "plugin",
    "affected_version": "[*, 1.1.43)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.43",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2019-15829",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-15829",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Countdown \u0026 Clock \u003c= 2.3.2 - Pro Features Lock Bypass",
    "slug": "countdown-builder",
    "type": "plugin",
    "affected_version": "* - 2.3.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2022-29423",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-29423",
    "auth_type": "Privileged",
    "cvss_score": 3.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Post/Page Copying Tool \u003c= 2.0.0 - Unauthenticated Sensitive Information Exposure",
    "slug": "postpage-import-export-with-custom-fields-taxonomies",
    "type": "plugin",
    "affected_version": "* - 2.0.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-56300",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-56300",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Contest Gallery \u003c= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover",
    "slug": "contest-gallery",
    "type": "plugin",
    "affected_version": "* - 24.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "24.0.7",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-11103",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11103",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ProfileGrid \u003c= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update",
    "slug": "profilegrid-user-profiles-groups-and-communities",
    "type": "plugin",
    "affected_version": "* - 5.5.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-3713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-3713",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gallery Images Ape \u003c= 2.2.8 - Missing Authorization",
    "slug": "gallery-images-ape",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41995",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41995",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form \u0026 SMTP Plugin by PirateForms \u003c= 2.5.1 - Unauthenticated HTML injection",
    "slug": "pirate-forms",
    "type": "plugin",
    "affected_version": "[*, 2.5.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2019-25145",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2019-25145",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Alphabetic Pagination \u003c= 3.2.1 - Reflected Cross-Site Scripting",
    "slug": "alphabetic-pagination",
    "type": "plugin",
    "affected_version": "* - 3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-26751",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-26751",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Classic Addons – WPBakery Page Builder \u003c= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "classic-addons-wpbakery-page-builder-addons",
    "type": "plugin",
    "affected_version": "* - 3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-43953",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43953",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Job Board \u003c= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure",
    "slug": "simple-job-board",
    "type": "plugin",
    "affected_version": "* - 2.10.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0593",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0593",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Slider, Gallery, and Carousel by MetaSlider \u003c= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter",
    "slug": "ml-slider",
    "type": "plugin",
    "affected_version": "* - 3.98.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.98.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-5337",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-5337",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Most Popular Posts Widget \u003c= 0.8 - Authenticated (Admin+) SQL Injection",
    "slug": "most-popular-posts-widget-lite",
    "type": "plugin",
    "affected_version": "* - 0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2015-10124",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10124",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Copymatic – AI Content Writer \u0026 Generator \u003c= 2.1 - Cross-Site Request Forgery to Settings Update",
    "slug": "copymatic",
    "type": "plugin",
    "affected_version": "* - 2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-6781",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-6781",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WAH Forms \u003c= 1.0 - Missing Authorization",
    "slug": "wah-forms",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23763",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23763",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WANotifier \u003c= 2.7.7 - Missing Authorization",
    "slug": "notifier",
    "type": "plugin",
    "affected_version": "* - 2.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49976",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49976",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Contact Form to Any API \u003c= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Contact Form",
    "slug": "contact-form-to-any-api",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-7617",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-7617",
    "auth_type": "Unauth",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Digital Lottery \u003c= 3.0.5 - Unauthenticated Arbitrary File Upload",
    "slug": "digital-lottery",
    "type": "plugin",
    "affected_version": "* - 3.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49242",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Table Editor \u003c= 1.6.4 - Cross-Site Request Forgery",
    "slug": "wp-table-editor",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-48310",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-48310",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP-Polls \u003c= 2.76.0 - Race Condition",
    "slug": "wp-polls",
    "type": "plugin",
    "affected_version": "* - 2.76.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.76.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40130",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40130",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Woffice \u003c= 5.4.10 - Unauthenticated Privilege Escalation",
    "slug": "woffice",
    "type": "theme",
    "affected_version": "* - 5.4.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.10",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-43153",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43153",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Easy Property Listings \u003c 3.4 - Cross-Site Request Forgery",
    "slug": "easy-property-listings",
    "type": "plugin",
    "affected_version": "[*, 3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2020-5530",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-5530",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Creative Blocks \u003c= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "creative-blocks",
    "type": "plugin",
    "affected_version": "* - 1.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51822",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51822",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Maker \u003c= 1.15.20 - Captcha Bypass",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "[*, 1.15.21)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.21",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2023-48290",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48290",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Dynamic URL SEO \u003c= 1.0 - Reflected Cross-Site Scripting",
    "slug": "dynamic-url-seo",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23984",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23984",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Advanced Dynamic Pricing for WooCommerce \u003c= 4.1.5 - Cross-Site Request Forgery via migrateProductOnlyToCommon function",
    "slug": "advanced-dynamic-pricing-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 4.1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-40203",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40203",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Integration for Contact Form 7 and Constant Contact \u003c= 1.1.4 - Open Redirect",
    "slug": "cf7-constant-contact",
    "type": "plugin",
    "affected_version": "* - 1.1.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-47779",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47779",
    "auth_type": "Unauth",
    "cvss_score": 4.7,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
  },
  {
    "title": "Sydney \u003c= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update",
    "slug": "sydney",
    "type": "theme",
    "affected_version": "* - 2.56",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.56",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-8999",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8999",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "RSVP Events \u003c= 2.9.4 - Reflected Cross-Site Scripting",
    "slug": "eventon-rsvp",
    "type": "plugin",
    "affected_version": "* - 2.9.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-7170",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7170",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shopper Approved Reviews 2.0 - 2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update",
    "slug": "shopperapproved-reviews",
    "type": "plugin",
    "affected_version": "2.0 - 2.1",
    "from_version": "2.0",
    "from_inclusive": true,
    "to_version": "2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3063",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3063",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WooCommerce Stripe Payment Gateway \u003c= 7.6.1 - Insecure Direct Object Reference via update_payment_intent_ajax",
    "slug": "woocommerce-gateway-stripe",
    "type": "plugin",
    "affected_version": "* - 7.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-51502",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-51502",
    "auth_type": "Unauth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "MasterStudy LMS \u003c= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "masterstudy-lms-learning-management-system",
    "type": "plugin",
    "affected_version": "* - 3.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-35090",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-35090",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Breaking News WP \u003c= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "breaking-news-wp",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31750",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31750",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Waiting: One-click countdowns \u003c= 0.6.2 - Cross-Site Request Forgery",
    "slug": "waiting",
    "type": "plugin",
    "affected_version": "* - 0.6.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.6.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4000",
    "auth_type": "Unauth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Jetpack Feedback Exporter \u003c= 1.23 - Unauthenticated Sensitive Information Exposure",
    "slug": "jetpack-feedback-exporter",
    "type": "plugin",
    "affected_version": "* - 1.23",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.23",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32251",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32251",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4697",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4697",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "MAS Companies For WP Job Manager \u003c= 1.0.13 - Reflected Cross-Site Scripting",
    "slug": "mas-wp-job-manager-company",
    "type": "plugin",
    "affected_version": "* - 1.0.13",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.13",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9206",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9206",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Login with phone number \u003c= 1.5.6 - Cross-Site Request Forgery to User Password Change",
    "slug": "login-with-phone-number",
    "type": "plugin",
    "affected_version": "* - 1.5.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-4916",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4916",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Kingkong Board \u003c= 2.1.0.2 - Missing Authorization",
    "slug": "kingkong-board",
    "type": "plugin",
    "affected_version": "* - 2.1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-36694",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-36694",
    "auth_type": "Auth",
    "cvss_score": 6.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
  },
  {
    "title": "Woo Products Widgets For Elementor \u003c= 2.0.4 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "woo-products-widgets-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-43271",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-43271",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Post Gallery - UPG \u003c= 2.19 - Missing Authorization to Remote Command Execution",
    "slug": "wp-upg",
    "type": "plugin",
    "affected_version": "2.19",
    "from_version": "2.19",
    "from_inclusive": true,
    "to_version": "2.19",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2022-4060",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4060",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Complianz Free \u003c= 6.3.3 \u0026 Premium \u003c= 6.3.5  - SQL Injection via Translations",
    "slug": "complianz-gdpr-premium",
    "type": "plugin",
    "affected_version": "* - 6.3.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3494",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Complianz Free \u003c= 6.3.3 \u0026 Premium \u003c= 6.3.5  - SQL Injection via Translations",
    "slug": "complianz-gdpr",
    "type": "plugin",
    "affected_version": "* - 6.3.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.3.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-3494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-3494",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PCRecruiter Extensions \u003c= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "pcrecruiter-extensions",
    "type": "plugin",
    "affected_version": "* - 1.4.22",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.22",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11776",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11776",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Web Accessibility By accessiBe \u003c= 2.10 - Cross-Site Request Forgery",
    "slug": "accessibe",
    "type": "plugin",
    "affected_version": "* - 2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-10375",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-10375",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "PayGreen Payment Gateway \u003c= 1.0.26 - Reflected Cross-Site Scripting",
    "slug": "paygreen-payment-gateway",
    "type": "plugin",
    "affected_version": "* - 1.0.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11810",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11810",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Custom CSS, JS \u0026 PHP \u003c= 2.4.1 - Cross-Site Request Forgery to Remote Code Exectuiron",
    "slug": "custom-css",
    "type": "plugin",
    "affected_version": "* - 2.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39601",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39601",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Responsive Image Gallery, Gallery Album \u003c= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "gallery-album",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31120",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31120",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Real Estate Manager – Property Listing and Agent Management \u003c= 7.3 - CAPTCHA Bypass",
    "slug": "real-estate-manager",
    "type": "plugin",
    "affected_version": "* - 7.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22645",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22645",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WordPress All In One Login Plugin \u003c= 2.0.8 - IP Sooofing to Protection Mechanism Bypass",
    "slug": "change-wp-admin-login",
    "type": "plugin",
    "affected_version": "2.0.8",
    "from_version": "2.0.8",
    "from_inclusive": true,
    "to_version": "2.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-58595",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-58595",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Jigoshop Swipe plugin \u003c= 3.1.0 - Cross-Site Scripting",
    "slug": "swipe-hq-checkout-for-jigoshop",
    "type": "plugin",
    "affected_version": "* - 3.1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4557",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4557",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile \u0026 Restrict Content – ProfilePress \u003c= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.15.19",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.15.19",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13119",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13119",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "uListing \u003c= 1.6.6 - Unauthenticated Options Changes via wp_route",
    "slug": "ulisting",
    "type": "plugin",
    "affected_version": "[*, 1.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2021-4381",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4381",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "PDF Builder for WooCommerce. Create invoices,packing slips and more \u003c= 1.2.136 - Reflected Cross-Site Scripting",
    "slug": "woo-pdf-invoice-builder",
    "type": "plugin",
    "affected_version": "* - 1.2.136",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.136",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11276",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11276",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "HLS Player \u003c= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "hls-player",
    "type": "plugin",
    "affected_version": "* - 1.0.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11333",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11333",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Maintenance Mode \u0026 Coming Soon \u003c= 2.4.4 - Cross-Site Request Forgery",
    "slug": "wp-maintenance-mode",
    "type": "plugin",
    "affected_version": "* - 2.4.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-1576",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-1576",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "User Registration \u003c= 2.3.2.1 - PHP Object Injection",
    "slug": "user-registration",
    "type": "plugin",
    "affected_version": "* - 2.3.2.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.2.1",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-27459",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-27459",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Print PDF Generator and Publisher \u003c= 1.2.0 - Cross-Site Request Forgery",
    "slug": "nopeamedia",
    "type": "plugin",
    "affected_version": "* - 1.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-22637",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-22637",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Booking and Rental Manager \u003c= 2.2.8 - Authenticated (Contributor+) Local File Inclusion",
    "slug": "booking-and-rental-manager-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 2.2.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.8",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-27011",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-27011",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "leenk.me \u003c= 2.5.0 - Cross-Site Request Forgery",
    "slug": "leenkme",
    "type": "plugin",
    "affected_version": "* - 2.5.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.5.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2016-10989",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2016-10989",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Thrive Theme Builder \u003c 3.24.0 - Missing Authorization",
    "slug": "thrive-theme",
    "type": "theme",
    "affected_version": "[*, 3.24.0)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.24.0",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2023-47783",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47783",
    "auth_type": "Auth",
    "cvss_score": 8.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
  },
  {
    "title": "Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates \u003c= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "responsive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 1.6.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.6.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13354",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13354",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Post SMTP \u003c= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via Email Log Exposure",
    "slug": "post-smtp",
    "type": "plugin",
    "affected_version": "* - 3.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-24000",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-24000",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Backup Migration \u003c= 1.4.3 - Information Exposure via Log Files",
    "slug": "backup-backup",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32686",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Jeg Elementor Kit \u003c= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets",
    "slug": "jeg-elementor-kit",
    "type": "plugin",
    "affected_version": "* - 2.6.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-4479",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-4479",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Security Master \u003c= 1.0.2 - Cross-Site Request Forgery",
    "slug": "wp-security-master",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49440",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49440",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ProfilePress \u003c= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes",
    "slug": "wp-user-avatar",
    "type": "plugin",
    "affected_version": "* - 4.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-23820",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-23820",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Opt-In Downloads \u003c= 4.07 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "halfdata-optin-downloads",
    "type": "plugin",
    "affected_version": "* - 4.07",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.07",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-10590",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-10590",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Gigaom Sphinx \u003c= 0.1 - Reflected Cross-Site Scripting",
    "slug": "go-sphinx",
    "type": "plugin",
    "affected_version": "* - 0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-23734",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23734",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Visual Portfolio, Photo Gallery \u0026 Post Grid \u003c= 2.17.1 - Unauthenticated CSS Injection",
    "slug": "visual-portfolio",
    "type": "plugin",
    "affected_version": "* - 2.17.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-2543",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2543",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Wicked Folders \u003c= 2.18.16 - Missing Authorization on ajax_add_folder",
    "slug": "wicked-folders",
    "type": "plugin",
    "affected_version": "* - 2.18.16",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.18.16",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0713",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0713",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
  },
  {
    "title": "Prisna GWT - Google Website Translator \u003c= 1.4.11 - Authenticated (Admin+) PHP Object Injection",
    "slug": "google-website-translator",
    "type": "plugin",
    "affected_version": "* - 1.4.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.11",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-8514",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-8514",
    "auth_type": "Privileged",
    "cvss_score": 9.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
  },
  {
    "title": "Social Sharing Toolkit \u003c= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "social-sharing-toolkit",
    "type": "plugin",
    "affected_version": "* - 2.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-4835",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-4835",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Recipe Maker \u003c= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'",
    "slug": "wp-recipe-maker",
    "type": "plugin",
    "affected_version": "* - 9.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.6.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-9650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-9650",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Tutor LMS – Migration Tool \u003c= 2.2.0 - Missing Authorization in tutor_lp_export_xml",
    "slug": "tutor-lms-migration-tool",
    "type": "plugin",
    "affected_version": "* - 2.2.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-1798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-1798",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "WP SinoType \u003c= 1.0 - Cross-Site Request Forgery",
    "slug": "wp-sinotype",
    "type": "plugin",
    "affected_version": "* - 1.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-9630",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-9630",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HT Mega – Absolute Addons For Elementor \u003c= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget",
    "slug": "ht-mega-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.4.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.9",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3307",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3307",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SVGator – Add Animated SVG Easily \u003c= 1.2.4 - Cross-Site Request Forgery",
    "slug": "svgator",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-48766",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-48766",
    "auth_type": "Unauth",
    "cvss_score": 7.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
  },
  {
    "title": "Anima \u003c= \u003c=1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "anima",
    "type": "theme",
    "affected_version": "* - 1.4.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-37248",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37248",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "PixTypes \u003c= 1.4.15 - Reflected Cross-Site Scripting",
    "slug": "pixtypes",
    "type": "plugin",
    "affected_version": "* - 1.4.15",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.15",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-40205",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-40205",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CoinPayments.net Payment Gateway for WooCommerce \u003c= 1.0.17 - Unauthenticated PHP Object Injection",
    "slug": "coinpayments-payment-gateway-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.0.17",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.17",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-47532",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-47532",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Add to Feedly \u003c= 1.2.11 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings",
    "slug": "add-to-feedly",
    "type": "plugin",
    "affected_version": "* - 1.2.11",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.11",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-2470",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-2470",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Export WordPress Data with Advanced Filters \u003c= 1.4.1 - Cross-Site Request Forgery",
    "slug": "wp-ultimate-exporter",
    "type": "plugin",
    "affected_version": "[*, 1.4.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2018-20968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20968",
    "auth_type": "Unauth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Hestia \u003c= 3.2.10 - Missing Authorization",
    "slug": "hestia",
    "type": "theme",
    "affected_version": "* - 3.2.10",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.10",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-53986",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-53986",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "WP Posts Carousel \u003c= 1.3.12 - Authenticated (Contributor+) PHP Object Injection",
    "slug": "wp-posts-carousel",
    "type": "plugin",
    "affected_version": "* - 1.3.12",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.12",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-39358",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-39358",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Webling \u003c= 3.9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "webling",
    "type": "plugin",
    "affected_version": "* - 3.9.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.9.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-31806",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31806",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Bilingual Linker \u003c= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bilingual-linker",
    "type": "plugin",
    "affected_version": "* - 2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13441",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13441",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Social Locker \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "social-locker-content",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51858",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51858",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Easy Textillate \u003c= 2.01 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "easy-textillate",
    "type": "plugin",
    "affected_version": "* - 2.01",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.01",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2303",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2303",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Multiple Shipping And Billing Address For Woocommerce \u003c= 1.5 - Unauthenticated PHP Object Injection",
    "slug": "different-shipping-and-billing-address-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2025-31087",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-31087",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Exclusive Addons for Elementor \u003c= 2.6.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid",
    "slug": "exclusive-addons-for-elementor",
    "type": "plugin",
    "affected_version": "* - 2.6.9.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.9.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-2503",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-2503",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "My Sticky Bar \u003c= 2.6.6 - Cross-Site Request Forgery to Sensitive Information Exposure",
    "slug": "mystickymenu",
    "type": "plugin",
    "affected_version": "* - 2.6.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.6.6",
    "to_inclusive": true,
    "severity": "low",
    "cve": "CVE-2023-7048",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-7048",
    "auth_type": "Unauth",
    "cvss_score": 3.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Woostagram Connect \u003c= 1.0.2 - Unauthenticated Arbitrary File Upload",
    "slug": "woostagram-connect",
    "type": "plugin",
    "affected_version": "* - 1.0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.2",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-49327",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-49327",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Royal Elementor Addons \u003c= 1.3.93 - Authenticated (Contributor+) Stored Cross-Site Scriting",
    "slug": "royal-elementor-addons",
    "type": "plugin",
    "affected_version": "* - 1.3.93",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.93",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31236",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31236",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Download Manager \u003c= 3.2.82 - Password Protected File Bypass",
    "slug": "downloadmanager",
    "type": "plugin",
    "affected_version": "* - 3.2.82",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.82",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-32131",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-32131",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Traveler \u003c 3.2.2 - Unauthenticated SQL Injection",
    "slug": "traveler",
    "type": "theme",
    "affected_version": "[*, 3.2.2)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.2.2",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-52714",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-52714",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "PDF \u0026 Print by BestWebSoft \u003c 2.0.3 - Reflected Cross-Site Scripting",
    "slug": "pdf-print",
    "type": "plugin",
    "affected_version": "[*, 2.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2018-20970",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2018-20970",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WordPress File Upload \u003c= 4.24.7 - Reflected Cross-Site Scripting",
    "slug": "wp-file-upload",
    "type": "plugin",
    "affected_version": "* - 4.24.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.24.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6651",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6651",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "SpiderContacts \u003c= 1.1.7 - Reflected Cross-Site Scripting",
    "slug": "spider-contacts",
    "type": "plugin",
    "affected_version": "* - 1.1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6272",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Rehub \u003c= 19.6.1 - Unauthenticated Local File Inclusion",
    "slug": "rehub-theme",
    "type": "theme",
    "affected_version": "* - 19.6.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "19.6.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-31231",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31231",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "kk Star Ratings \u003c= 5.4.5 - Missing Authorization",
    "slug": "kk-star-ratings",
    "type": "plugin",
    "affected_version": "* - 5.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-46639",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-46639",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "CSV Mass Importer \u003c= 1.2 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "csv-mass-importer",
    "type": "plugin",
    "affected_version": "* - 1.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-4190",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-4190",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPC Badge Management for WooCommerce \u003c= 2.4.0 - Missing Authorization",
    "slug": "wpc-badge-management",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-30537",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-30537",
    "auth_type": "Auth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
  },
  {
    "title": "ChatBot \u003c= 4.4.6 - Unauthenticated PHP Object Injection via Cookies",
    "slug": "chatbot",
    "type": "plugin",
    "affected_version": "* - 4.4.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.4.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2023-1650",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1650",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Our Team Showcase \u003c 1.3 - Cross-Site Scripting",
    "slug": "our-team-enhanced",
    "type": "plugin",
    "affected_version": "[*, 1.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2014-9523",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-9523",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Shareaholic \u003c= 9.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode",
    "slug": "shareaholic",
    "type": "plugin",
    "affected_version": "* - 9.7.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-4889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-4889",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Uncode \u003c= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed",
    "slug": "uncode",
    "type": "theme",
    "affected_version": "* - 2.9.1.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.9.1.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2024-13681",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13681",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  },
  {
    "title": "Footer Text \u003c= 2.0.3 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "footer-text",
    "type": "plugin",
    "affected_version": "* - 2.0.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-27860",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-27860",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Simple Keyword to Link \u003c= 1.5 - Cross-Site Request Forgery",
    "slug": "simple-keyword-to-link",
    "type": "plugin",
    "affected_version": "* - 1.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-30980",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-30980",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Privacy Policy Generator, Terms \u0026 Conditions Generator WordPress Plugin : WP Legal Pages \u003c= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation",
    "slug": "wplegalpages",
    "type": "plugin",
    "affected_version": "* - 3.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.4.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-8565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-8565",
    "auth_type": "Auth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  },
  {
    "title": "Minimal Coming Soon \u0026 Maintenance Mode \u003c= 2.16 - Missing Authorization to Export Settings/Theme Change",
    "slug": "minimal-coming-soon-maintenance-mode",
    "type": "plugin",
    "affected_version": "[*, 2.17)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.17",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2020-6166",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2020-6166",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "Bellows Accordion Menu \u003c= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "bellows-accordion-menu",
    "type": "plugin",
    "affected_version": "* - 1.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-49242",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49242",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "CSS \u0026 JavaScript Toolbox \u003c 12.0.3 - Authenticated (Subscriber+) Local File Inclusion",
    "slug": "css-javascript-toolbox",
    "type": "plugin",
    "affected_version": "[*, 12.0.3)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "12.0.3",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2025-3703",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3703",
    "auth_type": "Auth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Ultimate Form Builder Lite \u003c= 1.3.6 - SQL Injection to PHP Object Injection",
    "slug": "ultimate-form-builder-lite",
    "type": "plugin",
    "affected_version": "[*, 1.3.7)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.7",
    "to_inclusive": false,
    "severity": "critical",
    "cve": "CVE-2017-15919",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2017-15919",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Cincopa video and media plug-in \u003c 1.137 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "video-playlist-and-gallery-plugin",
    "type": "plugin",
    "affected_version": "[*, 1.137)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.137",
    "to_inclusive": false,
    "severity": "medium",
    "cve": "CVE-2015-10109",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2015-10109",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Finale Lite \u003c= 2.16.0 - Missing Authorization to Content Deletion",
    "slug": "finale-woocommerce-sales-countdown-timer-discount",
    "type": "plugin",
    "affected_version": "* - 2.16.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.16.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2023-47180",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-47180",
    "auth_type": "Unauth",
    "cvss_score": 7.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  },
  {
    "title": "Scheduled Announcements Widget \u003c= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "scheduled-announcements-widget",
    "type": "plugin",
    "affected_version": "* - 0.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0363",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0363",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Themify Builder \u003c= 7.5.7 - Open Redirect via 'tb_redirect_fail'",
    "slug": "themify-builder",
    "type": "plugin",
    "affected_version": "* - 7.5.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3032",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3032",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Neresa \u003c= 1.3 - Unauthenticated Local File Inclusion",
    "slug": "neresa-wp",
    "type": "theme",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-49383",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-49383",
    "auth_type": "Unauth",
    "cvss_score": 8.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "ThemeREX Addons \u003c= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode",
    "slug": "trx_addons",
    "type": "plugin",
    "affected_version": "* - 2.33.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.33.0",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-0682",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-0682",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WPFunnels \u003c= 3.5.26 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "wpfunnels",
    "type": "plugin",
    "affected_version": "* - 3.5.26",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.5.26",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-54696",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-54696",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Traffic Manager \u003c= 1.4.5 - Missing Authorization",
    "slug": "traffic-manager",
    "type": "plugin",
    "affected_version": "* - 1.4.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-41695",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-41695",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Webba Booking \u003c= 4.2.21 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "webba-booking-lite",
    "type": "plugin",
    "affected_version": "* - 4.2.21",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.2.21",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-36847",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-36847",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Consulting Elementor Widgets \u003c= 1.3.0 - Unauthenticated Local File Inclusion",
    "slug": "consulting-elementor-widgets",
    "type": "plugin",
    "affected_version": "* - 1.3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.0",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-37089",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-37089",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Popup Maker \u003c= 1.19.0 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "popup-maker",
    "type": "plugin",
    "affected_version": "* - 1.19.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.19.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-5561",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-5561",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Quiz Maker \u003c= 6.5.0.5 - Denial of Service",
    "slug": "quiz-maker",
    "type": "plugin",
    "affected_version": "* - 6.5.0.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "6.5.0.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-22027",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-22027",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  },
  {
    "title": "GEO my WordPress \u003c= 4.5.0.1 - Unauthenticated Local File Inclusion",
    "slug": "geo-my-wp",
    "type": "plugin",
    "affected_version": "* - 4.5.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.5.0.1",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6330",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6330",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WP Popups – WordPress Popup builder \u003c= 2.2.0.1 - Unauthenticated Full Path Disclosure",
    "slug": "wp-popups-lite",
    "type": "plugin",
    "affected_version": "* - 2.2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-6555",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6555",
    "auth_type": "Unauth",
    "cvss_score": 5.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  },
  {
    "title": "Word Search Puzzles game  \u003c= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting",
    "slug": "wha-wordsearch",
    "type": "plugin",
    "affected_version": "* - 2.0.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2022-37335",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-37335",
    "auth_type": "Auth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
  },
  {
    "title": "WhatsApp click to chat \u003c= 3.0.4 - Reflected Cross-Site Scripting",
    "slug": "manycontacts-bar",
    "type": "plugin",
    "affected_version": "* - 3.0.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-11686",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-11686",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "The Plus Addons for Elementor PRO \u003c= 4.1.9 \u0026 The Plus Addons for Elementor \u003c= 2.0.6 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "theplus_elementor_addon",
    "type": "plugin",
    "affected_version": "* - 4.1.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "4.1.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4331",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "The Plus Addons for Elementor PRO \u003c= 4.1.9 \u0026 The Plus Addons for Elementor \u003c= 2.0.6 - Authenticated (Contributor+) Privilege Escalation",
    "slug": "the-plus-addons-for-elementor-page-builder",
    "type": "plugin",
    "affected_version": "* - 2.0.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.6",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2021-4331",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-4331",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "BP Better Messages \u003c= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode",
    "slug": "bp-better-messages",
    "type": "plugin",
    "affected_version": "* - 2.4.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-49168",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-49168",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Twittee Text Tweet \u003c= 1.0.8 - Reflected Cross-Site Scripting",
    "slug": "twittee-text-tweet",
    "type": "plugin",
    "affected_version": "* - 1.0.8",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.0.8",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-0602",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-0602",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "wpForo Forum \u003c= 2.0.9 - Authenticated (Subscriber+) Arbitrary File Upload",
    "slug": "wpforo",
    "type": "plugin",
    "affected_version": "* - 2.0.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.0.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-40200",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-40200",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Upsell Order Bump Offer for WooCommerce \u003c= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "upsell-order-bump-offer-for-woocommerce",
    "type": "plugin",
    "affected_version": "* - 3.0.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-59565",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-59565",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Directorist \u003c= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task",
    "slug": "directorist",
    "type": "plugin",
    "affected_version": "* - 7.5.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "7.5.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2023-1889",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2023-1889",
    "auth_type": "Auth",
    "cvss_score": 6.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  },
  {
    "title": "Onlywire Multi Autosubmitter \u003c= 1.2.4 - Cross-Site Request Forgery to Cross-Site Scripting",
    "slug": "onlywire-multi-autosubmitter",
    "type": "plugin",
    "affected_version": "* - 1.2.4",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.4",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-54435",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-54435",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Display Template Name \u003c= 1.7.1 - Cross-Site Request Forgery",
    "slug": "display-template-name",
    "type": "plugin",
    "affected_version": "* - 1.7.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-28927",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-28927",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "Popup box \u003c 2.3.4 - Authenticated SQL Injection",
    "slug": "ays-popup-box",
    "type": "plugin",
    "affected_version": "[*, 2.3.4)",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.3.4",
    "to_inclusive": false,
    "severity": "high",
    "cve": "CVE-2021-24458",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24458",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "WordPress Button Plugin MaxButtons \u003c= 9.7.7 - Authenticated (Editor+) Stored Cross-Site Scripting",
    "slug": "maxbuttons",
    "type": "plugin",
    "affected_version": "* - 9.7.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "9.7.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-3026",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-3026",
    "auth_type": "Privileged",
    "cvss_score": 5.5,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Form Maker by 10Web \u003c= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting",
    "slug": "form-maker",
    "type": "plugin",
    "affected_version": "* - 1.15.32",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.15.32",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-13053",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-13053",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Surbma | Font Awesome \u003c= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "surbma-font-awesome",
    "type": "plugin",
    "affected_version": "* - 3.0",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "3.0",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-51798",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-51798",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP Editor \u003c= 1.2.9 - Authenticated (Admin+) PHAR Deserialization",
    "slug": "wp-editor",
    "type": "plugin",
    "affected_version": "* - 1.2.9",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.2.9",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2022-2446",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2022-2446",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Advanced Social Feeds Widget \u0026 Shortcode \u003c= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting",
    "slug": "advanced-facebook-twitter-widget",
    "type": "plugin",
    "affected_version": "* - 1.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.7",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-0951",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-0951",
    "auth_type": "Privileged",
    "cvss_score": 4.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Configurator Theme Core \u003c= 1.4.7 - Authenticated (Subscriber+) Privilege Escalation",
    "slug": "amz-configurator-core",
    "type": "plugin",
    "affected_version": "* - 1.4.7",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.4.7",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-3101",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-3101",
    "auth_type": "Auth",
    "cvss_score": 8.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Grid Shortcodes \u003c= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "grid-shortcodes",
    "type": "plugin",
    "affected_version": "* - 1.1",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.1",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-29797",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-29797",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "Fitness Calculators \u003c= 1.9.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting",
    "slug": "fitness-calculators",
    "type": "plugin",
    "affected_version": "* - 1.9.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.9.5",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2021-24272",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2021-24272",
    "auth_type": "Unauth",
    "cvss_score": 5.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
  },
  {
    "title": "GetResponse for WordPress \u003c= 5.5.35 - Authenticated (Contributor+) Stored Cross-Site Scripting",
    "slug": "getresponse-integration",
    "type": "plugin",
    "affected_version": "* - 5.5.35",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "5.5.35",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2024-31104",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-31104",
    "auth_type": "Auth",
    "cvss_score": 6.4,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
  },
  {
    "title": "AiBud WP \u003c= 1.8.5 - Authenticated (Admin+) Arbitrary File Upload",
    "slug": "aibuddy-openai-chatgpt",
    "type": "plugin",
    "affected_version": "* - 1.8.5",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.8.5",
    "to_inclusive": true,
    "severity": "high",
    "cve": "CVE-2025-23968",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-23968",
    "auth_type": "Privileged",
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "reCAPTCHA Jetpack \u003c= 0.2.2 - Cross-Site Request Forgery",
    "slug": "recaptcha-jetpack",
    "type": "plugin",
    "affected_version": "* - 0.2.2",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "0.2.2",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2025-32494",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2025-32494",
    "auth_type": "Unauth",
    "cvss_score": 4.3,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
  },
  {
    "title": "HUSKY - Products Filter Professional for WooCommerce \u003c= 1.3.6 - Unauthenticated Time-Based SQL Injection",
    "slug": "woocommerce-products-filter",
    "type": "plugin",
    "affected_version": "* - 1.3.6",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3.6",
    "to_inclusive": true,
    "severity": "critical",
    "cve": "CVE-2024-6457",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2024-6457",
    "auth_type": "Unauth",
    "cvss_score": 9.8,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  {
    "title": "Pods \u003c= 2.4.3 - Cross-Site Scripting",
    "slug": "pods",
    "type": "plugin",
    "affected_version": "* - 2.4.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "2.4.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-7956",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-7956",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  },
  {
    "title": "WP-RSS-Spreadshirt-3DCube-Gallery \u003c= 1.3 - Cross-Site Scripting",
    "slug": "spreadshirt-rss-3d-cube-flash-gallery",
    "type": "plugin",
    "affected_version": "* - 1.3",
    "from_version": "0.0.0",
    "from_inclusive": true,
    "to_version": "1.3",
    "to_inclusive": true,
    "severity": "medium",
    "cve": "CVE-2014-4553",
    "cve_link": "https://www.cve.org/CVERecord?id=CVE-2014-4553",
    "auth_type": "Unauth",
    "cvss_score": 6.1,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  }
]